Tuesday, March 14, 2023

Rewriting your git history by removing secret\confidential values permanently


## Rewriting your git history, removing files permanently 

#### Problem:
 - Committing secret , Keys , token values in git is potentially security risk. 
 - If we deleted \ remove Keys , secret , token or any security information  later in the next commit .
 - Still security information in git history so it is very potential security risk.

#### Solution:
 - Rewriting your git history by removing secret\confidential values permanently [cheat sheet](https://res.cloudinary.com/da8kiytlc/image/upload/v1611932656/Cheatsheets/RewritingYourGitHistory-Cheatsheet-Final_weq1l2.pdf?ref=gitguardian-blog-automated-secrets-detection)

` Installation of git-filter-repo `

1. Install Python.
2. Check "Add Python to environment variables" in Advance options while installing Python.
3. [Clone repository](https://github.com/newren/git-filter-repo.git).
4. Run the command git --exec-path to see your Git exe directory.
5. From the git-filter-repo repo's root directory, copy the file git-filter-repo (about 160KB) into your Git exe directory.
6. Run the command "Which python" .
7. Open git-filter-repo file ,replace first line "/usr/bin/python" with path of python (from above point).
8. Type the command git filter-repo.If it works, you should get the message "No arguments specified." 	
 
Now We can tell git-filter-repo to search for the hard-coded token\secret value , and replace with the environment variable by adding this line to replacements.txt:
 
Example

```sh
    ‘123abc’==>ENV[‘AUTH_TOKEN’]
```

If you have multiple secrets you need to excise, you can have more than one rule like this in replacements.txt.( place in the parent directory)

- Run git filter repo command with replace text switch for replacement.txt

```sh
 git filter-repo --replace-text replacements.txt
```

- Add remote Url to your local repository .Note:remote url mapping would removed after running git filter repo command

 Syntax

	```sh
		git remote add name [remoteUrl]
	```
 Example

  ```sh
    	git remote add aztd-SFTPAssistantBot https://github.com/UserName/aztd-SFTPAssistantBot.git
  ```
 Syntax
	```sh
		git push --set-upstream  main  --force
	```
 Example

 ```sh
     git push --set-upstream aztd-SFTPAssistantBot main  --force
 ```

- References

  [the-secret-is-beyond-the-last-commit](https://blog.gitguardian.com/rewriting-git-history-cheatsheet/#the-secret-is-beyond-the-last-commit?utm_source=product&utm_medium=product&utm_campaign=onboarding)
  [git-filter-repo-commands-output-nothing-on-windows](https://stackoverflow.com/questions/69355161/git-filter-repo-commands-output-nothing-on-windows)
    

No comments:

Post a Comment