## Rewriting your git history, removing files permanently #### Problem: - Committing secret , Keys , token values in git is potentially security risk. - If we deleted \ remove Keys , secret , token or any security information later in the next commit . - Still security information in git history so it is very potential security risk. #### Solution: - Rewriting your git history by removing secret\confidential values permanently [cheat sheet](https://res.cloudinary.com/da8kiytlc/image/upload/v1611932656/Cheatsheets/RewritingYourGitHistory-Cheatsheet-Final_weq1l2.pdf?ref=gitguardian-blog-automated-secrets-detection) ` Installation of git-filter-repo ` 1. Install Python. 2. Check "Add Python to environment variables" in Advance options while installing Python. 3. [Clone repository](https://github.com/newren/git-filter-repo.git). 4. Run the command git --exec-path to see your Git exe directory. 5. From the git-filter-repo repo's root directory, copy the file git-filter-repo (about 160KB) into your Git exe directory. 6. Run the command "Which python" . 7. Open git-filter-repo file ,replace first line "/usr/bin/python" with path of python (from above point). 8. Type the command git filter-repo.If it works, you should get the message "No arguments specified." Now We can tell git-filter-repo to search for the hard-coded token\secret value , and replace with the environment variable by adding this line to replacements.txt: Example ```sh ‘123abc’==>ENV[‘AUTH_TOKEN’] ``` If you have multiple secrets you need to excise, you can have more than one rule like this in replacements.txt.( place in the parent directory) - Run git filter repo command with replace text switch for replacement.txt ```sh git filter-repo --replace-text replacements.txt ``` - Add remote Url to your local repository .Note:remote url mapping would removed after running git filter repo command Syntax ```sh git remote add name [remoteUrl] ``` Example ```sh git remote add aztd-SFTPAssistantBot https://github.com/UserName/aztd-SFTPAssistantBot.git ``` Syntax ```sh git push --set-upstreammain --force ``` Example ```sh git push --set-upstream aztd-SFTPAssistantBot main --force ``` - References [the-secret-is-beyond-the-last-commit](https://blog.gitguardian.com/rewriting-git-history-cheatsheet/#the-secret-is-beyond-the-last-commit?utm_source=product&utm_medium=product&utm_campaign=onboarding) [git-filter-repo-commands-output-nothing-on-windows](https://stackoverflow.com/questions/69355161/git-filter-repo-commands-output-nothing-on-windows)
Azure Cloud Solution Architect, Full-Stack Development in .Net Eco system, Senior Manager at Capgemini
Tuesday, March 14, 2023
Rewriting your git history by removing secret\confidential values permanently
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment