## Rewriting your git history, removing files permanently
#### Problem:
- Committing secret , Keys , token values in git is potentially security risk.
- If we deleted \ remove Keys , secret , token or any security information later in the next commit .
- Still security information in git history so it is very potential security risk.
#### Solution:
- Rewriting your git history by removing secret\confidential values permanently [cheat sheet](https://res.cloudinary.com/da8kiytlc/image/upload/v1611932656/Cheatsheets/RewritingYourGitHistory-Cheatsheet-Final_weq1l2.pdf?ref=gitguardian-blog-automated-secrets-detection)
` Installation of git-filter-repo `
1. Install Python.
2. Check "Add Python to environment variables" in Advance options while installing Python.
3. [Clone repository](https://github.com/newren/git-filter-repo.git).
4. Run the command git --exec-path to see your Git exe directory.
5. From the git-filter-repo repo's root directory, copy the file git-filter-repo (about 160KB) into your Git exe directory.
6. Run the command "Which python" .
7. Open git-filter-repo file ,replace first line "/usr/bin/python" with path of python (from above point).
8. Type the command git filter-repo.If it works, you should get the message "No arguments specified."
Now We can tell git-filter-repo to search for the hard-coded token\secret value , and replace with the environment variable by adding this line to replacements.txt:
Example
```sh
‘123abc’==>ENV[‘AUTH_TOKEN’]
```
If you have multiple secrets you need to excise, you can have more than one rule like this in replacements.txt.( place in the parent directory)
- Run git filter repo command with replace text switch for replacement.txt
```sh
git filter-repo --replace-text replacements.txt
```
- Add remote Url to your local repository .Note:remote url mapping would removed after running git filter repo command
Syntax
```sh
git remote add name [remoteUrl]
```
Example
```sh
git remote add aztd-SFTPAssistantBot https://github.com/UserName/aztd-SFTPAssistantBot.git
```
Syntax
```sh
git push --set-upstream main --force
```
Example
```sh
git push --set-upstream aztd-SFTPAssistantBot main --force
```
- References
[the-secret-is-beyond-the-last-commit](https://blog.gitguardian.com/rewriting-git-history-cheatsheet/#the-secret-is-beyond-the-last-commit?utm_source=product&utm_medium=product&utm_campaign=onboarding)
[git-filter-repo-commands-output-nothing-on-windows](https://stackoverflow.com/questions/69355161/git-filter-repo-commands-output-nothing-on-windows)
Azure Cloud Solution Architect, Full-Stack Development in .Net Eco system, Senior Manager at Capgemini
Tuesday, March 14, 2023
Rewriting your git history by removing secret\confidential values permanently
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment