## Rewriting your git history, removing files permanently
#### Problem:
- Committing secret , Keys , token values in git is potentially security risk.
- If we deleted \ remove Keys , secret , token or any security information later in the next commit .
- Still security information in git history so it is very potential security risk.
#### Solution:
- Rewriting your git history by removing secret\confidential values permanently [cheat sheet](https://res.cloudinary.com/da8kiytlc/image/upload/v1611932656/Cheatsheets/RewritingYourGitHistory-Cheatsheet-Final_weq1l2.pdf?ref=gitguardian-blog-automated-secrets-detection)
` Installation of git-filter-repo `
1. Install Python.
2. Check "Add Python to environment variables" in Advance options while installing Python.
3. [Clone repository](https://github.com/newren/git-filter-repo.git).
4. Run the command git --exec-path to see your Git exe directory.
5. From the git-filter-repo repo's root directory, copy the file git-filter-repo (about 160KB) into your Git exe directory.
6. Run the command "Which python" .
7. Open git-filter-repo file ,replace first line "/usr/bin/python" with path of python (from above point).
8. Type the command git filter-repo.If it works, you should get the message "No arguments specified."
Now We can tell git-filter-repo to search for the hard-coded token\secret value , and replace with the environment variable by adding this line to replacements.txt:
Example
```sh
‘123abc’==>ENV[‘AUTH_TOKEN’]
```
If you have multiple secrets you need to excise, you can have more than one rule like this in replacements.txt.( place in the parent directory)
- Run git filter repo command with replace text switch for replacement.txt
```sh
git filter-repo --replace-text replacements.txt
```
- Add remote Url to your local repository .Note:remote url mapping would removed after running git filter repo command
Syntax
```sh
git remote add name [remoteUrl]
```
Example
```sh
git remote add aztd-SFTPAssistantBot https://github.com/UserName/aztd-SFTPAssistantBot.git
```
Syntax
```sh
git push --set-upstream main --force
```
Example
```sh
git push --set-upstream aztd-SFTPAssistantBot main --force
```
- References
[the-secret-is-beyond-the-last-commit](https://blog.gitguardian.com/rewriting-git-history-cheatsheet/#the-secret-is-beyond-the-last-commit?utm_source=product&utm_medium=product&utm_campaign=onboarding)
[git-filter-repo-commands-output-nothing-on-windows](https://stackoverflow.com/questions/69355161/git-filter-repo-commands-output-nothing-on-windows)
Azure Cloud Solution Architect, Full-Stack Development in .Net Eco system, Senior Manager at Capgemini
Showing posts with label git. Show all posts
Showing posts with label git. Show all posts
Tuesday, March 14, 2023
Rewriting your git history by removing secret\confidential values permanently
Labels:
git,
git-filter-repo,
rewrite- git,
rewrite- git-history
Subscribe to:
Posts (Atom)