feat(lab3): SSH signing + gitleaks pre-commit + history rewrite practice

[Maflock]

Goal

SSH commit signing, pre-commit secret scanning with gitleaks, and bonus history-rewrite practice.

Changes

• Added submissions/lab3.md with SSH signing proof, gitleaks blocked-commit log, tune-out reasoning, and bonus history-rewrite findings
• Added .pre-commit-config.yaml wired with gitleaks, detect-private-key, and check-added-large-files hooks

Testing

git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true
git config --global tag.gpgsign true

mkdir -p ~/.config/git
git config --global gpg.ssh.allowedSignersFile ~/.config/git/allowed_signers
echo "$(git config --global user.email) namespaces=\"git\" $(cat ~/.ssh/id_ed25519.pub)" \
  >> ~/.config/git/allowed_signers

git log --show-signature -1

pre-commit install
pre-commit run --all-files

cat > /tmp/leak-test.txt <<EOF
# This is a deliberate fake secret for Lab 3 testing
GH_PAT=ghp_16C7e42F292c6912E7710c838347Ae178B4a
EOF
cp /tmp/leak-test.txt submissions/leak-attempt.txt
git add submissions/leak-attempt.txt
git commit -m "test: should be blocked by gitleaks"

git log -p | grep -c 'ghp_'
git log -p | grep -c 'REDACTED'

Observed output:

commit 9783d75cd5d22699c7211877ef6ff7c15eccf1a6 (HEAD -> feature/lab3, origin/feature/lab3)
Good "git" signature for v.gorbatovskaia@innopolis.university with ED25519 key SHA256:[REDACTED]
Author: Veronika Gorbatovskaia <v.gorbatovskaia@innopolis.university>
Date:   Thu Jun 18 19:59:58 2026 +1000
    test: second signed commit

pre-commit installed at .git/hooks/pre-commit

Detect hardcoded secrets.................................................Passed
detect private key.......................................................Passed
check for added large files..............................................Passed

Detect hardcoded secrets.................................................Failed
- hook id: gitleaks
- exit code: 1

Finding:     GH_PAT=REDACTEDD
Secret:      REDACTED
RuleID:      github-pat
Entropy:     4.143943
File:        submissions/leak-attempt.txt
Line:        2
Fingerprint: submissions/leak-attempt.txt:github-pat:2

17:37PM INF 1 commits scanned.
17:37PM INF scan completed in 13.29ms
17:37PM WRN leaks found: 1

0
2

---

Artifacts & Screenshots

Artifacts:

• submissions/lab3.md
• .pre-commit-config.yaml

Screenshots:

• Verified badge commit:

Checklist

• Title is clear (feat(lab3): SSH signing + gitleaks pre-commit + history rewrite practice)
• No secrets/large temp files committed
• submissions/lab3.md exists
• Task 1 — SSH signing configured + Verified badge on commit
• Task 2 — .pre-commit-config.yaml + gitleaks demonstrably blocking
• Bonus — filter-repo rewrite practice documented