Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
feat(lab3): SSH signing + gitleaks pre-commit + history rewrite practice #3
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(lab3): SSH signing + gitleaks pre-commit + history rewrite practice #3
Changes from all commits
7e188619783d75d3bcfe531652496c127c6File filter
Filter by extension
Conversations
Uh oh!
There was an error while loading. Please reload this page.
Jump to
Uh oh!
There was an error while loading. Please reload this page.
There are no files selected for viewing
Lab 3 - Submission
Task 1: SSH Commit Signing
Local configuration
git config --global gpg.format->sshgit config --global user.signingkey->/Users/verdr/.ssh/id_ed25519.pubgit config --global commit.gpgsign->trueLocal verification
Output of
git log --show-signature -1:GitHub verification
One-paragraph reflection (2-3 sentences)
STRIDE-R (Repudiation) becomes real when an attacker crafts a commit that appears to come from a trusted developer — the team can't reliably trace the action to its true source, and the framed developer can plausibly deny it. In a real repository, this tactic could silently introduce vulnerabilities, disable test suites, or rewrite security rules while deflecting accountability. Signed commits enforced by the Verified badge neutralise this threat: without a valid signature bound to the claimed author's key, the forgery is exposed and the attack loses its cover.
Task 2: Pre-commit + gitleaks
.pre-commit-config.yaml(paste the full content)pre-commit installoutputThe blocked commit
Output of the
git committhat gitleaks blocked:Tune-out exercise
Inline allowlist — Adding an inline allowlist in
.gitleaks.tomlworks well when you're dealing with a known, deliberate placeholder — like a documentation-only token that isn't real and can't be exploited. The benefit is surgical precision: the rule stays active everywhere else in the repo, so unrelated leaks still get caught.Path exclusion — Carving out an entire directory like
docs/is more dangerous because it creates a blind spot where real secrets could slip in unnoticed later. It's an easy fix for noisy doc folders, but you're swapping coverage for convenience — use it sparingly and only when you trust everything that lands in that path.Bonus: History Rewrite
Before
Output of
git log -p | grep -c 'ghp_': 2After
Output of
git log -p | grep -c 'ghp_': 0 Output ofgit log -p | grep -c 'REDACTED': 2The two-step pattern in real life
git filter-repo --replace-text replacements.txt- rewrite locallyTwo real-world gotchas you discovered (2 sentences each)
git filter-repochanges every commit ID, so teammates must explicitly resync — a simple pull won't cut it. On a real team repo, coordinating the force-push isn't optional cleanup; it's part of handling the incident properly.Uh oh!
There was an error while loading. Please reload this page.