feat(lab3): SSH signing + gitleaks pre-commit + history rewrite practice #4

Lab 3 — Submission

Task 1: SSH Commit Signing

Local configuration

git config --global gpg.format → ssh
git config --global user.signingkey → ~/.ssh/DevSecOps.pub
git config --global commit.gpgsign → true

Local verification

Output of git log --show-signature -1:

commit d0390ca29a3ea0307ad5993a6fd53a3862911bc5 (HEAD -> feature/lab3, origin/feature/lab3)
Good "git" signature for s.muravev@innopolis.university with ED25519 key SHA256:UqBH0obBkmnJt6Eh6p3IFJSMimjB+lbcSW05JDjQrfU
Author: StefFashka <s.muravev@innopolis.university>
Date:   Thu Jun 18 17:02:03 2026 +0800

    test: first signed commit

GitHub verification

Direct link to your most recent commit on GitHub: https://github.com/StefFashka/DevSecOps-Intro/commit/d0390ca29a3ea0307ad5993a6fd53a3862911bc5
Screenshot of the Verified badge:

One-paragraph reflection (2-3 sentences)

What STRIDE-R (Repudiation) scenario would a forged-author commit enable in a real team's codebase? How does the Verified badge make that attack visible?

A forged-author commit could allow an attacker to add malicious code while pretending to be a trusted team member. This makes it difficult to know who actually made the change and who is responsible for it. The GitHub Verified badge helps prevent this by showing that a commit was signed by the real author. If a commit is unverified, reviewers can quickly see that the author's identity may not be trustworthy.

Task 2: Pre-commit + gitleaks

`.pre-commit-config.yaml` (paste the full content)

repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.24.0
    hooks:
      - id: gitleaks

  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v4.6.0
    hooks:
      - id: detect-private-key
      - id: check-added-large-files

pre-commit install output

pre-commit installed at .git\hooks\pre-commit

The blocked commit

Output of the git commit that gitleaks blocked (the failing hook output):

warning: in the working copy of 'submissions/leak-attempt.txt', LF will be replaced by CRLF the next time Git touches it
Detect hardcoded secrets.................................................Failed
- hook id: gitleaks
- exit code: 1

○
    │╲
    │ ○
    ○ ░
    ░    gitleaks

Finding:     GH_PAT=REDACTED
Secret:      REDACTED
RuleID:      github-pat
Entropy:     4.143943
File:        submissions/leak-attempt.txt
Line:        2
Fingerprint: submissions/leak-attempt.txt:github-pat:2

7:35PM INF 1 commits scanned.
7:35PM INF scanned ~355 bytes (355 bytes) in 134ms
7:35PM WRN leaks found: 1

detect private key.......................................................Passed
check for added large files..............................................Passed

Tune-out exercise

Suppose a teammate insists they need to commit AKIA* strings because they're documentation examples in docs/. Briefly describe two approaches:

Inline allowlist — [allowlist] block in .gitleaks.toml. When is this OK? This is acceptable when a file contains known fake credentials used for testing or documentation. It ignores only specific values while still allowing gitleaks to scan the rest of the file for real secrets.

Path exclusion — paths: [docs/] in .gitleaks.toml. When is this risky? This is risky because gitleaks will completely skip the excluded directory during scans. If someone accidentally commits a real API key or password inside docs/, the leak may go undetected.

Bonus: History Rewrite

Before

1c23df4 (HEAD -> master) docs: add usage notes
9b34ef1 feat: empty log
7a12b4c feat: add config
fcb48fc init

Output of git log -p | grep -c 'ghp_': 2

After

e09a51d (HEAD -> master) docs: add usage notes
a6a9943 feat: empty log
2112db1 feat: add config
fcb48fc init

Output of git log -p | grep -c 'ghp_': 0 Output of git log -p | grep -c 'REDACTED': 2

The two-step pattern in real life

git filter-repo --replace-text replacements.txt — rewrite locally
Secret Rotation and Revocation (Token Deactivation) — Is the mandatory second step because rewriting Git history only removes the secret from the repository. It does not prevent someone from using the secret if they already copied it. If the token was exposed, it should be revoked and replaced with a new one. This ensures that the old leaked token can no longer be used by anyone.

Two real-world gotchas you discovered (2 sentences each)

I discovered that executing git filter-repo on cross-platform environments like WSL on top of Windows folders (/mnt/c/) triggers strict safety errors like "not a fresh clone," which requires appending the explicit --force flag to run.
Additionally, standard pip and environment setup routines broke on a fresh modern Python installation managed by uv inside Windows, forcing me to bypass traditional execution paths and rely on uv run to abstract the dependencies seamlessly.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(lab3): SSH signing + gitleaks pre-commit + history rewrite practice #4

Diff view

Diff view

There are no files selected for viewing

Lab 3 — Submission

Task 1: SSH Commit Signing

Local configuration

Local verification

GitHub verification

One-paragraph reflection (2-3 sentences)

Task 2: Pre-commit + gitleaks

`.pre-commit-config.yaml` (paste the full content)

pre-commit install output

The blocked commit

Tune-out exercise

Bonus: History Rewrite

Before

After

The two-step pattern in real life

Two real-world gotchas you discovered (2 sentences each)

feat(lab3): SSH signing + gitleaks pre-commit + history rewrite practice #4

Are you sure you want to change the base?

feat(lab3): SSH signing + gitleaks pre-commit + history rewrite practice #4

Uh oh!

Uh oh!

Diff view

Diff view

There are no files selected for viewing

Lab 3 — Submission

Task 1: SSH Commit Signing

Local configuration

Local verification

GitHub verification

One-paragraph reflection (2-3 sentences)

Task 2: Pre-commit + gitleaks

.pre-commit-config.yaml (paste the full content)

pre-commit install output

The blocked commit

Tune-out exercise

Bonus: History Rewrite

Before

After

The two-step pattern in real life

Two real-world gotchas you discovered (2 sentences each)

`.pre-commit-config.yaml` (paste the full content)