From a3c034db2e20114fc25f02e525ac8b97baac0fa1 Mon Sep 17 00:00:00 2001 From: arseniy Date: Fri, 12 Jun 2026 20:58:45 +0300 Subject: [PATCH 1/3] PR template --- .github/PULL_REQUEST_TEMPLATE.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 .github/PULL_REQUEST_TEMPLATE.md diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md new file mode 100644 index 000000000..33d544fe2 --- /dev/null +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -0,0 +1,23 @@ +## Goal + + +## Changes + +- + +## Testing + +```bash +# paste commands + output here +``` + +## Artifacts & Screenshots + +- `submissions/labN.md` + +--- + +## Checklist +- [ ] Title follows `feat(labN): ` format +- [ ] No secrets or large temp files committed +- [ ] Submission file at `submissions/labN.md` exists \ No newline at end of file From 39bcbcf9af97afcf45a97fff0e3f49f60db01e5d Mon Sep 17 00:00:00 2001 From: arseniy Date: Wed, 17 Jun 2026 18:38:21 +0300 Subject: [PATCH 2/3] test: first signed commit --- submissions/lab3.md | 1 + 1 file changed, 1 insertion(+) create mode 100644 submissions/lab3.md diff --git a/submissions/lab3.md b/submissions/lab3.md new file mode 100644 index 000000000..61fa24bee --- /dev/null +++ b/submissions/lab3.md @@ -0,0 +1 @@ +lab3 signing test From af238205b8553a1f11045e26c65b40654b866710 Mon Sep 17 00:00:00 2001 From: arseniy Date: Wed, 17 Jun 2026 19:06:33 +0300 Subject: [PATCH 3/3] feat(lab3): SSH signing + gitleaks pre-commit + history rewrite practice --- .pre-commit-config.yaml | 11 +++ submissions/image.png | Bin 0 -> 18198 bytes submissions/lab3.md | 148 +++++++++++++++++++++++++++++++++++++++- 3 files changed, 158 insertions(+), 1 deletion(-) create mode 100644 .pre-commit-config.yaml create mode 100644 submissions/image.png diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml new file mode 100644 index 000000000..8ab859da7 --- /dev/null +++ b/.pre-commit-config.yaml @@ -0,0 +1,11 @@ +repos: + - repo: https://github.com/gitleaks/gitleaks + rev: v8.21.0 + hooks: + - id: gitleaks + + - repo: https://github.com/pre-commit/pre-commit-hooks + rev: v5.0.0 + hooks: + - id: detect-private-key + - id: check-added-large-files \ No newline at end of file diff --git a/submissions/image.png b/submissions/image.png new file mode 100644 index 0000000000000000000000000000000000000000..cbc9dfeaee34e822d1c0009440ddbb6ceb645c6f GIT binary patch literal 18198 zcmeIacT`i|*FVT(!-lAU(h(_2N2-7{krH|fy(vBPE?rPTI)>g`LP;o6LJLJiT98iY zO?nS4^zyqt>i2!$nOU=D{+P99&6>Lw-rNHz{ut5D*Z7 z*I$4COj*#qB_NPNf?i2#zBSsI^nN?IP>(xP;fYb?0Wl|a+<1BCF3FusaWU^q zMva)Dt~Q&0uL*RBEGh z*XKIosd#Z=q3xx+e@eVlkcW5$m6er&)%+$#_-(I?UE%kxXJrv992|6Aco?o7Iw^S% z@~80EPi6usac?}HHk#C_YYc$ZeRR5vN}NW%gvgg!x|34{OZhdu1*uzisF@B+FUct+ zOm0SFlOK`%bNz1x*9R64I@j>+3(k>=nhII}LsA>}|CA#5^fZw8@A;$b|550Fi1YH_ zLjV5_|CgkcpU>!R5nSr@{FSsc2r4Wr^ZnO!{P%db%lAf0%+=NPE-?9iA2U4MZ~p5& z%F11K6jB(nT9{yzvdM85t=H1W5Op!A&YY%=?TnP5I!8PU+6{AMH@SNIe%39y z(Dl|91f#qLDvNW4q^T;NH@4-|$_tkCmy1Lc`SNb|pmuf7YZ6aSz_kAV*ctz~e5*>5?U7t2Gf%bp?wEp>Z+4m=6_O^A25B#>T`EI0p z^E;d`@tZEPD`f~NY;SK18|gu)g}(#OKwPYS+HHxCvAkfd%Bph4c?*x3SW#z9$W9IH z+tC&9z&N}YiIOu-#~Kda%B@|Ge*xYtc3b|j8Rk9h0`w7aVvqeG@j}s=XeNDuQ=@Og zQy9O0k#`|%y}qvRZi`O8aFH{ao0r|0pU$)?gU=G*Y3E?E>=<^F`eu17H7uf=mqTWq ze15co*{RF%eZs_IT$*mVC(|AphN<76JZVA3O=@K|(iPmQbZ?xyLi<;`@Yh90TSeJ% zdezI7`57y%uISgFiH-IbppZmylvDAW&ihaG3K%;DWS~BV;sAf}Sh55Vf zlGK%}W$68tG)b5~6lN&mU6P-Vu#R27V-A8cL&iQZ)H1)vStHjPYn0`cW2(w3)osGSo}zZb4@!XL?+MznqGZl|ESlb}5@Lu((S*v(r1 zT4C|;#Dk>QbEj60g&QrC^J%RUywdU*xB^tvhhpy|evYVB` zCDwO?o^A9`5LVcS4t0T!M=oBf96z-vK(F;tL4azuI=GF+v0`bl}jtQxnv5BzQISfq11n zlFnNTZ2(GkIiM6R^Gk<_RQY>l7#s<%d}bo?wztVBj`L99B8)19YhsMcWTFc7iuVqL zqw2x%{S`gk!6UM|rfy>o{}#H_Y=5_?ukSVV15b!kGn@#sm?7H;q98jhYX$4{2PMWi zEj2+uj|8m^+mA}7446+Q07Kk&x81l*(qknq+C{NH^@OgMdhYA3*m5(YE7~Miw1o5b z9OWK8IrY{B4_Mi*vUt?Cj>G#^L@pDN#Jx^1;E%)TmdUIQIV>L=hA;h@U^5tJwLs#| zu!bTBvZD3vwcC$BuyJoV*UUTDm{pB?+f~&qkGKAOsJ+Q!NS7P!(6WdMnE4uLj=4co z!eh5`+<*F|vQC?MGzOMd;_6_09yrAnw@#8vRcSX^{1Dw}JB@P7Fp!5%qWI?(4(+@w zEpuYUoq9>u0!XE@NG5|(<{HMv{R+uwIhXZ%ZK3rs(%Xm$v)k`ttreCNjzp@gwWC}m zrSe^EqT;Rxcqim_+)J|}&XpdkDQY`=ZtM~oPq>Mb&}MdpTk`0^77kPr>iPCWDRNxV zW*O)@SyhX6~-s|qcx~X9X zkZ|Fd?6)ftUJ;^&lnIR9LGA|B)#CFlI~I^RaU^e9e3B44}r?@Fb6TKa~VEimzZ z4ckrNElKzsMWVx-QCndFv5J7c*mOaE0y+z4ga==Q*98}b_v#TQREBohpw;P%^cyAD zwD5xe(8!Iyw|B8mp0a!d`Rbgo^10ij$@C{g{ewSObA9kH+cF7#QR6O##QF{fE`#f8 zc^wCrSbr@oe;wp?VfTHmFHPFvfCYqg>knPM!xpMqh%o!2-i3b9v&?+E$vL{wE zuPT#hqoJLg>xg3dMke3DEtC|=eNcA5`VP>lqVGu`c3#ahNX~D$wR1`OYcpIH%4j#x zVuV_8jz?qnQO7K?tSO=3G-STd)%JX!{(Yz>@NeX zJ=i0kY_j!cc<3BAT3mE8U#2o_Xo#DC#nFJae6}J%1NHUF>-j1rF}!0c{OOEPUfwxiSYrpYB#z^e4Nape-{ z00S`XI=AAEf3`PWM7N_uZ7X?+=nuD`oAr5|&HUHM(<5v$1R9=BV(0v>wdN1AzS}w|7WXxj z(l(|W?mH0raJ_-hw`gqH>8!Oh2z$SNx`r|T?2m8oj&1NuuHhw4S)qYju(a{(FaDISep9;hci}Kj2Jf`@Xoo08ci0NJ|CJDT;n=Ak z;9AufC=0DYA|{(7XQV#8MS_KD=H?HoFrK-}N)h%)XMS_se?dzEcx?Qnve#vADV;k5W4aAeGC6mxz-pWT0R8~X;A z|G(#Uy;BJ7Fyj$;{o((>6^u?1aH-tK z9rgZod&6})SlpRLZOimXNNqx5JU@^oMUVnwDsOlIyb=D|Nl3m2Mer+4FPU8E#+{Zn zeK5|Mm7ins`F!@y$yvfAZ$w39r2xO6H+IGuQJFh7B5D;`;VML35L(528|0W%RHW2p z6qVY|>pX;|L^D{xet3}hkV_K(dCKLe4l{L`MJsr&W&Y^e=kdu$C3&ER_yRQ#WHB*Q$Hd6YD&kQnEG#^a_rmt~zoF(~ zFDrL(-7))EN^#A}$*D}QC^R&*zhj4FhmW5kI8~z#iJ7Sz{IK3@-% zmX+;%Q`%1H5SIZe?|p^fxCTre?PD5>4;hyySS6IGPJ6qV%hBI293D8ru7O1 zrn`&x4n@WKL@C57Kf&XAgIHV30wAwm)e_*l)?&Yf$gYI(jrca+Lo$+w-{!2L;~RGh ztE(07`BcAIcxrKMlYIJ~r|ZZmY0>B4pv8K(C~+xkL0><_w;spAVVWb(ld4xK?`7^7-?pDL)DT@;7 zNKMmS^MILVRe62nvxD`a3c}!-u)|vu9+-*_9uQ=zUOB_o0LIXWR!Qe2g4iYK*{}^l zCQQB*O3PnhPLj*KQm*YsdC{%f4EA%PhPB%**PEq>A8gXpeD(M(pbx+B8Gd@TC-PAg z=)11jdx?cNLYD9gZ++_Up^C*7Frhra;0u=KGJSuxVFH5z;?7@UgOOAdsfq zt;b?E!LZC%EfVV`!iMj~7~M;yR~$w_G6Z^1qFaF-lj z4G>tmLv!5X4&N)sEmC>dVDKvtHb2lwbCF5Ar(_0O@-UmI@^0|j9;j|@JcbsiZO8X6123m6qtO& z3U6&2nQCX`cBK}@JZVhwalIq7#QWK7!*`-}x#NslaPZ-L^%B3*NxvD>7(0Y$%EKW{dJ*>Z z`oOwf@_82*%j9b{8^aJt7~3Fw*!`OckgWA*pU+ zEMwWRqilTk`*pPXga$L{-$?K`dF4{%=o*FD485doO7TGW!&`9^{6FvYpOg$kTEog? z@t&qV65rX*3WSpPHMQEQKk42eRvL^IH_D^nGRmuK`Pq8gXlHDOpIoFn3l5hCtUXj? zy|tJgbvUHY1d?WJDDtnvSGt@d5C}e-A;mfScb!ltVUl~Ly7&?f^_AeJeBFV6(tP|r z%V!v~M1}G#vhBw98fDF9C}Te_JuKKek`_Mvfrdb1pRd_7Ei1@V+I^naTA;HmI6RVO zJ)30TxM+!iEPG6=?~a%6^)=!(s+wx#pJW)rR#(4fDA8Su^mp#Dm}|c)0FSg+U1`;? zSexF_+Bx)`w@i>3y76-IZYoW2;=)|AwMXO31a!(30WQ>@J zzmzmTkR-TyYagg-sA!`k)Z^{PpH&8;5Ba zh9+P;WX@sJsDK{C@2xpmQ?j3dC=l2()+erKva}Q~D7J~qCNdTs^d0e48H?1uQj+x& zJ1!Cyt=;a+UVUK_;QX&XIjVBSV`Cx= zYmZkuYUd(F_&qk=T8r5pGzEuoFuxtBXJWnRTw`6qdn-hYW$|*o$cZ5n>(I(vXF|Gd zG}2%{P|;E55-w^re@=LL9yxR5NvGAJAfkzjn{DgTc-?oacApSuvsXQJK|tu5>*tI_ zP4$ww7X&jN4O-~HNA3x`OZ31p=I*=`;@rw;IPN_m&*tTxDNsXZDa18>l_-Q;-hMQp z1M)NO;bQPIut{hrZqBRhy?EHKe2M8_d2m+hD5Uzlm#-nM7+|r?F{8w(E|b=|+1I{V zh}nHFQ5?8jV2wG#Q+K`H7VbKnLnVJ{%}VU934wo1-kx=%Jn4P9aN(}ZeO0}V$KNH* z;?yGijfe)rWEwNbd15k&xnPMLq^_tKHK;gjo1Fi{|9aBor;r5G4L-x&SvQ~tYNb=j zovXeV%Qn_(g-p+HxG)`$4S1Ev2CR9Ywrzr*MK$*45bPtPg58Vzko9BNmeM0|kZFI> zBJXgTrDjJ_oZV@y(|2jNxd_44RpgV-4fo(85+}f`n6R%}>`qf4cx=_{(()-$J*c5{#0#+CuL3@$!XXo)j*j{YjX5@kPT<^WqepS3UC=hPQrp!SO5Y{stvc z0%wv7E%ws-F0tM{G0r*>3{tvgJm+Xe&dtE{t8U$vj}5n+I4YT1bJOqhcoo}6!=4ER zcoESGqDcRhZuOnL&YYeLBz0X* zgHxmy7P9+#FWmgKyb};DSDQAf`S#rG@NC-+8^29Aj6*p1`<^@#o9gH;7);o$YJYOg3pU&;z1B-^eE(cr_gK6wH8}Pz8;A^2qLZW1Bc6j{1})xh$)hAx=rM;hp>jL-p1d3ti_gJ-l5%xBj>l z?jT%Qk87b}ko52Q4FDLB1`H}#Fsa-s_Dx)iW{}+RQ-4wdgSD8N*%kGL_!p=)%Zhnk zs1_pBSuE6hu=l5kJ6#tCws`Lq`6D%aolH2}wGHx)6R5l`EuT`u)kwN_Y)>@J{jCN^ zqf!yabJnP*pvbGw`YRM8FoMX9nb*FRmGXG5;rvzO$b7F451Y^!#l3~Py!?Re z;;plwrQ(fPnwa%Z7Y_*-BHeNw3{LPixwHUq+m&NAF(0Dl< zUb>SO9uOS!M1?Zgm7buFWZU$*MQ}`=8=zWWlA=I?D z@zH^;#?SY%{JSZ}s?JbGGRU6b^k4;H70X4s9p+-uUa7kEaYx=Uga3-I7q4qmZIFqVxOj` zV1k9EQsU#ZZ{ymO()qdCLeCvo2J5sM(p@*!YYq4Q47cWj)MgWrhInkMuI!7c3lLR_ zO-cVd?Hv71{ThEPZmQ4`G9`MkxW7p*guW?J0v9GP9P5|E-s-j`!V_VZCKhP^)SLuQQ=`^&={ZZmK7h7i1}%1X%y(kzv4!GYU{Ia^?4 zPg@>5)tT7;>3e(#r$Km}z+$Q44<9^bYI%Zd8U~jdLqivYH?=BqBvw9NmG4nVSXIzG z|0W+t*qDj4nSR(t&|Tsi7uo2p+U3VG7N4{C!weOik|pjY(e2fd{BR_JL3)SUUz_k^ zX=CRDaj}AVr|UA%i~}^gXvNteE+-!|j9sJFF#qa~P+0|f!RLZv!{0e6`J|Sv*-mHr_xs@# zxAf&G`%bYdMy$z=SAU66Uu^9Z6EZ>+eJ*$LlY*`yUFQkWcpl_q_xgcTIbfa zws+|Rh@{+B^LN8*hQZT%LZe_{XXdDaH8_$Q?Bz(AX zb7*%38f_F?ccqJs_f#;ba*_5DYEG_U~;p zHFOE5yB3AM47?@o#sAixo+VpYgLQI%qT=nm9uo_woNh(r>$Ab)2CtpW%fxBn|9o=1 ziYU3F2HO8|$8^rIor|0c#L6KAS*LU!u;?B-7p0?2aVkivS8}oEh=xpIr;H~(y0L%w z9Smv!CgdZQ0YR!zp|4qtkpl*?SkvGMS#E*pxIN7%X(9{A$UCi=)mF15`7(k-z@D7_ zxvxiZD%ZK;6C<2$xb~t$u5~!ZZDu?!;H_kdQ_!;}moL<(igYFXS`pEEM=z8-A1RFa zOAwwjknev2X?2%tvx(*^w|yH-ex9)RL#<4QU0B!1V*RGg*pJcIw+MsF9dP!5ABfl6 z{<4x3k<4$Cd%it1evLHtu+iaE7dVo|Oyht1h5uw2>lpIWHuT0pR%A;yhx$v?E=R64 zNA>f0&%Qo8ZJaDwLdleD8a_VrjBl7gjRBTp60M4A@;zO~PU<1Ll4q`aL=F+bLbS3!RNj zAg_~+D*UJ=VT4re?L8kt2!L9a@BEVxJQ5u1>l?sWu(GWGCuaYZ3E8(1-!)WDu$Q^+ zfdO;r-Wo6i=cM{?q_bGR#Z~CV!BXjriV7VV*;a!1glLm9OQp9(-JP2Dhx7L<%#vTI zX_s`U?+|s!H?S#~reie97|)7iPET3D5MD&{ID?@=;5W7DD*@jin$$r_b;2{x2ok?$!i`cZ z(!gi2QBMgK_nf~~k0=6Bx^-e%Plv#mBx?9#bHJtk&jScv@zYo4EnT5WiFwEdH&n4+ zD*Su0j3*PQ3vu4@8k`ZLwS&@T@plTUI0G>Fh!cv$>gwkJ06eIQ<8db{;Bcs;2OS@@ z`NJ+wS~Gf%IstGY z{w&{rP&FZ2x%NFic!78R=5N5PdN8~j6W?Jw1R%_?gxXbJ*IYHPUn?cM)W`$5uE8ShF?clPy?|}w;ns`eVhc92jGy7}DipF7yX%!* zmbyhPZ|3e2z4$v~0h~QB_%)S?c1-*(UbNVN?qasFprzwN=->A?;{!l_O3BUoD`5YmXXECjH~DQM~Pa z)C~YUqSL+&*Tup!gZ~7=T%BQXHV#oKSz=#i>sN|DBP7%)#aAF$>`=R|w$1wbunBWI zA(hX_-j7zvBIoOtUz!MAsg}*oO{V_&c;(SIvgq#a?jahF38Ce$@2@#ET;^9_L>C(E^*lwDC{z67N^eP;?v_A@2l$r1Hmm+Zqkwf0VQT1&gvd0Ji(<=+GrN+n z?-|oxc&hh^os3Ho(sEi}p$kd^Voe6A(g3?CG_1VcR)8w_cil5L-OB0|X=rFDQ;Z+6 zU`BkehV_q}UIGB@Wi!vDQWA2WpZy$et0g%3S7Y$kIziCH=*$n_ujtOrne*W92vnes z7VPZf^Ez^vquNG@{;l&JnBBf-eX3{g~0uS?Ipb@Rn-=7sKDO99AG zVG>}Pc--;OxHu-z@oq-dvTW1=C;o*h%uv|>vXUuZqKC;-B0z7gzUlEeXfX>>xvi0K zI$JKH&IICIqA(qfri$a2$x{JSrZ8}_u&Cw8n6nBA>ALHO7t@N%kQ6(&lY&cZifMC7 z{1(wjO38ngsQuwNQZzzfN;d{Xt`ws`gaKDE7`Zn-po6o8qcFpl#c7r@Z-j5 z2WofSu&}U!{6gD^Zj2UwMFSz`wkaWDtjHY0BWq4{sDKys-iLfU+)n0x9SDU&kIz8A zkiorr*#?J+uFMhJj>}@=duHWK#8wR+nnQ{AoT3Q58ZNt)E~0xr#t}cHzYpN{@bGX~ zCMM<;7m|KWqdHlBFqS8U1F~TSe!o=Ms?x6QH$^^q(PbXGE!ch^n=724?LX$HbAiHD zP^M6VH8hZsk@vQ%f4@rZ+rN6oBg@7wDg^*o6Pwq7A+v+3XvaCA!*6QH{+|V*OnP&b zQwlU5-u+4rDfD^npCfCzGH~V{-c_%dCZK`E=3%F%?AL3pvU76cl7t`0aVAQ!ZA(BWjZsAS)lWNX;zMW1GHNGz zZjhKmSaQl4tLQ@CEeATyQI;y@G%?>6Y1Hr8)T{3tY6ucY0nmsRy;)AQUN#U#1Xe{m zUZN0JG#1dEcWNG8C1EZApgIl?j@IIPKxE@6BrHtBz#vsVk{TFR>fCC-nv`EVsJvNrJup_YY(0>A+vw#=Y z)$O?XXXP?;31)5vkZU=YxM2Zw*8_={+J4H#l^1Kdp|GvRMnI@lUZrO+>9r4`I!yth zs3^X?cxc3JDhSfx{Utks=u;{%EEde+%Nge&f1$Gj2Ii~F3KPim8TbH~}O?l3W%5mlKE z_C^~UmB`xB*o6wTwVOo_DY@{*#U{dFu%AbSe<;P(2C3}g#j&Jlpv7>*>hC&5H{?O3 zYi37IrrM1dl~};E8}1RjdI>~M1yX=(N;D@GFz7x_+7CZmoVQw>f6?+vmWAtyJ|2$` z4GB?u^Cmkoj(VUkr)6xnZyMj%O|w&-8oCypovg2^>uj*knBrsU3*mKZci2>wb&XZl z(!yBS4Ts+Vm5pz-O8w~+`4zyH00eDTPEMmc!BRj3ww0dz=j`n4yyJ6HI=T`dCjW0B zb`QXu!5w{4fJ%Le{fsy~d@C(W+*RS}>RJJaHEvZ745(ZtS>l4xHU2wjTh-my*PTt6 zm>I1G^VPgoOSxEhCz%^B3WZPYye>*`)>DORdsQCih}oV{{yCR{c{{{#Lvu^0N>_A? zMa=MUe#q6)WVa2{qcNY*P}I{Qh=!DJ3@fJ7JTx+%Nlfx$d;N*9?{P))3);D#CkMNY zh*{)ERzK_T2Yx*xLS=<-{W6Bwqbo~NioFFXyqi0)wN)3z-cOLjcn*WJvLRp72Iu>X zN0Y36Xa37m!Tu#TLA8rwqNwxN9I2`FDMBL`3C7D)aa5Pj(oFr%xoT^^GKc9x%XP+$ zk4rZVtLjf4C8SF0HJmdqB-mqDmBz!Qzy4-zSM$N(maHv5RekEfc+Nca zfgnMA%`~oYJ@k{Tp1yuca!NhILzplXQXu}HuzkB34+WY_=hv_Gv_ff?L3~(s*b=(u zVN)>uTk@nN3O#Pq)N}KrOS-dfu&WN>SeU776o9G1E_;h(LuN^8aa7a2eebT z@P_d4xorC^=s@;{ng>v`DnYx|W=eyz;Lf;nqva2N)s?%B#WT$lgnM#}m7Ac88e*%- z`v4j7(9w=z>M@70xC-j$C6?bNI=yqXn^>(9Z(DqvKb>e6MKJ;#pL(vd{&_5+;S>C8PFwmPr{1!`a< z!b$%U)Qb%YeLgud0*fOXTcdQXl0?Mz(MqUR@Eb*D)Uh6X=nhlM_@L@Q=6gCiO#{V1 z1@z2vJ&e4WY2y=|B>8qeFyC0!`#9GaH-zmE7aq+L}x#e2X zh6sv|yOVWbxGH>JTx^HN6(MC2c_zYz-Cf5DVdipDSQqiua~``l(?8Yf0GwUJJuw@dW++wzEw{58ClkIY!ArP=7x=*W%s%8c~9(KksDsHKSE zy<;lxdF7{rT~T5sOAVA|`k;@u9JFP&Q@qY1L=kr7)|j1)<$|lCZE{fe`hwxAhn-J= z;M3l5hS7k2lkR%ziSbY}6_4h20^KTo)oYQfHhk4KfdCcAONrkeWD#a7+Ip?9`oe2L z4)Js|b?Zzb%5N=r%qS-7qfHfJwkrd&qEjXIc9v@C_KRwPU(|IiYrJU>MB6f`@RtfZ zyDEI_YB|kn=cF`@0e8ldl-)X+@azw3I`3!fs_}n6#Nh~;19A$EON&@h09{mpImp(@ zZ(I(FG4Ac5{l#|=5Wb0|(?@d9eYC!H<3+gmj&08_mmcYec8QI@wBB9H@8s_$Rwx}D zH0{7MJ*kSp0NXrSqe60Rh|oW+ZB6zZ8X`R6d12_OSLgR$%VPa{>hQqHJf;!UiPqBo z@ERb^YY-Eb?A;JYCXrz^k&L(+*9c8CVjU;Y#JBzV{K`0(y)HMIbJNJvOr z$!N*1)uKA4{uQ{F-9@KJM%l z-f{wg$kz(yG72fpA+=PFYvfl}>l>nNTeE{}O(e1%5ii%ITu2^>on~rHG`#BZrB05w zO46E8eX7tUP-LhHdy?*}9yN7Nwc)O?GCWZTr)OZB@={gM7R&d3c&6i@%tGS5IJ(0}BVxuXr~6Oz5`SuK>o*RrUc6Omu}@hPKPD7)djI;Nq>KGc zQqIld7)Kp_0f$?PoLucOHcM=x5Q6ow3Lv-PlG0l0^LVfD(O-mr2tfW9X_TAJ^>7!! zq(95`e!n|m(YwgmPrWhFNpC!Y8>>|*J`G7GsdM*U8A=~MpB1aAmC5LQ%+csyOX|#_ zO93kDF)Z%La94(kBMtXc_S%Im{R2-C(bl6Lia)?yGQRLAe*Dy55|<#q|KoiB9*@|| z1FkLm4`LTz{dV)*2{jC`X$O_N^*0=bbED%J7fxIU<6wL2`0aGNf%242;frNc#lt^b zECTYv28&{+bYbB!CQzQr@S3ec${WS)&}X`&HkIw9c3R5r#TJI%MKb2*EF8Rsc`9_; zO86V7qxv0wL6&Dz2px^W?D3p9D3ZLDU_bYt9Cj;Q-Vl2Ql)xx4q=$l)XA z3rJYEFrrCQPQ7M`_D+$Ph=vdal;^=p2u2>PsfEbindX~jX5mz(Fr1rUot_rDH=P+T z07}0}^Oj{~&$R{tH{l3M0Y@`*7#0!>pD=-6IB70G*(*2e<<*b2pPt##957K-r8}!K}GHz7padjsXE!1b$ zn;$Xb(39R69m-EfO&!xMa`dVlh&?l%pOU!x^#y-jk3p&uJ#k-uUi4h zA}15l$pbE$7Y52#A8OoItlr)azokQVw_1F^rW1{uJSGa@Q{BJ4u>578&RX*vN~9;4 zi6taKy#+7%z3ex^AEkd>wfQ0OCqP4x>3@ap@eiCs3?p_Bm5+iO`WdIZ$$7)a%&WjF zCa82Yw-aYlzM>%L4+^QgVxIei#Zoc(jnYQwrd13`-BmW0eNhK>bQ%hY8SAd>oTi1B zh01RnJ64H}9+WCm-%{Lkr!7%AkEg8}cTo(Wye*pgR)bjd)TC!Rr*Tlf)hTOC@7nVM z@eiR5Mfx|{p>S1?3o-H+H- zq%Ir0%QG*sovStNmymv3ZS#eXMM?m)03=n6``x>p`~3L$MV*Mbs>2!H@Ug*3U_t6j z|49_Fmx>j!gxt+cqX5E>H>@;;2uqXSm^rz@!8ebtuCZ&{8jYu&Tb%_pXnV{9-264E z0pqLcW^PpN-U89j{;XSP?)iM;1{lAU0*$O|da)@YTD-+cS$z~avCzcA`By1=loJSX zU-@T!G_37C16h|(Tx$^q8-5wo9Uyi6lrbMmx608xfoa{EG)_-Ss(Cy=Vn~;%aT>Yo zo}rwE(AH0B%y=`v@9fPOk&fUu6&ZI%IjaKznN#MzBrugW{FF*ASmqB}372#o_c_3W za%E%?KRMsvRM|E*ZDfLiG6_9kL2I#|zH+~*{>zsKLJ0J|lZ4d>1@+-c57}@@6IALxs zFF1v76X_7%F9o3vHzUI;cWkO263-DMTj8`U9~eQpk>@sIzoe!Bu~+%Ymj5F9%mjJ zdjF4fE-dw7zXeWS0{{d6IJlH!Ail{jmV{e$NJuB?TUg~G)_nyeZCG`jdL4_r?#dnW z2xV>W6cx1%zoVXXFtR7_TAspGs|+Ay>{x$czI)>jiwv14`Ol(4$}W~l8ad+1Q;QaJ zSyHyWDRgM~2bS6c75^dL#?!d;@k;Q4@*SFTwGtfS^A8PIoW4KSg~~76jmi(cG&PYo zEG4!>m+CBfG)w5rCUtB0!mz{vxNYpv(yqZjm%ZUl{k}MQfSqVeq-jrCXcs@rWjv&D zO8|m$YLRg=5tZ@Xe($wh8gVQ^XVol1IImG`e}0sK|G_1=f(J-a)HV1fHgV05Fr1HH zDEm%9-3#Taiydt*#BPi<0mMf?kv#_1+sdGf3s`Umy8p>{~^!4Q~2c+&sgs) z4?uYlNGA-=TD`D?F%940lB>l*gb$5^4h|s_E43Du7FatV;KI?uat;p2_FL?xgNA0X zStzt{`vKDvUGwrpKIX|{|3v?^+1dMh+ojh$lP|f^9q;_exj-z5xp(q-<=QvQxp(yo zh*sq+B^+~2c|-}+f!V9zs<#^5Gd9o0Hj*<2GG|3agNWo?20T`>@~R3(VvtEyQ^oMA z?%0+Z*&bgUmDe84+_L2JZJ3cyo`IM~@#6F|}iVFW|@v&M7z{%YqzR|RPy$*cjR}PUXB?a{8V0PDPrAt z#;l|0)p4yz|3c!?UDfkIzsef+kq4(7j;m>DH?Q!m(;v8nR4kN6XZL5hpX=$%?^Zm2 zzR$U_{Mo(W&90u^#LDuju}9UOb5!8K&vdMu=WjwBfn!0~|2}#CzcMC#B%NJc_V6v` z`1Z0jtR7C?HB5VR41zl9Vddr3=o@-|q@N5Po*%5-09=D$>GMh*u%^($e#NS-H+n2b zIMzf#)xf7v20m7?x6dRG0u9wFIauwUw6Jo~H8?cwv{vu@K}L2?c3etKQHuRx_U0)j zf#1m|t1w>Y7r@6k#OUoDXdB|hlOf9HnSxrHyI+q&Dsm3jG%ygpyW3Qu0MEGp$C3Zq z%d0y}LMJG2hY-yGhR!>uKXWIlQPVYbJ=WxAQvQ%C>aF#x^qH`GnR2L&oG-#z2yA;3*)ibDtvw7{SUT}0l*0$IL1oZ40n9ZX=13#=| z;!>^pPSC_QEdb5xd`?N&?U*m%Z<^QFPclH|MnU~kQ^l>VGDpI1D%M^hDU`Fjj{pmL}FYQH68zozGu9dcvxF@-y8>flwT-ffI9E6$a*R?K2LWNojV^B(Cl_dr} zjoOF{d=+I}%^27tHzitnR`)^UJq=-p~&2H!T1iMO%tP*Wh zDb*jzz5Bws@8e;df5d$oz)->3!^?*uJZVqa20Ab?h(bg^@FA?Gl{@zYqiJX;HS;$E z&JpzZkoyNfchS@Hf!Nz?0eLTejnmJ6M^*_4-YMMtp9yk|sG~EU6z^f9Kg|-%sJ|9S z!3w-ATLY4-fDEA6L^EE2zX?>19de3g9cwfcs1G;9;0zR+oSp^j z;Q@}N6Lcq{3M7^UHsO#DC1&I2H$1vJ2kg(G`hoIKXSp9Iby>hiXfRylCBTLrainxw z<-<1A0=C(|wl-;P{TXe{Z3NZSa~=euE<*kN=2ap9A+-G!!QWTR{jK8Y42a_ZPr|^A zRsSCwbI76p_UYH&CVwUH|J3dstiRJj|I_4i feature/lab3, origin/feature/lab3) +Good "git" signature for arsgames4028@gmail.com with ED25519 key SHA256:Y1hruybz/P3gY+m1MS5QWsu6nofEzm/nTPLX0fv/mCA +Author: arseniy +Date: Wed Jun 17 18:38:21 2026 +0300 + + test: first signed commit +``` + +### GitHub verification + +- Direct link to your most recent commit on GitHub: + +`https://github.com/demonit4028/DevSecOps-Intro/commit/39bcbcf9af97afcf45a97fff0e3f49f60db01e5d` + +- Screenshot of the Verified badge: + +![alt text](image.png) + +### One-paragraph reflection + +A forged-author commit could allow an attacker to push malicious code while impersonating another developer. This creates a STRIDE-R (Repudiation) problem because the real author may deny responsibility and the team cannot reliably prove who created the change. The Verified badge makes such attacks visible by cryptographically binding the commit to the developer's signing key. + +--- + +## Task 2: Pre-commit + gitleaks + +### `.pre-commit-config.yaml` (paste the full content) + +```yaml +repos: + - repo: https://github.com/gitleaks/gitleaks + rev: v8.21.2 + hooks: + - id: gitleaks + + - repo: https://github.com/pre-commit/pre-commit-hooks + rev: v5.0.0 + hooks: + - id: detect-private-key + - id: check-added-large-files +``` + +### `pre-commit install` output + +```text +pre-commit installed at .git/hooks/pre-commit +``` + +### The blocked commit + +Output of the `git commit` that gitleaks blocked: + +```text +[WARNING] Unstaged files detected. +[INFO] Stashing unstaged files to /home/demonit/.cache/pre-commit/patch1781711692-10516. + +Detect hardcoded secrets.................................................Failed +- hook id: gitleaks +- exit code: 1 + +○ + │╲ + │ ○ + ○ ░ + ░ gitleaks + +Finding: GH_PAT=REDACTED +Secret: REDACTED +RuleID: github-pat +Entropy: 4.143943 +File: submissions/leak-attempt.txt +Line: 2 +Fingerprint: submissions/leak-attempt.txt:github-pat:2 + +6:54PM INF 1 commits scanned. +6:54PM INF scan completed in 6.84ms +6:54PM WRN leaks found: 1 + +detect private key.......................................................Passed +check for added large files..............................................Passed + +[INFO] Restored changes from /home/demonit/.cache/pre-commit/patch1781711692-10516. +``` + +### Tune-out exercise + +#### 1. Inline allowlist + +An inline allowlist in `.gitleaks.toml` is acceptable when the secret-like value is a well-known example used for educational or documentation purposes. This approach is safer because it ignores only a specific value while continuing to scan the rest of the repository. + +#### 2. Path exclusion + +Excluding entire paths such as `docs/` is risky because real secrets may accidentally appear there and remain undetected. Path exclusions should only be used when the directory is guaranteed not to contain sensitive information and the team understands this tradeoff. + +--- + +## Bonus: History Rewrite + +### Before + +```text +c084d19 docs: add usage notes +78f7f4a feat: empty log +f00bfd4 feat: add config +a7715c3 init +``` + +Output of `git log -p | grep -c 'ghp_'`: **2** + +### After + +```text +8674eab docs: add usage notes +d546596 feat: empty log +f348e15 feat: add config +a7715c3 init +``` + +Output of `git log -p | grep -c 'ghp_'`: **0** + +Output of `git log -p | grep -c 'REDACTED'`: **2** + +### The two-step pattern in real life + +1. `git filter-repo --replace-text replacements.txt` — rewrite locally. +2. Rotate the leaked secret and force-push the rewritten history to the remote repository. + +### Two real-world gotchas you discovered + +1. `git filter-repo` refused to run because the repository was not considered a fresh clone. I had to use the `--force` flag to allow the history rewrite. + +2. Installing `gitleaks` through `apt` on Kali repeatedly failed with HTTP 404 errors. I solved the problem by downloading the release archive directly from GitHub and placing the binary into `/usr/local/bin`. \ No newline at end of file