Goal

Configure SSH commit signing with GitHub verification, set up pre-commit hooks with gitleaks secret scanning, and practice Git history rewriting using git filter-repo.

Changes

• Added submissions/lab3.md with Task 1, Task 2 and Bonus documentation
• Added .pre-commit-config.yaml
• Configured SSH commit signing using an ED25519 SSH key
• Configured gitleaks as a pre-commit hook
• Added detect-private-key and check-added-large-files hooks
• Verified signed commits locally and on GitHub
• Completed history rewrite exercise using git filter-repo

Testing

# Verify SSH signing configuration
git config --global gpg.format
# ssh

git config --global user.signingkey
# /home/demonit/.ssh/id_ed25519.pub

git config --global commit.gpgsign
# true

# Verify signed commit locally
git log --show-signature -1
# Good "git" signature for arsgames4028@gmail.com

# Install hooks
pre-commit install
# pre-commit installed at .git/hooks/pre-commit

# Run hooks
pre-commit run --all-files

# Test gitleaks blocking
git commit -m "test: should be blocked by gitleaks"

# Output contains:
# RuleID: github-pat
# File: submissions/leak-attempt.txt

# Bonus: history rewrite
git log -p | grep -c 'ghp_AAAA'
# before: 2
# after: 0

git log -p | grep -c 'REDACTED'
# 2

Artifacts & Screenshots

• submissions/lab3.md
• .pre-commit-config.yaml
• submissions/image.png — GitHub Verified badge screenshot
• Commit with Verified badge:
  demonit4028@39bcbcf

Checklist

• Title follows feat(labN): <topic> format
• No secrets or large temp files committed
• Submission file at submissions/lab3.md exists

Lab 3 checklist

• Task 1 — SSH signing configured + Verified badge on commit
• Task 2 — .pre-commit-config.yaml + gitleaks demonstrably blocking
• Bonus — filter-repo rewrite practice documented