From cbaf74de0e7b85c40a4a537fadad653b7c825aaf Mon Sep 17 00:00:00 2001 From: William Carroll Date: Thu, 20 Aug 2020 11:53:14 +0100 Subject: [PATCH] Setup git-secret This morning I'm attempting to secure my monorepo. How? - `git secret`: DONE: To version-control sensitive data - `git secrets`: TODO: Lint code for sensitive data I will probably update the CI to call `git secrets --scan` or some similar command to fail when that exists non-zero. I have much to learn, but doing is the best way to learn it. --- .gitignore | 2 ++ .gitsecret/keys/pubring.kbx | Bin 0 -> 6799 bytes .gitsecret/keys/pubring.kbx~ | Bin 0 -> 32 bytes .gitsecret/keys/trustdb.gpg | Bin 0 -> 1200 bytes .gitsecret/paths/mapping.cfg | 0 5 files changed, 2 insertions(+) create mode 100644 .gitsecret/keys/pubring.kbx create mode 100644 .gitsecret/keys/pubring.kbx~ create mode 100644 .gitsecret/keys/trustdb.gpg create mode 100644 .gitsecret/paths/mapping.cfg diff --git a/.gitignore b/.gitignore index e7ee823e5..911fce105 100644 --- a/.gitignore +++ b/.gitignore @@ -31,3 +31,5 @@ node_modules/ /configs/.config/fish/fish_variables /website/blog/public/ /emacs/.emacs.d/tramp +.gitsecret/keys/random_seed +!*.secret diff --git a/.gitsecret/keys/pubring.kbx b/.gitsecret/keys/pubring.kbx new file mode 100644 index 0000000000000000000000000000000000000000..692d5c67b04b379a63d59fe3b322735f382586a7 GIT binary patch literal 6799 zcmZQzU{GLWWMJ}kib!K%U|@*13v2^n5F3J}@|hUHtWyjOk`ozN7-Z_&CrPcD6X-YD z@yN&HOKpz!TFdu<%mJzTqSHq+T!MN3thEX} z`N~n=XWQ;cynH&gQc)p0i9yZ$j!{!Zm=6W7lEe5)UxF(Utuo{SLWy3%Q9knrbV$t zn{Q6ula-B+3+Pq7vwC@T?p}$7SL_P5$GwR3+P#xEDCp#xI^TH@3wx74p3&RB`~9gG z>Vn}nmPWqI-qe3$*5!DKx1Jr^k2bdVtqQrpvRuxIS4_jyQQ_RmT+zi>9VWXV4A)2dxE;^j-;7W z&T_Ek)YKYvUSA;OTjlkpYW3Zc`A_5C2A(nO2+Tbu=k(6?!F2TshrZ6qOJ9Dd^w;|) zZmOId+TtUp|E?m)_LgPtJ%<$~w!89fa0q_*UR_kE`SGFE9iauhi>_4txVJoiD}x{- z1LFoB28Q&4bV%A}*rFVsnUj;5n5*ENSX7jslcQi$UXTo8I;7_&X6EQ6=jYl%wJ7Zx znA`Fny%~B%llD*HT=B=WA@9D|zv*wSUhKbA$Cb9dJ?zr_1jnxR+~1~6^J%&<>(s&O zog!biD4Q(IyR_o|o?lBO>)K=9&G{T$a*;!+dfpEMg`z0tx2opSHk&d^dh%XBTa?f2 zSX_Ey&i=a>r(M@O&syxi`Sy3ewP8? z<~v8T{p9UFPmheObLF^c*%}f3lSO@Iq%)}m_8Q6H?OzpTM3#PihT6G?sxvnvXUn4 zuZT54k$Y_C- zbU)j6MNx&5cAVu3=IS9a7Tt4`Y{EIz+(YbIG`$lJzhCEf&V9|PPj|vMae69Um>3Wj zKZEm!^UjR+75iD#FDxl9n)2@0yt;!HP9+@k+1Krpcz-T-+Zl%V6JZA3o4q?XG88Oc zq&+Fd(_uwNlm-o?eZ8Dt8S(zf&?JEGK9+-&00}h5+2IqbsnfvknoN616-Wgig ziqGf2KXqZru?=|ji79y>lv(N+!!EaR<+)E?e(iLH?b0R3 zbd%O~%2AJwU5xRA;Hj)x)e_tM!qX5ue? zZwm0a`sVQM)5a_guaE8QN+{sk*^p3Wa((Za5U$Gt0t@$sv{*)EN7aO?70G|`p0CDK z7PW;f{qK{{Srz^gld@VlKJ_llF}7T{Qst$6a_01wnfoj381`jmT+i(`-@pdW)eN0X zh|m-MsjnOH{&ZTVhToPu8=`%F%=(kY$`rZpoIWV@U?K`!0t|<(9JX)NzJBWSLCK>H zyN&wfb7pNP-rhZv5%0=!RQ=#vv8|KcXWP$y>%g%vJ@;?n;tgVX$FzEb4C78s z*?w(D-|^K;mm5zvxS-c@lw(PoSo)#RI1_OecKyT z_2bXLl06oETO|+n_-Ory5cZN^k-g`!?#Ew@JMJjl{~NBWa);?)&7G)iPLa%- z^|o9IUejMPxjlLI%F*s~S4hINjSZF?TihQURywqKofpHxd1}uC?UdClMBWMQ?s#&N zJ#w~*_a{S5oo4Ci5U>{+avZ&Vsem`PQSEo?S_`Uxi3{)dA=^+G?QsYM3iOK zg!h@B-PK{KXD6bqu&280m&ZNbC;b=QQgZ*coflWwb6rt2hvP3Zj8 zF4<4BTs1CB9lm_0FYe3MyYm_kIByS`_&oB_L-oWHr|UId?wGB)U-zGgxz5vMo+WwK z(f6v=_KR`+dm3B#;QjC2Hy7q+XHD6VW+&-=esLS)YwN5^_9=&CZ!@d73EWhkQPH_) z>#y05T2y^=l%?HYPoLhm{Qq9rPg_@SDS3R+huL!O%WuyvSrs3#zQ_BnW@YNCn=Agk zsS!?-T)+Ni^^TZ{ze`TPI-e-O^pw5CZONOREt%^NY+~r{+B9|cM0L|GTTb8OJ=QFE zS#i4}m-vMn%X~wc|C;W|??1C%&QGz(N4d&^Z9_!+?j=2eZIKo~l(bwvYOXnQpJ$Gj zpv!KzQi=3^E#Di1!fzf~(UcsR=)JmZveA-79{0SNSbi}~YF{h6uVAXXaX5>@?n6p1 z(JDZg)q`ACh(lLFvu0J()PV2Z{YF?Sg_<^(V;;cY{-HbvnB1@dhbpE$5 zw|jTO-ul^o#yw7Tt-f0ve?Gp=_)Igf?v;W6p%Tib{g0b9Zm7?y`#IZIYvaO-Qq#-x&IPh~ zPPMHmW=@{V!JLtqwWIIP_U&B$nx`i_oGX~~aP_5MoVQvJe`@&b&+l9+$BHeZG6eE9h_y8?yz0^>mR4i z@^^O<)Sh_Mt+JUFEmjq;{Yf`0_pe3!Zp%=;)b@%g>8*Pf?Vn>c$@zVdZ`kVFFaJc{ z$a$d8rMl^Ex?qcAYuDjv-Is4?I?C+d?Dg&WZDHzh=i* zmh$cL?LC>iV=n&!{&Hqpqo7~+1uK^Q&vCs}Q8BTOW5&*@cMjU+OXXC^sVS&$ukC)% zG4c3@_j5i7eW|n9dLyJ^jq>G34u4*Sh`;=uy>sJ2{h7%V*IYUsAfkJ_rHms^;&qkx zu52du3jO)dMWkP|Y&>1IQE8!rqsZH?TiOWa1G*c| zhj%J=OFdolQ(t}g1M5g34zDAXtiIcJUwtLM`Op7Z_9>I}7u?<}%<@EZ8vnNmhQ~M7 zDgWDc{Fro%s%5@LpS0_LmnBiPxyj#+VpEE?_1=)WH6^4&ed97e^GPLVPPQ7JxalWy zes#d2R0FTe8Ta|s!kxeVd$s!6n$3c~zcyX_b#=qB>)c;+VmTTd4HjBYy)#Qu=9I~? zoB1#2OuYQ#dg9y5v(;}%EN-ayU({=D?DOHrp=+k+W1jnP{QfY5b?Ut}R@J_<7;n@# ztJJ%$# z*B6m@smC>VSc(W0D|Y8%n53B?#R`)HC%mU{utb4H652Y%)~{w|inKcy11gAM zJ#G1H0fv)qyBe&PtaOOJ^w03-_l&YOd7C6%U$rCC+;#qVuX`V1=E!>M!6R?Oi-sz* zRkRn2AKsRJ;=$$P-+t}C8B(A-p4;{Ai-C{5cS5n}`X|Cw`dZ<||uMg0P&SbgK{^%F1UaJ|~K zaq&vGJu<2?T_=j8zr2pz@OHPZajjtB`WKva^WaIFS-xfgnv0h%IIR^i zxkEtD^~J73tXod+IxXz7b@d(P1=HeYiDoNL*wXgyvBICH*Y@9Zxu{jJI%oP)w%<8V z7kg$%DZTxXzw*hdm_x5+5)wr&cuH-0zw6WKS<|PAl#0IGeW{v-RfvI)C&p`(zBO(!c)%1Wzs zD<@Td(PA)c*X*29*>u@=-kku|AM&f-2Zn5uQQo|x^t!`papL+k%^F2$CPpJ~*J^O#zM7_pmn(;C( zvI~3PPyAY6^sp@LZwlLtTPM_R&1au?!bxND-YpgX1Q%NGF_}2C!B$JJcae(dt|uYc z&*vSAaQPRXyX4k~bKjHiu`d=co!>8UgFl*oQtCI$xz1H>$DX|}_nq?PR{5IyMi(!l zRYs2)1sLvLR@D^Px=3XCX6ujLSqpNWDOuJ^pZmTm<+(rM4o!N5r?U zUpCoBJX~=uV@=I!{;IcfTK~T9S7dhGaU#t8Qkb>Xvi8mC+QHq0r)#B)vn2HIo_zM0 zxw5jk`O$6@$9Y|{`DzvAQ{uj#l6~~@{#s+HGp8*Tb^o)m*l+*H)%mC@rSKlh>lG#w zWG`HClW%V+t2imap)R~rdP3N4j}!W)>-$TzWv_|IE?Uss;O76u)a&_*x4LKFaqZYN z=P_%hM!-BbhfMQng$v?))e}xHykT>A;?85vsylYY1g6^Ye>ze>w|Dm;$8~*-A+P_m zKlpCUu&49bgp7TLzEMqVm)E!O{=dYNEik{PdB#ik&+j%(+kcidGdY?6b?vej+VO{1 z&Xv2ab?4LcTZcTvk81b06QibB^P~CxaIaw>!CHPFS2!RZ=mkJ6gNe>0D?1eUAbq*4KII^Nwnr6nIcl z(_HmV(yx5Q)rF1;$A8rEWCb}Yg>Use_Q$OA!u{yfO&5P|l28x&=)B>p^J0&qf@bFL zlYa$F33mH=bYrUf>)^x(@#YRiB2N=JU)r-ZXB=U9FD?3)e`?s(-s&3+yVbQNZt%Cs z8Jln}UZvQZ{Y>c6*B$$xT*~0P@y}RTU>eK$`@1e)GkVasBkHej#DmM1i&~CyahPrK z)8|P4&+vzFMv=+_-yLk1(k6?W9Qb#WY3<6#g~A(e`?6WHt*NYikk9AvVErz`A8R(d z7w5%1yuhjU%)^D>ymC=ThN?`0P|>Y&(fj3gqMyTVEOOy|RU>14CgD=!ttbEFF4zVjbXpPykI|0l-%9V5rafi!TJW{{e9rkT z=R?n_3h8`)s^Ip0nQTimdrm^i?`P4;Hw6PtpO}g(t*q@8J(z2%W$RMUs_}9v zi;!I^?;aULSh3Q{B+sJ3$icwL$`rZ(nFEt7GpG>)>kUo%FTl`ICg%S}A&D{Y;#=l~ z%S+D}%}bo4Xen;_$KlJn1seknrf^9)&MiBoZ#cC}sq0R?>&b;hH81j%mVJ?8z5dYT zMoG!Sy~i839KT%qj7PVG>1SGJL(kki6R+?4)p#U0_|8|I3RD)_onT*7FIn>Bb=>m( zS0j=P+f0^-s@!pwP${mRsdF#?K}7wB*6q5YthZQRD{i`VYfe^%`$Co!mrOo~GbOv` zUYV%K@o7(@OaDPzZmrx+PSYpei`ltMEJ;Q0U25d2=kfgYM>S+Sa`P8|{p1v981~w1 zqA{jwx9&bhH{1e=3*t=KTO|#F~-ShJ-#|+_kzPjp6 zhLdl#xjwaDnq!k4pmj@a<9?|x`oYFb++LX$^^Cr!p4n@^Z3!uPEFyDo(i0tnG8x_p z3_dqCcZ+34>VNP(lwnxq;pwG)TEEz8#W!<3bHgJO;;TDUzKVo@|Hjm)$>q=e@yaUO z`|H^rrW+rkIZ#F6~EoPmN{MydV6mAW3$(B?ZLGxKNclDO1S!Lv0zlv f^Pdi|loGx_eamhe!LK*IRo{K;us~V5+JP4U*Kk&? literal 0 HcmV?d00001 diff --git a/.gitsecret/keys/pubring.kbx~ b/.gitsecret/keys/pubring.kbx~ new file mode 100644 index 0000000000000000000000000000000000000000..c0a748ce2c37a0225e18f72cf81dd13d23ef6e79 GIT binary patch literal 32 fcmZQzU{GLWWMJ}kib!K%U|@*13v2^n5F3O6MA-yb literal 0 HcmV?d00001 diff --git a/.gitsecret/keys/trustdb.gpg b/.gitsecret/keys/trustdb.gpg new file mode 100644 index 0000000000000000000000000000000000000000..369485be0624d934e8792ed59755130e548976db GIT binary patch literal 1200 zcmZQfFGy!*W@Ke#Vql233v6S+4j8$xi(`n6s>28pu)t`zfP(>p7!4PUAOQ=Eh6^|t GFbDvMZUg23 literal 0 HcmV?d00001 diff --git a/.gitsecret/paths/mapping.cfg b/.gitsecret/paths/mapping.cfg new file mode 100644 index 000000000..e69de29bb