Comments (4)
from security-strategy-essentials.
Nice, that's the commit that added the .env
file. We'll need to remove the contents of this commit, as well as the commit that removed it from the history.
Step 13: Remove historical reference to a previous .env
file
We can do this with the following commands:
- Since we cloned the repository earlier, let's run
git checkout main
to put us back on the main branch - Run
git pull
to update your local repository with the changes we merged from the contributor's pull request - Run
git filter-branch --index-filter "git rm -rf --cached --ignore-unmatch .env" HEAD
to remove the historical reference to the.env
file
Note: There is a lot going on with this command. We won't be diving into everything this command is doing, but it's filtering through the main branch and removing any cached reference to a .env
file.
- Next, let's run
git push -f
to force push this change to the main branch - Let's now run
git log --oneline
to get a list of our modified commit history - Paste your log output into this issue as a comment
Here is an example of a log output using `git log --oneline`:
d27dde6 (HEAD -> main, origin/main, origin/HEAD) Merge pull request #8 from OmarVasquez/add-gitignore
65c1b71 Update .gitignore
a9b1b74 Merge add-wolverine-image into main
e2262cd Add wolverine image to game
9414843 Merge pull request #6 from OmarVasquez/a-a-ron-patch-1
16d5372 Create SECURITY.md
28b3625 Merge pull request #1 from OmarVasquez/update-dependency
3f7b819 Update package.json
e9ae69a Change package.json file to highlight where dependency update should go
831b1d1 Add empty .gitignore file
78cfef0 Remove .env file
8f08f15 Add .env file
e6e2377 Update README.md and Octocat game
528248c Initial commit
I'll respond below when I see your comment
from security-strategy-essentials.
a152381 (HEAD -> main, origin/main, origin/HEAD) Merge pull request #8 from OmarVasquez/add-gitignore
d7c657e Update .gitignore
378a3bb Merge add-wolverine-image into main
1a06113 Add wolverine image to game
6371140 Merge pull request #6 from OmarVasquez/OmarVasquez-patch-1
110416c Create SECURITY.md
1d649e2 Merge pull request #1 from OmarVasquez/update-dependency
273cdba Update package.json
e9ae69a Change package.json file to highlight where dependency update should go
831b1d1 Add empty .gitignore file
78cfef0 Remove .env file
8f08f15 Add .env file
e6e2377 Update README.md and Octocat game
528248c Initial commit
from security-strategy-essentials.
Nice, your log output is no longer showing reference to those previous commits. So, what exactly just happened?
Our commit history has been modified
You probably noticed that when you ran the git filter-branch
command, Git did some rewriting to some commits in the repository's history. Since we needed to alter the commits that referenced the .env
file, it altered the commit ID, and all proceeding commits that point back to those commits.
This is why you need to consider local work and branches that are based on this previous history. This is okay to run, as long as everyone contributing in the repository is aware of the situation and can plan accordingly.
Is the sensitive information gone?
Those commits no longer show in the file contents in your repository history. You can see this by navigating to your repository's commit history and clicking on the "Add .env file" commit. Notice that there are now no referenced files or content recorded.
However, we can still access the cached commit if we know the old commit ID: 848cd8c
Removing the old cached commits
This is where we'll need to contact the amazing GitHub Support team for assistance.
Even though we removed these commits, the historical reference to them can still be found if you know the commit ID. In a real world situation, you'll need to contact GitHub Support to perform the following:
- Run garbage collection on the repository to remove these unreferenced commit(s)
- Invalidate the Git cache to permanently remove any cached references
For our situation, we can skip contacting GitHub Support for this example! 😄
Find your final issue here now.
from security-strategy-essentials.
Related Issues (6)
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from security-strategy-essentials.