git-secret VS git-filter-repo

I've happily been using git-secret (https://sobolevn.me/git-secret/) for encrypting non-critical (i.e. non-production) secrets for a while now. It sounds like Gittuf will do a lot more than git-secret, but for the use case of encrypted files specifically, is there a significant different about with the approach that Gittuf has taken?

Secrets inside the repo. All the credentials, ssh keys, VPN configs can be stored directly in the repo with support of the git secret. gpg key is optional: config works fine if it is not provided and secrets are not decrypted.

You might notice that some of the environmental variables have funky values that look more like template placeholders. For example "SESSION_STORAGE_SECRET=${SESSION_STORAGE_SECRET}". That's because there's a .env file that contains those (you can see it in the root of the GitHub repository page. As a good practice I try to isolate anything that needs to be secret right off the top. So even though this is a development setup and would need work to turn it into a something suitable for production let's try to start off right not doing the wrong thing by hardcoding all our secrets into various files. At least now there's just one file to secure. And later on if you move to something really secure like Hashicorp's Vault product, or even something open source like git secret you won't have to hunt all over the place for the secrets to keep. Lets now look at the rest of the Catalyst application setup:

Checkout git-secret. https://git-secret.io/

There‘s plugins like https://github.com/AGWA/git-crypt or https://git-secret.io that you can use to encrypt the files for yourself, so that they are available on multiple machines to you

If you really want to have private repositories in GitHub, you will need to set up something like https://git-secret.io on top of git.

If you want a low config solution and not scared of gpg, https://git-secret.io/

Hey guys, so I'm using git-secret as of now. Just stumbled across Mozilla SOPS today and finding it interesting. Which one you guys recommend and why? Advantages and disadvantages of each? I think SOPS is more robust and stable since it is being maintained by a large organization? Please correct me if I'm wrong. Help is appreciated.

**WARNING**: git-filter-branch has a glut of gotchas generating mangled history rewrites. Hit Ctrl-C before proceeding to abort, then use an alternative filtering tool such as 'git filter-repo' (https://github.com/newren/git-filter-repo/) instead. See the filter-branch manual page for more details; to squelch this warning, set FILTER_BRANCH_SQUELCH_WARNING=1. Proceeding with filter-branch... Rewrite a3a48b09e282854c80bf4ad02a017e249e161fd8 (2/8) (0 seconds passed, remaining 0 predicted) rm 'config.js' Rewrite 6e788e83a338e45b348d93d682b32c816ee2fbff (3/8) (0 seconds passed, remaining 0 predicted) rm 'config.js' Rewrite 7a378a0145bce70bea213ca5f9062138544db5f2 (4/8) (0 seconds passed, remaining 0 predicted) rm 'config.js' Rewrite 0637c9659623644cfceb35be10f2a1fe5c468e04 (5/8) (0 seconds passed, remaining 0 predicted) rm 'config.js' Rewrite 6c421eb99adc6b987cff7f3cada31e9313638072 (6/8) (0 seconds passed, remaining 0 predicted) rm 'config.js' Rewrite 98001e5b97270efa4a8ab5bd0452be56dd76883d (7/8) (0 seconds passed, remaining 0 predicted) rm 'config.js' Rewrite 2ca4e161a4af2b8f38c46faf848fdbb3e550f23c (8/8) (0 seconds passed, remaining 0 predicted) rm 'config.js' Ref 'refs/heads/secret_keys' was rewritten.

Yup you need https://github.com/newren/git-filter-repo Take a look at https://github.com/newren/git-filter-repo/blob/main/INSTALL.md for instructions

git filter-repo: a third-party command actually, as a replacement to Git's own filter-branch, that allows rewriting the whole history of a repository to remove a mistakenly added file, or help extract part of the repository to another.

I needed to archive some old repositories into a monorepo and of course I gave myself the requirement of maintaining git history, in some way. I tried a couple of solutions but it wasn't until I stumbled upon the git-filter-repo project at https://github.com/newren/git-filter-repo and another article which I've since lost (which was badly documented anyway) that I was able to figure out how to do this.

Git objects are not designed to be changed, they are immutable blobs. This is not a problem if you are making a reader, but is a problem when you want to change things, tools like old git-filter-branch or the newer filter repo abstract all reference updating away for you

Make sure your gitignore is setup right (GitHub has a repo of good defaults). If you messed that up, you could rewrite git history to remove the big stuff. Use git-filter-repo. Not sure how that works for LFS.

git-filter-repo

Check out git filter repo https://github.com/newren/git-filter-repo

I personally prefer git-bfg ( https://rtyley.github.io/bfg-repo-cleaner/ ) ... though git-filter-repo ( https://github.com/newren/git-filter-repo ) is quite popular. The difference for me was that git-bfg is JVM based and my work machine has Java on it while git-filter-repo is python based... and my work machine is without python.