shhgit VS pub

Shhgit is a really neat tool for this

There are a lot of secret detection tools out there. It probably is going to depend a lot on the specific features you care about. I personally really like shhgit[0] which is MIT licensed and is the tool I've found to most match my workflows.

[0]: https://github.com/eth0izzle/shhgit

Assuming that the person you were working with didn't drain your wallet, there are many tools which can be used to actively monitor for commits being done on GitHub with secrets of sort.

The first one that comes to my mind is shhgit (https://github.com/eth0izzle/shhgit)

Anyone can self host it and then add multiple GitHub Dev keys to it. Then this can be used to monitor GitHub commits being done, majority of which can be categorized as "secrets".

Agreed. Version resolution is the interesting problem.

Most package managers use a SAT solver to resolve dependencies. The Dart team has a detailed write up on their SAT-based approach which is worth a read [1]. For contrast, Russ Cox presents an algorithm that doesn't use a SAT solver (intended for Go) [2].

[1] https://github.com/dart-lang/pub/blob/master/doc/solver.md

[2] https://research.swtch.com/vgo-mvs

Official documentation.

As I understand Custom package repositories it's possible to host one's own package repository. The Repository Specification is public, but dart.dev only references cloud based paid services like Cloudsmith and OnePub.

As u/Which-Adeptness6908 already pointed out, the repository specification is small, and that's all you need to implement a server: https://github.com/dart-lang/pub/blob/master/doc/repository-spec-v2.md

https://docs.github.com/en/code-security/secret-scanning/sec...

A bit sad, they don't publish the list of regexes, etc.

--------------

I added a similar thing to the package manager for Dart / Flutter, because we saw users accidentally publishing secrets. That code is public, it relies on regexes and entropy estimation:

https://github.com/dart-lang/pub/blob/eb8ee21a089ebe0f2c2dd8...

It was heavily inspired by the researchers in:

Heres are some issues I've faced when trying with the dart-version cli: - The installation - dart pub global activate needs to have flutter/dart global installed already. - Global activated fvm cli got invalid after flutter upgrade, see issue - The cli does not work with customized fork of flutter. - You should run fvm flutter , not flutter , this changes CI/CD workflow

This will add the args dependency in your pubspec file. We used the Darts package manager pub to add this dependency.