search

awslabs / git-secrets

Prevents you from committing secrets and credentials into git repositories
Apache License 2.0
12.36k stars 1.17k forks source link

Add support for server side hooks #80

Open ajjl opened 6 years ago

ajjl commented 6 years ago

Client side hooks are great, but rely on developers properly setting them up and not taking shortcuts. Server side hooks provide an opportunity to enforce security policies at a more global level.

This commit adds an "update_hook" option which can be added as a serverside update hook. It scans the pushed commits for secrets.

Fixes issue: #79

ajjl commented 6 years ago

Please let me know what if anything, I should do for tests.

bjbishop commented 6 years ago

This would be really useful! Thanks @ajjl

ramya-ravula-ctr commented 6 years ago

can we enforce this on public github or it is only for github enterprise appliance ?

ajjl commented 6 years ago

@ramya-ravula-ctr I dont think this works on publicly hosted github. I don't know about github enterprise is set up but I imagine it would work. This is meant for a git server that you have control over. An example would be a self hosted gitlab server.

ramya-ravula-ctr commented 6 years ago

Thanks @ajjl for the response. i figured out it's not for publicly hosted github and public github only supports client side hooks.

ajjl commented 6 years ago

@mtdowling any thoughts on this feature?

ajjl commented 6 years ago

anybody... @mtdowling ?

rix0rrr commented 6 years ago

I was looking into this as well, and was wondering the following:

Where do you store your "secret patterns"?

Normally they get stored in .git/config, but that file does not get shared between clones. So where does the server get the list of prohibited patterns?

ajjl commented 6 years ago

Hi @rix0rrr Using gitlab I have the secrets in the .gitconfig file in the home folder of the git user on the gitlab server. I am not sure how it would be set up in other environments

mtdowling commented 6 years ago

Sorry for the delay! I was on paternity leave and then dropped the ball on reviewing this.

I've left some comments on the review.

ajjl commented 6 years ago

Thanks for the review @mtdowling! I will take a look at this this weekend or next week and get back to you.

ajjl commented 6 years ago

Also congrats on your new/bigger family! @mtdowling

uleinal commented 6 years ago

Wow, I totally lost track of this, anyways, I added the comment into the code, and rebased the branch. Let me know if you want anymore changes before merging @mtdowling

ajjl commented 6 years ago

That was me up there logged into my work account. Hopefully not too confusing.

mtdowling commented 5 years ago

Everything is looking good here. The only thing that I think is missing is tests. Is that something you can add?

sparr commented 1 year ago

I think this is ready along with the tests in #204.

sparr commented 1 year ago

Close and reopen to trigger tests