ahmza/nixos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

drop the git-secret scaffolding, which was never finished

Browse Source 
42c805f added the ignore rules ahead of running `git secret init`, which is
the right order - the rules should exist before any key material does. but
init was then never completed, so the repo has been sitting on a .gitsecret
containing nothing but a zero-byte paths/mapping.cfg: no keys directory, no
random_seed, no pubring, and no secrets ever registered.

nothing here is being encrypted and nothing is planned to be, so the rules
guard a workflow that does not exist. removing both halves rather than
leaving a half-initialised directory around, since the latter reads as "we
use git-secret" to anyone glancing at the tree.

the `!*.secret` negation goes with them. it only ever un-ignored the
encrypted blobs and never protected the plaintext originals, so it is not
load-bearing on its own.

nothing sensitive was present at any point, and nothing was committed.
This commit is contained in:
ahmza
2026-08-07 14:36:48 +01:00
parent a009a4d984
commit 91332d7e16
1 changed files with 0 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
-18
View File
@@ -4,21 +4,3 @@
# churns on every build, so it must not be tracked. # churns on every build, so it must not be tracked.
result result
result-* result-*
# git-secret. `git secret init` writes the random_seed and the `!*.secret`
# negation; the rest is hardening.
#
# WARNING: `!*.secret` only un-ignores the *encrypted* blobs. It does nothing to
# protect the plaintext originals -- that relies entirely on `git secret add`
# appending each plaintext path below. Always run `git secret add <file>` from
# the repo root (never hand-edit .gitsecret/paths/mapping.cfg) and verify with
# `git status` before committing.
.gitsecret/keys/random_seed
# .gitsecret/keys is git-secret's GPG homedir. pubring.kbx is meant to be
# committed; private key material and sockets never are.
.gitsecret/keys/private-keys-v1.d/
.gitsecret/keys/openpgp-revocs.d/
.gitsecret/keys/*.gpg~
.gitsecret/keys/.#*
.gitsecret/keys/S.*
!*.secret