42c805f added the ignore rules ahead of running `git secret init`, which is
the right order - the rules should exist before any key material does. but
init was then never completed, so the repo has been sitting on a .gitsecret
containing nothing but a zero-byte paths/mapping.cfg: no keys directory, no
random_seed, no pubring, and no secrets ever registered.
nothing here is being encrypted and nothing is planned to be, so the rules
guard a workflow that does not exist. removing both halves rather than
leaving a half-initialised directory around, since the latter reads as "we
use git-secret" to anyone glancing at the tree.
the `!*.secret` negation goes with them. it only ever un-ignored the
encrypted blobs and never protected the plaintext originals, so it is not
load-bearing on its own.
nothing sensitive was present at any point, and nothing was committed.
result is a symlink into /nix/store that nix build rewrites on every
invocation, so tracking it churns the history and pins a store path that
means nothing on any other machine. it was committed pointing at a t480
system while sitting on shadow.
the two git-secret lines are what `git secret init` writes. worth being
explicit about what they do and do not cover: `!*.secret` un-ignores the
*encrypted* blobs only. nothing here protects the plaintext originals -
that relies entirely on `git secret add` appending each plaintext path to
this file, so always run it from the repo root rather than hand-editing
.gitsecret/paths/mapping.cfg.
.gitsecret/keys is git-secret's gpg homedir. pubring.kbx is meant to be
committed, but a stray `gpg --homedir .gitsecret/keys --import` of a
private key would drop private-keys-v1.d/ in there, so those paths are
ignored up front rather than after the fact.
ahmza