feat(lab3): secure git signing and secret scanning

[Troshkins]

Goal

Configure secure Git controls for Lab 3: SSH-signed commits, gitleaks pre-commit secret scanning, and a bonus history rewrite exercise with git filter-repo.

Changes

• Added submissions/lab3.md with evidence for SSH commit signing, local signature verification, GitHub Verified badge verification, gitleaks blocking output, and bonus history rewrite results.
• Added .pre-commit-config.yaml with gitleaks and check-added-large-files hooks.
• Tested a deliberate fake GitHub PAT leak and confirmed that gitleaks blocks the commit.
• Completed the bonus sandbox exercise with git filter-repo to replace a fake leaked secret with [REDACTED] across Git history.

Testing

• Verified SSH commit signing configuration:

  • git config --global gpg.format → ssh
  • git config --global user.signingkey → /home/sato/.ssh/id_ed25519.pub
  • git config --global commit.gpgsign → true

• Verified local commit signature with:

  • git log --show-signature -1
  • Observed Good "git" signature for troskin454@gmail.com.

• Verified the pushed commit on GitHub shows the green Verified badge.

• Installed and tested pre-commit hooks:

  • pre-commit install
  • pre-commit run --all-files

• Verified gitleaks blocks a deliberate fake secret:

  • Attempted to commit submissions/leak-attempt.txt
  • Commit was blocked with RuleID: github-pat
  • The fake secret file was unstaged and removed after the test.

• Completed bonus git filter-repo sandbox test:

  • Before rewrite: git log -p | grep -c 'ghp_' → 2
  • After rewrite: git log -p | grep -c 'ghp_' → 0
  • After rewrite: git log -p | grep -c 'REDACTED' → 2

Artifacts & Screenshots

• Submission file: submissions/lab3.md
• Pre-commit configuration: .pre-commit-config.yaml
• GitHub Verified badge evidence is documented in submissions/lab3.md.
• Bonus history rewrite evidence is documented in submissions/lab3.md.

Checklist

• Title is clear (feat/labN): <topic> style)
• No secrets/large temp files committed
• Submission file at submissions/labN.md exists