Git:RemoveSensitiveData

lastmod 2023-08-15created 2014-02-166 edits

Describes how to permanently delete sensitive data from a repository.

Removing a file from every commit

Suppose someone thoughtlessly ran a command like git add . and committed a huge lump of dinosaur dung, or accidentally committed a file containing passwords, and now these files have to be deleted again. This happens more often than you might think. filter-branch is a tool for picking out just what you need across the entire history. With filter-branch's --tree-filter option, you can remove a file named passwords.txt from the history entirely:

$ git filter-branch --tree-filter 'rm -f passwords.txt' HEAD
Rewrite 6b9b3cf04e7c5686a9cb838c3f36a8cb6a0fc2bd (21/21)
Ref 'refs/heads/master' was rewritten

Importantly, you must work in the ROOT Working directory.

WARNING Message

• Removing sensitive data from a repository - GitHub Docs

Running it prints the following warning:

git-filter-branch has a glut of gotchas generating mangled history rewrites.  Hit Ctrl-C before proceeding to abort, then use an alternative filtering tool such as 'git filter-repo' (https://github.com/newren/git-filter-repo/) instead.  See the filter-branch manual page for more details; to squelch this warning, set FILTER_BRANCH_SQUELCH_WARNING=1.

Korean translation:

git-filter-branch에는 망가진 기록 재작성을 생성하는 문제가 너무 많습니다. 중단을 진행하기 전에 Ctrl-C를 누른 다음 'git filter-repo'(https://github.com/newren/git-filter-repo/)와 같은 대체 필터링 도구를 대신 사용하세요. 자세한 내용은 filter-branch 매뉴얼 페이지를 참조하십시오. 이 경고를 억제하려면 FILTER_BRANCH_SQUELCH_WARNING=1을 설정하십시오.

So in the end, just use BFG.

Applying to the remote repository

The changes in the modified Local repository must be applied to the Remote repository. Because they must apply to every changed Revision, you have to pass the force option (--force).

$ git push origin master --force

Favorite site

• Git-SCM: filter-branch is an excavator
• GitHub / Advanced Git / Removing sensitive data ¹
  • [Original] Github: Remove sensitive data ²

References