27

My git repo contains sensitive passwords which, for reasons out of my control, can't be removed right now. Right now it's all OK because this repo is internal-only, but I've been asked to create a branch that's safe to share with partners.

Is there any way to create a branch in git and then remove files from it in a way where they can't be retrieved using the log?

Seems like a long shot, but thought I'd ask. The only solution I can think of is to copy the file tree to a new git repo without the sensitive file--but then I'd lose the ability to merge partner changes back to my repo.

4 Answers 4

28

One thing you could do is create a branch of your repo, edit out the passwords, and then create a shallow clone (with depth 1) of that repository that you would give to the partners. They can make patches and whatnot against that clone, but can't see the whole history and can't push the repo anywhere else. If they're just making changes, then this should be a workable solution. You can still accept patches from them and apply to your master repository.

See the --depth option of git clone for further information.

2
  • I think this solution will work better for Ben's situation. It's easier to manage access on a repository basis, than on a branch basis.
    – Apreche
    Aug 27, 2009 at 20:38
  • 4
    git clone --depth 1 [email protected]:project/projectname.git - copy and paste
    – user285594
    Mar 19, 2014 at 7:09
5

Use filter-branch:

Suppose you want to remove a file (containing confidential information or copyright violation) from all commits:

git filter-branch --tree-filter 'rm filename' HEAD

2
  • 1.) --index-filter should be faster than --tree-filterfor removing files. 2.) if you don't want to change repository, first create new branch, and rewrite it. Aug 27, 2009 at 21:30
  • Yes, there is a very good discussion of the various techniques in the documentation I linked to Aug 27, 2009 at 21:39
5

git clone --depth 1 url_of_your_remote_repository

Limitation of shallow repository

  • you can't clone or fetch from the shallow repository(That means you can't make a new repository using this shallow copy)

  • you could not able to view whole history using git log command.

  • Its workable solution, your partner can make some changes and make it as "patches" and send it to you partner if you wants your partner changes. Then apply that patches in your current working tree/ whatever branches you want to apply.

    More

0

I'll take a stab at a couple answers. Let us assume that you can create a branch that doesn't contain sensitive data. You cloud then make a shallow clone of the branch which would not contain history and therefore you could not pull from it, but it could pull form you.

The other thing would be to clone a new repository and use the git removal tools to expunge sensitive data. This would create a distinct repository that could not interact except through patches with the first, but would have all the history.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.