Jacopo Nardiello

Managing sensitive data in Git repositories

Mon, 06 Nov 2017 23:00:00 +0000

More often than not, especially if you work with operations, you end up managing sensitive data both for your projects and, more importantly, for your clients. Screwing up usually have devastating consequences.

While some might argue that secrets should be handled carefully and should never ever be committed to repositories, I find that this is almost always impossible. Almost every project at some point will have keys, password, configuration, etc that you will need to handle.

While many considers private repositories to be secure enough, what if any of your accounts gets compromised? What if an ill-intentioned individual gain access to your private repositories? This is a situation that can be effectively mitigated by simply uploading your secrets encrypted. Gaining access to a repo won’t be enough, they will also need to have access to your GPG keys.

For this specific purpose, I’ve used in the past git-crypt. This tool lets you transparently encrypt your sensitive data. Locally you will have a decrypted version of your files, while on commit they will be encrypted and then pushed. Pairing this with a team management system such as lastpass to share encryption passwords with your team, let’s you have a battle-tested way of handling your secrets.

Installing git-crypt on Fedora 26

While installing git-crypt is pretty straight-forward on Mac OS X, it’s a bit of a hassle on Linux.

In fedora, you must first ensure to have a few dependencies installed before compiling from source.

# Installing dependencies
sudo dnf install gcc-c++
sudo dnf install openssl-devel

# Insalling git-crypt
sudo make install PREFIX=/usr/local
chmod jnardiello:jnardiello git-crypt

Using git-crypt

In order to use git-crypt, you need to add your GPG key to the trusted sources which can access the decrypted files.

# Initializing your git-crypt repo
git-crypt init

# Add your GPG credentials to unlock the repo
git-crypt add-gpg-user --trusted <USER_ID or gpg email>

Once a project is initialized, you must now configure which files you want to encrypt. In order to do that, you should create a .gitattributes file and add your sensitive paths there (note that it does support wildcards a bit like your .gitignore).

# Example of .gitattributes
*.key filter=git-crypt diff=git-crypt

After this is done, the key will be added to .git-crypt and the user will be able to decrypt the files.

When cloning an encrypted repository, with the correct GPG key configured, you can decrypt it by issuing the command git-crypt unlock

Conclusion

This is the best way I’ve found so far. Do you have any suggestion? If so, I’d love to hear your opinion.

Hello Spreaker

Mon, 08 Feb 2016 11:30:00 +0000

The big news is that starting next week I’ll be joining Spreaker as a backend and architecture engineer. If you don’t know them already, they are one of the big players in the podcasting world. Their platform (Web app and Spreaker Studio) allows to record, distribute, measure and listen podcasts. Their community currently hosts thousands of shows.

While I have no idea what it’s going to be like working with them, I know for sure that their tech team has some of the best engineers I know and the company culture they managed to grow is just amazing (more on this in future posts).

On my side it’s going to be a fairly big shift and a completely new challenge. I will spend a lot of my time automating their infrastructure, which means less pure software engineering and more devops.

The only thing I’m sure is that I’ll learn hell of a lot and that’s all I could ask.

Next week I’ll be in Rimini to work with Marco. I’ll keep you all posted and wish me luck!

Goodbye WorkDigital, Goodbye London

Thu, 04 Feb 2016 09:30:00 +0000

January was my last month at WorkDigital and, more generally, in London. My year-long journey with them has been a hell of a ride. Their domain of work is complex and particularly interesting. I owe them the chance of working on some really puzzling problems from which I genuinely learnt a lot.

What I’m really proud of

During the last year I worked on (many) different things and mostly touched every part of the core company platform. I spent time on a wide range of activites spanning from rewriting internal core components, refactoring old bits of forgotten code, played/benchmarked candidate tools and frameworks, cracked the good old “how the hell do we process javascript” problem and mostly annoyed my colleagues with “did you test this and that?”. In the meantime I organized and hosted a few meetups in the DHI silicon rounabout offices, worth mentioning Codebar and the Global Day of Code Retreat with the folks at @8thligh.

But of course, all this was only during our spare time. Our true main activity at the office was playing street-fighter.

Or sumo.

What didn’t go that well

Despite the overall good work we carried on I still feel a few things could have been done in a different (better) way:

We had very little customer interaction. This is a industry-wide problem and WorldDigital was no exception, it’s like engineers have to be isolated from the world so that they can’t be distracted and can be “managed” properly. I think this is a massive missed opportunity as it’s from customer interaction that you create real value.
The way we estimated things was broken, and we knew that. Unfortunately we forgot to tell managers who, by manual, treated them as deadlines. Quite a mess.

A big thank you

Working with the WorkDigital team was a turning point in my career. I learnt a lot, it was a great experience and I met some great people. I really couldn’t ask for more.

To the whole team, a big thank you. You guys really made my days.

What is next

My next adventure is starting soon and it will be a blast. Just stay tuned.

Back to blogging

Sun, 31 Jan 2016 17:53:00 +0000

Despite my best intentions, this blog went dead for a little over two years.

Now I really feel it’s time to change, it’s critical to start writing again. My main goal is to start shaping organizations and the technical community around me, publishing articles is the first small step toward this direction.

I will try to keep all my articles relevant and focused on software engineering and automation. I might throw a few articles about finance too as I’m increasingly getting into it.

This blog doesn’t provide (on purpose) a comments section. That’s because I love interactions and conversations therefore you are highly encouraged to ping me directly here.

Presenting Tenzo

Mon, 20 Jan 2014 15:38:00 +0000

Tenzo is an essential theme for Jekyll (and my first open source project, be kind!). I started crafting it for my personal website and then decided to add some extra-work and ship a ready-to-use package for the public. If you are curious to see it in action, well, you are already doing so.

Tenzo has been crafted keeping semplicity in mind. It’s not fancy, it’s not extra-packed with features. It is essential and wants to keep the focus on you and on content.

Typography

Tenzo is based on two fonts: ‘Roboto’ for headlines and ‘Cambo’ for paragraphs. It aims to be extra-clear and a pleasure to read. All fonts are completely free, imported via Google fonts.

Mobile first

The only thing that matters is what you write. Tenzo will behave very well when displayed on phones and tablets.

Installation

To use Tenzo, all you have to do is to download or clone the github repo, place it in a working jekyll environment and you should almost be good to go. Yes, if you fork the repo on github, it will be running out of the box with github pages. Just make sure to rename the repository accordingly.

All the configuration happens in the _config.yml. After filling the config file, if you are running a self-hosted (or local) instance Run Jekyll serve and you’ll be ready to start writing.

Styling posts

Tenzo is pure CSS3. There’s no Javascript, it doesn’t use any plugin.

An important aspect to note is that it uses custom html elements. I have no idea how this will affect website indicization, but - at least for me - calling all the elements “div” is a nonsense - (yet, i’m not sure if it’s a feature or a bug, only time will tell). Let’s try to introduce some innovation.

Headings

h1 is reserved for the article main title.

H2 Looks like this

H3 Looks like this

H4 Looks like this

H5 Looks like this

Code snippets

Here is how a code snippet is displayed:

def print_hi(name)
  puts "Hi, #{name}"
end
print_hi('Tom')
#=> prints 'Hi, Tom' to STDOUT.

Images

Here is how including images looks like:

Lists

Unordered List

First item
Second item
Third item

Ordered List

First item
Second item
Third item

Horizontal rule

And if (by any chance) you want to add a horizontal rule, here is what you get:

Bugs and Issues

Tenzo isn’t perfect, but aims high. If you find any bug or if you have any suggestion do not hesitateto contribute on github.

Credits

I took the best from the best. For all the typography work i used typecast. Code is displayed using Pygment, code snippet style was inspired by svbtle.

Hello world

Mon, 20 Jan 2014 14:55:00 +0000

After quite a while I finally launched my personal website. I’ve tried multiple times in the past and I’ve been using different platforms (wordpress, medium, ghost) but in the end i was never happy with the final result. I’ve spent by far too many hours trying to build a virtual place i’d be happy to call “home”.

For every time i tried, every time i ended up being just frustrated. While reaching a nice appearance has been always the easiest part, knowing that the content was published with platforms that were (at best) “black bagic” and on which i had very little control has been always extremely frustrating. I wanted something simple, where i owned the content, on which i could hack easily (without an unreasonable amount of time spent studying random documentation) and where content was king.

So far, everything i tried either required lot of time spent in configuration, unreasonable server/platform costs or my published content was owned by third parties (or a mix of these).

Finally i reached equilibrium. Switched to Jekyll, crafted the theme (Tenzo), hosted on github.

Here i’ll be writing mostly about coding and computer science, occasionally about math and life. It will be an interesting adventure writing here and i hope that you will enjoy the ride with me. You can follow me on twitter or add to your favurites the rss feed.

PS: English isn’t my first language, it is very very likely that i’ll make mistakes. Please, if you spot any, open an issue on github.