Skip to main content
2 of 10
Why is this important?

This might not help you at all, or it might give you the keys:

Your hint says that the "HTTPS private key has been forgotten in Git." This could mean several things, but I suspect it means that the private key was added and deleted from Git history, which in turn means you can get it back.

Hunt for it

If the Git history is short (and it might be, in an assignment like this), you can just git log --oneline --stat, Ctrl+D until you find the right commit, and git show it.

If the Git history is long, you can try fancier things to hunt for it, like

  • git log --all -- with a file filter (e.g. key.pem)
  • git log --all -i --pickaxe-regex -S with some text to look for in the delta (e.g. CERTIFICATE). This is faster than the next one, but needs the count of the searched text to change in a commit. (It ignores boring refactors.)
  • git log --all -i -G with some text to check to look for in the delta (e.g. CERTIFICATE). This is slower than the previous one, but it checks every commit.

Lesson

If you or someone on your team puts secret data into Git, you can't just git rm it away. Its content stays there in the deltas forever. You need to use a tool like git filter-repo or git filter-branch to get rid of it, and everyone with a clone of the repo who has fetched it since the secret was introduced needs to fix theirs, too. This might mean throwing their repo away and cloning a fresh copy.