Csoban Kesmarki csobankesmarki

Github provides no facility to do this via the UI. This is sad, because it would be extremely useful in order to draft something before publishing it. It would also be trivial for them to implement. Never mind; here's how to do it manually:

Get the "Clone this Gist" text from the left-hand side of the private Gist, e.g. https://gist.github.com/b9cc265982870c091a1e.git, and extract the ID b9cc265982870c091a1e.
Go to https://gist.github.com/ and create a dummy new public Gist.
Get the "Clone this Gist" text from the left-hand side, e.g. https://gist.github.com/8270253.git, and extract the ID 8270253.
git clone [email protected]:b9cc265982870c091a1e tmp-dir && cd tmp-dir && git push -f [email protected]:8270253.git

How to have specific .gitignore for each git branch

Objective

My objective is to have some production files ignored on specific branches. Git doesn't allow to do it.

Solution

My solution is to make a general .gitignore file and add .gitignore.branch_name files for the branches I want to add specific file exclusion. I'll use post-checkout hook to copy those .gitignore.branch_name in place of .git/info/exclude each time I go to the branch with git checkout branch_name.

Run commands on remote Docker host

This is how to connect to another host with your docker client, without modifying your local Docker installation or when you don't have a local Docker installation.

Enable Docker Remote API

First be sure to enable the Docker Remote API on the remote host.

This can easily be done with a container.
For HTTP connection use jarkt/docker-remote-api.

How to Generate & Use Private Keys using OpenSSL's Command Line Tool

These commands generate and use private keys in unencrypted binary (not Base64 “PEM”) PKCS#8 format. The PKCS#8 format is used here because it is the most interoperable format when dealing with software that isn't based on OpenSSL.

OpenSSL has a variety of commands that can be used to operate on private key files, some of which are specific to RSA (e.g. openssl rsa and openssl genrsa) or which have other limitations. Here we always use

The default format of keys was changed in OpenSSL 1.0. From OpenSSL 1.0 change log:

Make PKCS#8 the default write format for private keys, replacing the traditional format. This form is standardised, more secure and doesn't include an implicit MD5 dependency. [Steve Henson]

Good explanations of the difference between the two formats: https://tls.mbed.org/kb/cryptography/asn1-key-structures-in-der-and-pem

Converting RSA private key:

NB: This document describles a 'Old-School' way of using Yubikey with SSH

Modern OpenSSH has native support for FIDO Authentication. Its much simpler and should also be more stable with less moving parts. OpenSSH also now has support for signing arbitary files witch can be used as replacement of gnupg. Git also supports signing commits/tags with ssh keys.

Pros of FIDO

Simpler stack / less moving parts
Works directly with ssh, ssh-add and ssh-keygen on most computers
Simpler
Private key can never leave the FIDO device

	#!/bin/bash

	echo "All certificates in ca-certificates.crt, listed by subject:"
	awk -v cmd='openssl x509 -noout -subject' '/BEGIN/{close(cmd)};{print \| cmd}' < /etc/ssl/certs/ca-certificates.crt

	echo "All certificates in ca-certificates.crt, listed by subject, check for presence of VeriSign's 'Class 3 Public Primary - G5':"
	awk -v cmd='openssl x509 -noout -subject' '/BEGIN/{close(cmd)};{print \| cmd}' < /etc/ssl/certs/ca-certificates.crt \| grep "G5"

	# Source: http://www.sysmic.org/dotclear/index.php?post/2010/03/24/Convert-keys-betweens-GnuPG%2C-OpenSsh-and-OpenSSL
	# OpenSSH private keys are directly understable by OpenSSL. You can test for example:

	openssl rsa -in ~/.ssh/id_rsa -text
	openssl dsa -in ~/.ssh/id_dsa -text

	# So, you can directly use it to create a certification request:
	openssl req -new -key ~/.ssh/id_dsa -out myid.csr

	# You can also use your ssh key to create a sef-signed certificate:

	#!/bin/bash

	HOME=/var/named
	ADLISTURL="https://pgl.yoyo.org/adservers/serverlist.php?hostformat=bindconfig;showintro=0;mimetype=plaintext"
	MWLISTURL="http://mirror1.malwaredomains.com/files/spywaredomains.zones"
	ADLISTFILE=/tmp/adlistfile
	MWLISTFILE=/tmp/mwlistfile

	# Download newest blacklists
	curl -s -o $ADLISTFILE $ADLISTURL

	org.wikimedia.ssh-pkcs11-agent.plist -> ~/Library/LaunchAgents
	OPENSC_LIBS=/usr/local/Cellar/opensc/0.15.0/lib
	ssh-add -s $OPENSC_LIBS/opensc-pkcs11.so