- [Instructor] Code repositories play an important role
in modern software development,
providing both secure storage for code and version control.
Security professionals should understand
the use of code repositories
and the different security issues that they may raise.
The main purpose of a code repository
is to store the source files used in software development
in a centralized location that allows for secure storage
and the coordination of changes among multiple developers.
Code repositories also perform version control,
allowing the tracking of changes
and the rollback of code to earlier versions when required.
Basically, code repositories perform
the housekeeping work of software development,
making it possible for many people
to share work on a large software project
in an organized fashion.
Code repositories also meet the needs
of security and auditing professionals
who want to ensure that software development
includes automated auditing and logging of changes.
By exposing code to all developers in an organization,
code repositories promote code reuse.
Developers seeking code to perform a particular function
can search the repository for existing code
and then reuse it rather than starting from ground zero.
Code repositories also help avoid the problem of dead code,
where code is in use in an organization
but nobody is responsible for the maintenance of that code
and, in fact, nobody may even know
where the original source files reside.
Git is one of the most popular version control mechanisms.
Let's take a look at how a developer might use Git
in conjunction with the GitHub code repository.
I'm going to go ahead and make some edits to a file here,
called ssa.r.
This is just a program written
in the R programming language.
I'm going to add in just a comment up here on the top
that says This is a comment.
And I'm going to write this file to disk and close it out.
And this file is actually part of a Git repository.
I'm going to go ahead and take a look here
by typing the command git status.
And, as you can see,
it tells me that I've modified one file.
The file ssa.r has been modified.
If I want to go ahead and use Git
to add this to the GitHub repository
in the cloud and update it,
I have to go ahead and tell Git to do that.
I'm going to say git add ssa.r.
And now, when I go ahead and look at git status,
it tells me that the file has been modified
and the change is to be committed.
So, if I go ahead and do that, git commit,
it's asking me for information about why I'm making changes.
This is just a comment that's going to be displayed
to all other developers that tells them
about the change that I've made.
I'm going to write here added comment,
and that'll be the message displayed to other developers
about why I made this change.
And, as you can see,
it gives me some information here about the change
and tells me that I can go ahead
and change this if I wanted to change the author.
But it tells me one file has been changed
and two insertions have been made to that file.
I'm going to go ahead now and look at the status again,
and it tells me that
there aren't any modified files that I haven't committed,
but it also tells me that my branch
is ahead of origin/master by one commit.
What this is telling me is that I've made the change
and committed it on my local system,
but I haven't yet updated the master repository on GitHub.
So, I'm going to go ahead and do that.
Let's type git push,
and wait a moment as this is being synchronized
to the cloud.
And, as you can see, Git went ahead and updated github.com
in this data management repository.
So here I am on the GitHub website.
I'm going to go look at the data management repository.
I'm going to navigate to the ssa.r file.
And, as you can see, here is the ssa.r file.
There's my comment that I typed in, added comment,
and this change was made two minutes ago.
If I go ahead and drill into this file,
you can see here's the file that I've uploaded to the cloud,
and there's my This is a comment line.
I can also go ahead and look at the history.
It tells me all of the commits that have been made
and what the history of this file is.
Now let's go back to Git and see what happens
if we make a mistake when we make an edit.
I'm going to go ahead and edit the ssa.r file again,
and I'm going to go edit out the This is a comment line.
And then save the file,
and look at git status.
And, as you can see, the ssa.r file has been modified.
I can also go ahead and type the command git diff ssa.r,
and this tells me the difference between
the current committed version
and the version that I have currently written to disk.
And, as you can see, it says that the difference is
that the line This is a comment has been removed.
If I want to go ahead and update this file
by pulling down the most recent one from the web,
basically, undoing my change,
I can go ahead and type git checkout
ssa.r.
And now, if I take a look at ssa.r,
you can see that the line This is a comment
has been added back in.
Now, I'm not trying to make you a Git expert here
or an expert in code repositories.
All you'll need for the exam
is an understanding of what code repositories are
and the functions that they have.
Source code repositories may be public or private.
In the previous example, I used GitHub,
a cloud-based code repository.
GitHub supports both public and private repositories,
and security teams must be careful
to ensure that developers use the correct type
to avoid exposing sensitive code on the web.
Even when developers do intend to release code publicly,
they must be careful to remove sensitive information
from that code before publishing it.
For example, this story, from 2014, tells of thieves
who discovered developers who accidentally left
their secret keys for Amazon Web Services
in the code that they published to a public repository.
The thieves took these keys
and used them to run up significant AWS bills
before they were discovered.
Securing code repositories is an important part of the work
of software developers and cyber security professionals.