Git cheatsheet

Differences between PR branch and the main Polaris branch:

git fetch --all

git diff upstream/main...origin/$FEATURE_BRANCH --name-only

Note the elipses. 

This is not the same as simply:

git diff upstream/main origin/$FEATURE_BRANCH --name-only

Rebase and merge do the same thing in different ways. Whereas merge splices two branches together, rebase rewrites the history to make it look as if there was no branch at all. This might mean that if you merge main onto your feature branch and then push it to the same feature branch, it may be reject even if you're the only person committing to that branch. This is because your local changes have different hashes to the remote. It's easily resolved with:

git push --force-with-lease origin $FEATURE_BRANCH

To rebase to main, the path should be:

git fetch origin

git switch $FEATURE_BRANCH

git rebase origin/main

git switch main

git pull --ff-only origin main

git merge --ff-only $FEATURE_BRANCH

git push origin main

Note that merge is a misnomer. It will act like a rebase.

The --ff is a fast-forward and will just move the branch pointer if there are no new commits to the branch to which your pulling. If there are, you'll need to merge like normal. On the merge, if there are changes, it will create a new commit.

Miscellaneous Security

Examine your JVM's certificates of your Certificate Authorities with the tool provided by the JDK:

keytool --list -keystore /usr/lib/jvm/jdk-25.0.2+10/lib/security/cacerts

This can tell you if your credentials are broken:

$ openssl s_client -showcerts -connect YOUR_DOMAIN:443

CONNECTED(00000003)

depth=2 C = US, O = Amazon, CN = Amazon Root CA 1

...

Certificate chain

 0 s:CN = emryspolaris.click

   i:C = US, O = Amazon, CN = Amazon RSA 2048 M01

   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256

   v:NotBefore: Nov 21 00:00:00 2025 GMT; NotAfter: Dec 20 23:59:59 2026 GMT

-----BEGIN CERTIFICATE-----

...

OWASP (Open World Application Security Project) is non-profit open source and docs.

SPIFFE and SPIRE

RFC 8693 defines how one OAuth token can be exchanged for another, typically to downscope its rights before performing a more granular action.

While KeyCloak operates at the human level, SPIFFE (workload identity standards) and SPIRE (its runtime) operate lower. 

SPIFFE rests on three concepts

1. SPIFFE ID - a URL that acts like 'username' for the container or machine.
2. SPIFFE Verifiable Identity Document (SVID) - a short lived certificate
3. An API that can give a SVID with no further protocol.

SPIRE specifies a central Server for identity and Agents running on nodes. Both the node and the process must go through a process of attestation.

IP addresses

Note that big corporations often use a CDN so when you ping them, you're probably hitting servers owned by, for example, Fastly. To see the true addresses, run somthing like:

getent hosts www.bbc.co.uk

Server Name Indication 

SNI is a field in the TLS handshake carrying the hostname the client wants to reach.

It exists because of a chicken-and-egg problem. One IP address can serve thousands of sites, each with its own certificate. The server has to choose which certificate to present, but that choice happens before there's an encrypted channel to ask over. So the client puts the hostname in the very first packet, the ClientHello, in plaintext.

The client writes its own ClientHello. Nothing stops it sending SNI good-bucket.storage.googleapis.com while the encrypted Host header says bad-bucket.storage.googleapis.com — and the server routes on Host, which the policy can't see. That's domain fronting, and it's the one hole SNI filtering can't close by itself. 

"Domain Fronting: This is the process of using multiple different domain names in the various layers of a web connection, which helps an attacker evade detection from monitoring while they quietly connect to a target." - Aligning Security Operations with the MITRE ATT&CK Framework

Zero Trust Architectures

NetBird is an open source Go tool that instead of going through a front door, transparently talks to services directly. It sits on the open source C tool, WireGuard and uses an IdP to identify the user.

Pomerium is another open source Go app that sits in front of, say, a web app and allows access based on, say, the device that's trying to connect. Other policies can be implemented like geolocation.

Key Ceremony

This is a physical event between humans where keys are exchanged under tight security.