4 ms·
> In more recent versions of Git (v1.7.9 and above), you can now also sign individual commits. https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work https
by meesterdude 11y ago
> In more recent versions of Git (v1.7.9 and above), you can now also sign individual commits.
https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work
does this resolve the issue for git? or is it still possible to subvert?
- dietrichepp 11y agoThat only solves authentication, not authorization.
- tajen 11y agoSo you can trace for sure who made every commit, but you're saying an unauthorized actor can add a commit? Well you would detect that in the code review before the release.
- chei0aiV 11y agogit supports signed pushes as well as signed commits and tags. The signed pushes thing had a vulnerability though: http://mikegerwitz.com/papers/git-horror-story http://mikegerwitz.com/papers/git-horror-story https://developer.atlassian.com/blog/2015/05/git-horror-story-loose-nonces/ https://developer.atlassian.com/blog/2015/05/git-horror-stor...