4 ms·

I sign all my commits. Github even make it easy to see: https://github.com/blog/2144-gpg-signature-verification https://github.com/blog/2144-gpg-signature-verif

I sign all my commits. Github even make it easy to see: https://github.com/blog/2144-gpg-signature-verification https://github.com/blog/2144-gpg-signature-verification And I also use it in a few places e.g. for http://hashbang.sh/ http://hashbang.sh/, we only allow signed commits into master However, as far as I know, when you sign a git commit you are actually sign the hash of the commit. With SHA-1 broken in the current way it essentially means someone with 110K to burn could forge a commit and reuse my PGP signature.

moonshinefe 10y ago
Well holy smokes. I don't know which repository you contribute to, but if you're getting undermined by such James Bond-esque deception by super villains, in addition to someone spending 6 figures into breaking your stuff, I'd hope you'd at least review the commits you sign with your key after glancing at it. In addition, you'd have to have everyone else not notice it, all the insanely cheaper exploits not been tried on your current setup, and all the other stars aligning...
- moonshinefe 10y ago
  I'll also mention literally the first setup step to Git for most people: https://help.github.com/articles/set-up-git/ https://help.github.com/articles/set-up-git/ or similar. That might be a hint that Git isn't something which you should allow it to handle the security. Literally the first step to the entire thing: pick any email or name... Please provide reasonable security policies in your repos--and if someone is exploited, you've probably got far bigger problems than someone duplicating a sha-1. Not necessarily, but highly likely your system is owned.
moonshinefe 10y ago
Yes, if you sign off on commits you haven't reviewed to confirm the diffs at all, and they're carefully crafted files to make the collision, you may commit a duplicate sha-1, which still doesn't even break Git.
- kzrdude 10y ago
  This is an important distinction. Without a preimage attack on sha-1, the only vulnerability is if some part (yet any part) of the git objects reachable from the signed tag or commit is one half of a prepared collision pair.

moonshinefe 10y ago

Well holy smokes. I don't know which repository you contribute to, but if you're getting undermined by such James Bond-esque deception by super villains, in addition to someone spending 6 figures into breaking your stuff, I'd hope you'd at least review the commits you sign with your key after glancing at it. In addition, you'd have to have everyone else not notice it, all the insanely cheaper exploits not been tried on your current setup, and all the other stars aligning...

moonshinefe 10y ago
I'll also mention literally the first setup step to Git for most people: https://help.github.com/articles/set-up-git/ https://help.github.com/articles/set-up-git/ or similar. That might be a hint that Git isn't something which you should allow it to handle the security. Literally the first step to the entire thing: pick any email or name... Please provide reasonable security policies in your repos--and if someone is exploited, you've probably got far bigger problems than someone duplicating a sha-1. Not necessarily, but highly likely your system is owned.

moonshinefe 10y ago

Yes, if you sign off on commits you haven't reviewed to confirm the diffs at all, and they're carefully crafted files to make the collision, you may commit a duplicate sha-1, which still doesn't even break Git.

kzrdude 10y ago
This is an important distinction. Without a preimage attack on sha-1, the only vulnerability is if some part (yet any part) of the git objects reachable from the signed tag or commit is one half of a prepared collision pair.