4 ms·

Putting on my skeptical hat: what are commit signatures used for in the OSS community today, in practice? Do they prevent any supply chain attacks? Is forging a

by klabb3 4y ago

Putting on my skeptical hat: what are commit signatures used for in the OSS community today, in practice? Do they prevent any supply chain attacks? Is forging a commit really an attractive strategy for an attacker? I assume the most form of verification is checking the github account/reputation.

yarg 4y ago
A malicious forged change in a CI/CD chain could cause problems.
dane-pgp 4y ago
> what are commit signatures used for in the OSS community today I'd like to think that when a package maintainer for a Linux distro downloads the latest version of the code they are packaging, they check that all the commits are signed by the same developer IDs as last time. Okay, that's an over-simplification because you need to allow for key rotation, and new people joining the project, but that could be tractable or even automatable with a few heuristics and tools. For example, there could be a tool for checking if new keys were signed by previous keys with the same email address, and there could be a contributors.policy file which specifies who the project leaders are and how many of them are needed to sign off on a given release or commit.
Gigachad 4y ago
There was a case a while ago where the git server for a large project had been hacked and the maintainers had no way of knowing which commits were legitimate
- gspr 4y ago
  I agree that this is a potentially huge problem, but I wouldn't say that they had "no way"; thanks to git's distributed natured, surely if N developers got together and verified that their local hashes match up to a certain commit, they could be reasonably sure that those are legitimate.
  - Gigachad 4y ago
    The hack had happened a while ago. So it would have synced up for everyone. Sure, you might notice, but you very easily wouldn’t.
    - gspr 4y ago
      Good point!
dlor 4y ago
I don't disagree. The current state of git signing is pretty bad. I wrote more here: https://link.medium.com/zqy8VVzAJqb https://link.medium.com/zqy8VVzAJqb I'm a maintainer on gitsign and think we can fix it though!
- est31 4y ago
  Thanks for pushing the state of the art on this. Personally I'm not a fan of git signatures either because they seem to pair something supposed to be permanent (a commit) to something supposed to be ephemeral (a signing key). (Distributed) ledger technology can absolutely improve the status quo here.
yakubin 4y ago
> I assume the most form of verification is checking the github account/reputation. Did you mean to write "the most [used] form"? If so, it's unreliable. If you change your Git settings to use Torvals' email address, on GitHub it will show up as if your commits were made by his account[1]. [1]: <https://dev.to/martiliones/how-i-got-linus-torvalds-in-my-contributors-on-github-3k4g https://dev.to/martiliones/how-i-got-linus-torvalds-in-my-co...>
- klabb3 4y ago
  > Did you mean to write "the most [used] form"? Yeah. Too late to edit. I know that, but I postulate that people look at the author of the PR in githubs UI, not individual commits. Even if they did, the verified badge only points to a github profile anyway. So.. an attacker would much rather want to impersonate a github profile than a commit. I guess.

by klabb3 4y ago

yarg 4y ago

A malicious forged change in a CI/CD chain could cause problems.

dane-pgp 4y ago

> what are commit signatures used for in the OSS community today I'd like to think that when a package maintainer for a Linux distro downloads the latest version of the code they are packaging, they check that all the commits are signed by the same developer IDs as last time. Okay, that's an over-simplification because you need to allow for key rotation, and new people joining the project, but that could be tractable or even automatable with a few heuristics and tools. For example, there could be a tool for checking if new keys were signed by previous keys with the same email address, and there could be a contributors.policy file which specifies who the project leaders are and how many of them are needed to sign off on a given release or commit.

Gigachad 4y ago

There was a case a while ago where the git server for a large project had been hacked and the maintainers had no way of knowing which commits were legitimate

gspr 4y ago
I agree that this is a potentially huge problem, but I wouldn't say that they had "no way"; thanks to git's distributed natured, surely if N developers got together and verified that their local hashes match up to a certain commit, they could be reasonably sure that those are legitimate.
- Gigachad 4y ago
  The hack had happened a while ago. So it would have synced up for everyone. Sure, you might notice, but you very easily wouldn’t.
  - gspr 4y ago
    Good point!

dlor 4y ago

I don't disagree. The current state of git signing is pretty bad. I wrote more here: https://link.medium.com/zqy8VVzAJqb https://link.medium.com/zqy8VVzAJqb I'm a maintainer on gitsign and think we can fix it though!

est31 4y ago
Thanks for pushing the state of the art on this. Personally I'm not a fan of git signatures either because they seem to pair something supposed to be permanent (a commit) to something supposed to be ephemeral (a signing key). (Distributed) ledger technology can absolutely improve the status quo here.

yakubin 4y ago

> I assume the most form of verification is checking the github account/reputation. Did you mean to write "the most [used] form"? If so, it's unreliable. If you change your Git settings to use Torvals' email address, on GitHub it will show up as if your commits were made by his account[1]. [1]: <https://dev.to/martiliones/how-i-got-linus-torvalds-in-my-contributors-on-github-3k4g https://dev.to/martiliones/how-i-got-linus-torvalds-in-my-co...>

klabb3 4y ago
> Did you mean to write "the most [used] form"? Yeah. Too late to edit. I know that, but I postulate that people look at the author of the PR in githubs UI, not individual commits. Even if they did, the verified badge only points to a github profile anyway. So.. an attacker would much rather want to impersonate a github profile than a commit. I guess.