3 ms·

This is nice. At my company, some “bad actors” were pushing commits to git repositories that impersonated a bunch of employees at the company to repos that were

This is nice. At my company, some “bad actors” were pushing commits to git repositories that impersonated a bunch of employees at the company to repos that were essentially targeted hate crimes. I definitely recommend something like this.

nonethewiser 4y ago
Commits such as?
- wyldfire 4y ago
  commit 3c2f202543b31e9d7e2fff92a211a0f37ebcca9b (HEAD -> master) Author: Dave <dave@meanco.com> Date: Tue Sep 13 21:32:41 2022 -0500 I am not smart.
  - waynesonfire 4y ago
- whitepirate20 4y ago
  Just code contributions to some trans hating repo or something, don’t remember the details.
- nukemandan 4y ago
  https://github.com/jayphelps/git-blame-someone-else https://github.com/jayphelps/git-blame-someone-else
wyldfire 4y ago
Note that signing commits doesn't bar bad actors from pushing unsigned commits with forged identities. Also note that until you can individually get the good actors' public key you can't verify their commits. So it's not enough to distribute the instructions in this webpage, you also have to have a trusted key exchange. Everyone who wants to verify commits will need a copy of everyone who might sign commits' public keys. If you trust github then you can use them as a key broker like the "User SSH Keys from GitHub" section suggests, if all of your committers are github users.
- echohack5 4y ago
  > If you trust github then you can use them as a key broker like the "User SSH Keys from GitHub" section suggests, if all of your committers are github users. Additionally you can enable "Vigilant Mode" to make it obvious when commits are untrusted. https://github.blog/changelog/2021-04-28-flag-unsigned-commits-with-vigilant-mode/ https://github.blog/changelog/2021-04-28-flag-unsigned-commi...
- shagie 4y ago
  > Note that signing commits doesn't bar bad actors from pushing unsigned commits with forged identities. This would need to be coupled with a "reject unsigned commits" policy on push. For example - https://docs.gitlab.com/ee/user/project/repository/push_rules.html#prevent-unintended-consequences https://docs.gitlab.com/ee/user/project/repository/push_rule... And note that the caveats that it has would require the person to log in to gitlab to not need to push (by using the webIDE instead) which leaves an audit trail there. Similar functionality can be crafted with a pre-receive commit hook - https://docs.github.com/en/enterprise-server@3.2/admin/policies/enforcing-policy-with-pre-receive-hooks/creating-a-pre-receive-hook-script https://docs.github.com/en/enterprise-server@3.2/admin/polic... An example of such a hook - https://github.com/github/platform-samples/blob/master/pre-receive-hooks/block_unsigned_commits.sh https://github.com/github/platform-samples/blob/master/pre-r...
catiopatio 4y ago

nonethewiser 4y ago

Commits such as?

wyldfire 4y ago
commit 3c2f202543b31e9d7e2fff92a211a0f37ebcca9b (HEAD -> master) Author: Dave <dave@meanco.com> Date: Tue Sep 13 21:32:41 2022 -0500 I am not smart.
- waynesonfire 4y ago
whitepirate20 4y ago
Just code contributions to some trans hating repo or something, don’t remember the details.
nukemandan 4y ago
https://github.com/jayphelps/git-blame-someone-else https://github.com/jayphelps/git-blame-someone-else

wyldfire 4y ago

Note that signing commits doesn't bar bad actors from pushing unsigned commits with forged identities. Also note that until you can individually get the good actors' public key you can't verify their commits. So it's not enough to distribute the instructions in this webpage, you also have to have a trusted key exchange. Everyone who wants to verify commits will need a copy of everyone who might sign commits' public keys. If you trust github then you can use them as a key broker like the "User SSH Keys from GitHub" section suggests, if all of your committers are github users.

echohack5 4y ago
> If you trust github then you can use them as a key broker like the "User SSH Keys from GitHub" section suggests, if all of your committers are github users. Additionally you can enable "Vigilant Mode" to make it obvious when commits are untrusted. https://github.blog/changelog/2021-04-28-flag-unsigned-commits-with-vigilant-mode/ https://github.blog/changelog/2021-04-28-flag-unsigned-commi...
shagie 4y ago
> Note that signing commits doesn't bar bad actors from pushing unsigned commits with forged identities. This would need to be coupled with a "reject unsigned commits" policy on push. For example - https://docs.gitlab.com/ee/user/project/repository/push_rules.html#prevent-unintended-consequences https://docs.gitlab.com/ee/user/project/repository/push_rule... And note that the caveats that it has would require the person to log in to gitlab to not need to push (by using the webIDE instead) which leaves an audit trail there. Similar functionality can be crafted with a pre-receive commit hook - https://docs.github.com/en/enterprise-server@3.2/admin/policies/enforcing-policy-with-pre-receive-hooks/creating-a-pre-receive-hook-script https://docs.github.com/en/enterprise-server@3.2/admin/polic... An example of such a hook - https://github.com/github/platform-samples/blob/master/pre-receive-hooks/block_unsigned_commits.sh https://github.com/github/platform-samples/blob/master/pre-r...

catiopatio 4y ago