4 ms·

What kind of attack against a git repo can be realistically carried out today?

• kadoban 4y ago
  Given a git repo with signed commits I can give you the same repo with some file(s) changed with the signatures intact. Pretty sure you can anyway, I haven't thought deeply about the git file formats involved and such. Note that this attack isn't _that_ serious. There's not a lot of cases where this would make sense.
  • AnssiH 4y ago
    I don't think so, unless you utilize some not-yet-public vulnerability. As far as I know, with current public SHA-1 vulnerabilities, you can create two new objects with the same hash (collision attack), but cannot create a second object that has the same hash as some already existing object (preimage attack).
    • kadoban 4y ago
      My bad, yep you're right. So you could only either give 2 people different git repos that should be the same or I guess you could submit a collided file into a repo you can submit changes to (eg a public one that accepts PRs) and give someone else the other version. Given the limitations, really not too practical.
• deleted 4y ago
  [deleted]