3 ms·
Given a git repo with signed commits I can give you the same repo with some file(s) changed with the signatures intact. Pretty sure you can anyway, I haven't t
by kadoban 4y ago
Given a git repo with signed commits I can give you the same repo with some file(s) changed with the signatures intact.
Pretty sure you can anyway, I haven't thought deeply about the git file formats involved and such.
Note that this attack isn't _that_ serious. There's not a lot of cases where this would make sense.
- AnssiH 4y agoI don't think so, unless you utilize some not-yet-public vulnerability. As far as I know, with current public SHA-1 vulnerabilities, you can create two new objects with the same hash (collision attack), but cannot create a second object that has the same hash as some already existing object (preimage attack).
- kadoban 4y agoMy bad, yep you're right. So you could only either give 2 people different git repos that should be the same or I guess you could submit a collided file into a repo you can submit changes to (eg a public one that accepts PRs) and give someone else the other version. Given the limitations, really not too practical.