4 ms·
How would you subtly add code to repositories without breaking git?
by Igglyboo 12y ago
How would you subtly add code to repositories without breaking git?
- revelation 12y agoBy breaking SHA1, obviously.
- jasonmp85 12y agoAnd if people actually signed their commits and tags?
- erdeszt 12y agoCommit hashes are not a security feature but you can sign your commits with gpg.
- wongarsu 12y agoSome projects sign their release commits and tags, some even their merge commits, but I have never seen a project which actually signs every commit. The reasoning is always that you are actually signing the whole commit chain because your commit is liked to every previous one by the commit hashes.
- erdeszt 12y agoTrue but I was just mentioning the possibility not the best practices for using it.
- wongarsu 12y agoBy breaking SHA1 you could covertly edit older commits, but existing contributors would still have the original version. As soon as somebody edits code at the intrusion it would be discovered because it would merge cleanly locally but cause a merge conflict on github. Of course on big projects a lot of the code isn't touched in years but we're talking about revealing that somebody broke SHA1. It sounds very risky given the stakes.
- peterwaller 12y agoIf you ever click "merge pull request", github makes the merge commit for you. That means they get to decide the SHA and the full contents of the commit. I'll leave the potential consequences as an exercise to the reader. I guess the only protection against this would be to either never press the merge button in github, or repeat the merge locally and check there is no diff against the remote merge.
- Igglyboo 12y agoEven if you do this you could still see the changes if you pulled down the repo and examined it.