{"thread":{"id":"25252","subject":"What happens if someone modifies repository without me knowing?","startedAt":"2010-09-26T19:07:29Z","lastAt":"2010-09-26T20:23:22Z","messageCount":3,"participants":["Manuel Reimer","Sverre Rabbelier","Ilari Liusvaara"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"151743","messageId":"i7o5rc$t3$1@dough.gmane.org","threadId":"25252","inReplyTo":null,"subject":"What happens if someone modifies repository without me knowing?","fromName":"Manuel Reimer","fromEmail":"manuel.spam@nurfuerspam.de","sentAt":"2010-09-26T19:07:29Z","receivedAt":"2010-09-26T19:07:29Z","isPatch":false,"sender":{"key":"manuel.spam@nurfuerspam.de","avatar":null},"body":"Hello,\n\nlet's assume someone got access to the GIT server of my hoster and tries \nto hide a change within an old commit, done by me.\n\nHow will GIT tell me about this hidden change? Will a \"git pull\" just \nbring this change into my working copy, whithout telling me about the \nchange?\n\nYours\n\nManuel\n"},{"id":"151744","messageId":"AANLkTimUCGcM+OXqBOfHmGCaBamG27fjjz098-7GZ1G7@mail.gmail.com","threadId":"25252","inReplyTo":"i7o5rc$t3$1@dough.gmane.org","subject":"Re: What happens if someone modifies repository without me knowing?","fromName":"Sverre Rabbelier","fromEmail":"srabbelier@gmail.com","sentAt":"2010-09-26T19:16:33Z","receivedAt":"2010-09-26T19:16:33Z","isPatch":false,"sender":{"key":"srabbelier@gmail.com","avatar":"https://avatars.githubusercontent.com/u/3098?v=4"},"body":"Heya,\n\nOn Sun, Sep 26, 2010 at 21:07, Manuel Reimer <Manuel.Spam@nurfuerspam.de> wrote:\n> How will GIT tell me about this hidden change? Will a \"git pull\" just bring\n> this change into my working copy, whithout telling me about the change?\n\nIt will tell you it did a \"forced update\", assuming the other side has\nbeen set as your upstream. If you do a pull (rather than a fetch) it\nwill try to apply the changes right away too.\n\nDemonstration:\n\nsverre@laptop-sverre:~/code\n$ git init test\nInitialized empty Git repository in /home/sverre/code/test/.git/\nsverre@laptop-sverre:~/code\n$ cd test/\nsverre@laptop-sverre:~/code/test\n$ echo \"content\" > foo\nsverre@laptop-sverre:~/code/test\n$ git add foo\nsverre@laptop-sverre:~/code/test\n$ git commit -m \"Initial\"\n[master (root-commit) 9d48240] Initial\n 1 files changed, 1 insertions(+), 0 deletions(-)\n create mode 100644 foo\nsverre@laptop-sverre:~/code/test\n$ echo \"second line\" >> foo\nsverre@laptop-sverre:~/code/test\n$ git commit -am \"Proper second modification\"\n[master 8367122] Proper second modification\n 1 files changed, 1 insertions(+), 0 deletions(-)\nsverre@laptop-sverre:~/code/test\n$ cd ..\nsverre@laptop-sverre:~/code\n$ git clone test/ foo\nCloning into foo...\ndone.\nsverre@laptop-sverre:~/code\n$ cd test/\nsverre@laptop-sverre:~/code/test\n$ echo \"and a third\" >> content\nsverre@laptop-sverre:~/code/test\n$ git commit --amend -am \"Tampered second modification\"\n[master 87d8e8a] Tampered second modification\n 1 files changed, 1 insertions(+), 0 deletions(-)\nsverre@laptop-sverre:~/code/test\n$ cd ../foo/\nsverre@laptop-sverre:~/code/foo\n$ git pull\nremote: Counting objects: 5, done.\nremote: Total 3 (delta 0), reused 0 (delta 0)\nUnpacking objects: 100% (3/3), done.\nFrom /home/sverre/code/test\n + 8367122...87d8e8a master     -> origin/master  (forced update)\nMerge made by recursive.\n\n-- \nCheers,\n\nSverre Rabbelier\n"},{"id":"151747","messageId":"20100926202322.GA2995@LK-Perkele-V2.elisa-laajakaista.fi","threadId":"25252","inReplyTo":"i7o5rc$t3$1@dough.gmane.org","subject":"Re: What happens if someone modifies repository without me knowing?","fromName":"Ilari Liusvaara","fromEmail":"ilari.liusvaara@elisanet.fi","sentAt":"2010-09-26T20:23:22Z","receivedAt":"2010-09-26T20:23:22Z","isPatch":false,"sender":{"key":"ilari.liusvaara@elisanet.fi","avatar":null},"body":"On Sun, Sep 26, 2010 at 09:07:29PM +0200, Manuel Reimer wrote:\n> Hello,\n> \n> let's assume someone got access to the GIT server of my hoster and\n> tries to hide a change within an old commit, done by me.\n\nCommits can not be modified once created. So the attacker would have to\nrecreate that commit with nasty modifications and then recreate every commit\nsince. \n \n> How will GIT tell me about this hidden change? Will a \"git pull\"\n> just bring this change into my working copy, whithout telling me\n> about the change?\n\nAt least after git pull, the history will look very odd if displayed\ngraphically...\n\n-Ilari\n"}]}