{"thread":{"id":"45252","subject":"gpg verify git sub modules useful?","startedAt":"2017-02-28T15:52:39Z","lastAt":"2017-03-01T19:10:40Z","messageCount":4,"participants":["Patrick Schleizer","Junio C Hamano","Stefan Beller"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"312850","messageId":"a9da4416-6437-a491-f461-c5e61d805b2d@riseup.net","threadId":"45252","inReplyTo":null,"subject":"gpg verify git sub modules useful?","fromName":"Patrick Schleizer","fromEmail":"patrick-mailinglists@whonix.org","sentAt":"2017-02-28T15:50:00Z","receivedAt":"2017-02-28T15:52:39Z","isPatch":false,"sender":{"key":"patrick-mailinglists@whonix.org","avatar":null},"body":"When using git submodules, is there value in iterating about the git\nsubmodules running \"git verfiy-commit HEAD\" or would that be already\ncovered by the git submodule verification?\n\nCheers,\nPatrick\n"},{"id":"312859","messageId":"xmqqmvd6kykc.fsf@gitster.mtv.corp.google.com","threadId":"45252","inReplyTo":"a9da4416-6437-a491-f461-c5e61d805b2d@riseup.net","subject":"Re: gpg verify git sub modules useful?","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2017-02-28T17:36:03Z","receivedAt":"2017-02-28T17:47:14Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Patrick Schleizer writes:\n\n> When using git submodules, is there value in iterating about the git\n> submodules running \"git verfiy-commit HEAD\" or would that be already\n> covered by the git submodule verification?\n\nThat depends on what you are referring to with the \"git submodule\nverification\" and more importantly what threat you are guarding\nagainst. \"git -C verify-commit HEAD\" may make sure\nthat the contents of that commit object is GPG signed by whoever you\ntrust--is that what you want to make sure? Or do you want all\ncommits in the submodule history to be similarly signed because the\ntree of the superproject can switch to some other commit there?\n"},{"id":"312960","messageId":"8cdd9f2d-415c-1b60-0017-bf973e8cf914@riseup.net","threadId":"45252","inReplyTo":"xmqqmvd6kykc.fsf@gitster.mtv.corp.google.com","subject":"Re: gpg verify git sub modules useful?","fromName":"Patrick Schleizer","fromEmail":"patrick-mailinglists@whonix.org","sentAt":"2017-03-01T18:28:00Z","receivedAt":"2017-03-01T18:40:33Z","isPatch":false,"sender":{"key":"patrick-mailinglists@whonix.org","avatar":null},"body":"Good questions, thank you for trying to figure out what I am asking. :)\n\nJunio C Hamano:\n> Patrick Schleizer writes:\n> \n>> When using git submodules, is there value in iterating about the git\n>> submodules running \"git verfiy-commit HEAD\" or would that be already\n>> covered by the git submodule verification?\n> \n> That depends on what you are referring to with the \"git submodule\n> verification\"\n\ncd submodule\nif ! git verfiy-commit HEAD ; then\n error\nfi\n\n> and more importantly what threat you are guarding\n> against. \n\nAll main (non-submodule) (merge) commits and submodule (merge) commits\nare signed by me.\n\n1) git --recursive clone main (non-submodule) git repository\n2) cd git main repository\n3) git verify-commit HEAD or git verify-tag tag-name\n4) git submodule update\n\nWhat if the main (non-submodule) git repository gpg signature was okay\nbut then after git fetched the submodules these compromised (MITM'ed) ones?\n\nDoes the having gpg verified the root (main git repository) ensure that\nsubmodule commits are also quasi verified?\n\n> \"git -C verify-commit HEAD\" may make sure\n> that the contents of that commit object is GPG signed by whoever you\n> trust--is that what you want to make sure?\n\n> Or do you want all\n> commits in the submodule history to be similarly signed because the\n> tree of the superproject can switch to some other commit there?\n\nI guess so.\n\n"},{"id":"312964","messageId":"CAGZ79kav0yB=g5kwB68oHRxbd0mDJ5-gGTJSidSKkZ75gmT44Q@mail.gmail.com","threadId":"45252","inReplyTo":"8cdd9f2d-415c-1b60-0017-bf973e8cf914@riseup.net","subject":"Re: gpg verify git sub modules useful?","fromName":"Stefan Beller","fromEmail":"sbeller@google.com","sentAt":"2017-03-01T19:08:48Z","receivedAt":"2017-03-01T19:10:40Z","isPatch":false,"sender":{"key":"stefanbeller@gmail.com","avatar":"https://avatars.githubusercontent.com/u/455868?v=4"},"body":"On Wed, Mar 1, 2017 at 10:28 AM, Patrick Schleizer\n wrote:\n> Good questions, thank you for trying to figure out what I am asking. :)\n>\n> Junio C Hamano:\n>> Patrick Schleizer writes:\n>>\n>>> When using git submodules, is there value in iterating about the git\n>>> submodules running \"git verfiy-commit HEAD\" or would that be already\n>>> covered by the git submodule verification?\n>>\n>> That depends on what you are referring to with the \"git submodule\n>> verification\"\n>\n> cd submodule\n> if ! git verfiy-commit HEAD ; then\n> error\n> fi\n>\n>> and more importantly what threat you are guarding\n>> against.\n>\n> All main (non-submodule) (merge) commits and submodule (merge) commits\n> are signed by me.\n>\n> 1) git --recursive clone main (non-submodule) git repository\n> 2) cd git main repository\n> 3) git verify-commit HEAD or git verify-tag tag-name\n> 4) git submodule update\n>\n> What if the main (non-submodule) git repository gpg signature was okay\n> but then after git fetched the submodules these compromised (MITM'ed) ones?\n\nThe signing in Git is just signing the commit hash essentially.\n\n> Does the having gpg verified the root (main git repository) ensure that\n> submodule commits are also quasi verified?\n\nThat is my understanding. There is no difference between the security of\na file or a submodule, just the way of obtaining and its reporting is different.\nBoth a file and a submodule are referred to via a hash (currently sha1).\nObtaining a file is implicit whereas obtaining the submodule is explicit.\nThe reporting (in e.g. git-status) ... depends on a lot of options to be set.\n\nWhen signing the superproject, you acknowledge the submodules\nbeing in the state as recorded. (Same with s/submodules/files/)\n\nSo I am not sure what kind of additional signing you're looking\nfor in the submodules.\n\nThanks,\nStefan\n"}]}