{"thread":{"id":"58206","subject":"Coordinated Security Audit for git. Contacts needed","startedAt":"2022-07-21T16:50:07Z","lastAt":"2022-07-21T18:47:44Z","messageCount":4,"participants":["Amir Montazery","Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"459661","messageId":"CADKuG0uzh3syzgfiPLepiTLXNzkoYhLFX1h-DE3C7c8j6HXALQ@mail.gmail.com","threadId":"58206","inReplyTo":null,"subject":"Coordinated Security Audit for git. Contacts needed","fromName":"Amir Montazery","fromEmail":"amir@ostif.org","sentAt":"2022-07-21T16:49:51Z","receivedAt":"2022-07-21T16:50:07Z","isPatch":false,"sender":{"key":"amir@ostif.org","avatar":null},"body":"Hello git maintainers,\n\nThe Open Source Technology Improvement Fund, Inc (https://ostif.org)\nhas put together a coalition of 18 security professionals and\nresearchers to conduct a holistic security review of git. The\nobjective of this email is to inform you of the effort and seek\ncollaboration. We feel that the more we can engage and collaborate\nwith git maintainers, the more effective and impactful our security\nreview can be. An overview of the teams and work packages is as\nfollows:\n\nGit Security Audit Work Packages:\n\nGit source code review and threat modeling: This will be done by the\nteam at x41 d-sec with support from Gitlab reps.\n\nSupply chain security / CI infrastructure review with Chainguard and\nsupport from Gitlab.\n\nA new setup of CodeQL for git with Xavier, Turbo and their team from Github.\n\n\nWe would love to collaborate to establish communication channels with\nkey maintainers. Would it be possible for one of us to join one of\nyour community meetings for 5 minutes? Or is there a key person we\nshould be engaging?\n\n\nWe thank you for maintaining a key and critical piece of software for\nthe open source community and beyond.\n\nThanks again,\nAmir\n\n-- \nAmir Montazery\nManaging Director\nOpen Source Technology Improvement Fund\nhttps://ostif.org/\nhttps://calendly.com/ostif\n"},{"id":"459671","messageId":"xmqq8romicil.fsf@gitster.g","threadId":"58206","inReplyTo":"CADKuG0uzh3syzgfiPLepiTLXNzkoYhLFX1h-DE3C7c8j6HXALQ@mail.gmail.com","subject":"Re: Coordinated Security Audit for git. Contacts needed","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2022-07-21T17:47:14Z","receivedAt":"2022-07-21T17:47:23Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Amir Montazery writes:\n\n> We would love to collaborate to establish communication channels with\n> key maintainers. Would it be possible for one of us to join one of\n\nWe do not call people \"maintainers\", but \"developers\" and/or\n\"contributors\".\n\n> your community meetings for 5 minutes? Or is there a key person we\n> should be engaging?\n\nThere is no \"community meetings\" other than the informal \"stand-up\"\nirc discussion that is biweekly. The log of the latest is at\nhttps://colabti.org/irclogger/irclogger_log/git-devel?date=2022-07-18\nbut generally speaking we are not into \"synchronous\" communication.\n\nYou come to this mailing list and start talking, and that is how you\nare heard by community members, which you're already doing fine ;-).\n\nIn case you are not familiar with Git, you can see output from\n\n\tgit shortlog --no-merges -s -n --since=2.years | head\n\nto see who have been the active contributors.\n\nThanks.\n\n"},{"id":"459677","messageId":"CADKuG0vVGsC9tFr8bUrC48yhhkyg0Rrafyf39TYhPNXE1ak6mA@mail.gmail.com","threadId":"58206","inReplyTo":"xmqq8romicil.fsf@gitster.g","subject":"Re: Coordinated Security Audit for git. Contacts needed","fromName":"Amir Montazery","fromEmail":"amir@ostif.org","sentAt":"2022-07-21T18:06:41Z","receivedAt":"2022-07-21T18:06:55Z","isPatch":false,"sender":{"key":"amir@ostif.org","avatar":null},"body":"Thank you for the reply and information Junio.\n\nApologies for the mixup. I thank the community members for your time\nand consideration. If anyone is interested in providing some direction\nor help with the source code review, supply chain security, or\ncustomizing a new setup of CodeQL for git, please let me know. I\nunderstand you're all likely very busy so we will keep it as brief as\npossible. I can be reached at amir@ostif.org.\n\nThank you again. Hope everyone's summer is going well!\n\n\nOn Thu, Jul 21, 2022 at 12:47 PM Junio C Hamano wrote:\n>\n> Amir Montazery writes:\n>\n> > We would love to collaborate to establish communication channels with\n> > key maintainers. Would it be possible for one of us to join one of\n>\n> We do not call people \"maintainers\", but \"developers\" and/or\n> \"contributors\".\n>\n> > your community meetings for 5 minutes? Or is there a key person we\n> > should be engaging?\n>\n> There is no \"community meetings\" other than the informal \"stand-up\"\n> irc discussion that is biweekly. The log of the latest is at\n> https://colabti.org/irclogger/irclogger_log/git-devel?date=2022-07-18\n> but generally speaking we are not into \"synchronous\" communication.\n>\n> You come to this mailing list and start talking, and that is how you\n> are heard by community members, which you're already doing fine ;-).\n>\n> In case you are not familiar with Git, you can see output from\n>\n> git shortlog --no-merges -s -n --since=2.years | head\n>\n> to see who have been the active contributors.\n>\n> Thanks.\n>\n\n\n-- \nAmir Montazery\nManaging Director\nOpen Source Technology Improvement Fund\nhttps://ostif.org/\nhttps://calendly.com/ostif\n"},{"id":"459680","messageId":"xmqqmtd2gv5g.fsf@gitster.g","threadId":"58206","inReplyTo":"CADKuG0vVGsC9tFr8bUrC48yhhkyg0Rrafyf39TYhPNXE1ak6mA@mail.gmail.com","subject":"Re: Coordinated Security Audit for git. Contacts needed","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2022-07-21T18:47:39Z","receivedAt":"2022-07-21T18:47:44Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Amir Montazery writes:\n\n>> There is no \"community meetings\" other than the informal \"stand-up\"\n>> irc discussion that is biweekly. The log of the latest is at\n>> https://colabti.org/irclogger/irclogger_log/git-devel?date=2022-07-18\n>> but generally speaking we are not into \"synchronous\" communication.\n\nThe next one is on Aug 1st, it seems, according to https://tinyurl.com/gitCal\n\n The Git Standup is currently happening every two weeks at 18:00 UTC\n in the #git-devel channel on irc.libera.chat and its log can be\n found at https://j.mp/gitdevlog\n\nComing to it may be a good way to \"get to know\" some folks who work\non the project.\n\n> ... If anyone is interested in providing some direction\n> or help with the source code review, supply chain security, or\n> customizing a new setup of CodeQL for git, please let me know.\n\nAll new code (with a small exception) go through the patch review on\nthis list, so reviewing patches posted here and archived at\n\n https://lore.kernel.org/git/\n\nwith special focus on the security aspect (which is the forte of\nyou folks) may be great. A patchwork instance that captures the\ntraffic can be seen at\n\n https://patchwork.kernel.org/project/git/list/\n\nI am not sure what the best place to start in auditing existing\ncodebase, though.\n\nEven though linking with libraries that are unpatched for known\nvulnerabilities and/or are compromised would be a problem for\nend-users, because we as the project only make sourc releases and do\nnot make binary distribution, supply-chain issues may not be as big\nan issue to the project. Our friends at the \"Git for Windows\"\nproject does one for their platform, and may use your help in the\narea, though.\n\nThanks.\n"}]}