Re: weaning distributions off tarballs: extended verification of git tags

From: Colin Walters <walters@verbum.org>
Date: Mar 2, 2015, 17:09 UTC
Message-ID: <1425316197.895196.234425829.536E6C06@webmail.messagingengine.com>
In-Reply-To: <CANv4PNmF9sTh8od9xT5tYTOF1Cv0Mev2Muf-qxQDS_6kE7EnOw@mail.gmail.com>

On Sat, Feb 28, 2015, at 03:34 PM, Morten Welinder wrote:

Show 5 quoted lines

> Is there a point to including a different checksum inside
> a git tag?  If someone can break the SHA-1 checksum
> in the repository then the recorded SHA-256 checksum can
> be changed.  In other words, wouldn't you be just as well
> off handing someone a SHA-1 commit id?

The issue is more about what the checksum covers, as well as its strength. Git uses a hash tree, which means that an attacker only has to find a collision for *one* of the objects, and the signature is still valid. And that collision is valid for *every* commit that contains that object.

This topic has been covered elsewhere pretty extensively, here's a link: https://www.whonix.org/forum/index.php/topic,538.msg4278.html#msg4278

Now I think rough consensus is still that git is "secure" or "secure enough" - but with this proposal I'm just trying to overcome the remaining conservatism. (Also, while those discussions were focusing on corrupting an existing repository, the attack model of MITM also exists, and there you don't have to worry about deltas, particularly if the attacker's goal is to get a downstream to do a build and thus execute their hostile code inside the downstream network).

It's really not that expensive to do once per release, basically free for small repositories, and for a large one like the Linux kernel:

$ cd ~/src/linux $ git describe v3.19-7478-g796e1c5 $ time /bin/sh -c 'git archive --format=tar HEAD|sha256sum' 4a5c5826cea188abd52fa50c663d17ebe1dfe531109fed4ddbd765a856f1966e -

real 0m3.772s user 0m6.132s sys 0m0.279s $

With this proposal, the checksum covers an entire stream of objects for a given commit at once; making it significantly harder to find a collision. At least as good as checksummed tarballs, and arguably better since it's pre-compression.

So to implement this, perhaps something like:

$ git archive --format=raw

as a base primitive, and:

$ git tag --archive-raw-checksum=SHA256 -s -m "..."

"git fsck" could also learn to optionally use this.