git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [RFC] Malicously tampering git metadata?

From
Jeff King <peff@peff.net>
Date
Dec 18, 2015, 04:02 UTC
Message-ID
<20151218040210.GA9585@sigill.intra.peff.net>
In-Reply-To
<20151216032639.GA1901@LykOS>
On Tue, Dec 15, 2015 at 10:26:39PM -0500, Santiago Torres wrote:
Show 5 quoted lines
> An example of a malicious commit merge follows:
> 
> 1) The attacker controlling or acting as the upstream server identifies
> two branches: one in which the unsuspecting developer is working on, and
> another in which a vulnerable piece of code is located.

One thing to make clear here: the side branch with the vulnerable code must be a _new_ vulnerability that was not already part of the "main" branch the developer is working on. That is, I do not immediately see a way to resurrect an old vulnerability, because a merge of the old, broken commit would not result in reintroducing it.

This is more about "there was experimental junk on branch X, and you tricked some developer into pulling X onto Y, and now Y unexpectedly has the junk on it". And I agree with Stefan that push-certs are the intended defense against this.

Of course, in the real world things are much easier. Most projects do not sign commits at all, let alone use push certs. If developers are pulling from a compromised server, then you can simply make up whatever broken commits you want, and there's no way to tell the difference between them and the real commits.

-Peff
Previous: Jeff KingNext: Theodore Ts'o
Message 5 of 14 in “[RFC] Malicously tampering git metadata?”
  1. Santiago TorresDec 16, 2015
  2. Stefan BellerDec 16, 2015
  3. Santiago TorresDec 18, 2015
  4. Jeff KingDec 18, 2015
  5. Jeff KingDec 18, 2015
  6. Theodore Ts'oDec 18, 2015
  7. Santiago TorresDec 19, 2015
  8. Theodore Ts'oDec 20, 2015
  9. Santiago TorresJan 12, 2016
  10. Stefan BellerJan 12, 2016
  11. Santiago TorresJan 14, 2016
  12. Stefan BellerJan 14, 2016
  13. Santiago TorresJan 22, 2016
  14. Stefan BellerJan 22, 2016

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.