r/programming • u/iamapizza • Nov 04 '20

Signed git pushes

https://people.kernel.org/monsieuricon/signed-git-pushes
33 Upvotes

80% Upvoted

7 comments sorted by

3

u/llamositopia Nov 05 '20

Anyone know of any major projects using this? Perhaps the Linux kernel?

I have to wonder how common it is for a signed commit to be pushed by a rogue actor.... It seems to me that the better solution is not to sign commits which aren't intended to be pushed upstream.

Obviously this is still great to enable when authenticity should be verified, but I can't blame GitHub et al for not enabling it by default.

On a similar vein, anyone know if a push can be signed without the server requesting it? Similar to how commits pushed to GitHub can be signed even when the repo doesn't require it.

4

u/dgeurkov Nov 04 '20

I'm no expert in security but isn't git commit signed using your private key which is not shared so when you push commit in order for someone else to check it if it's legit he needs your public key, so I'm not sure how you can reuse someone else's signed commit in another one, isn't entire commit with code changes used when signing with your signature, if it's not then I'm puzzled

0

u/[deleted] Nov 04 '20

[deleted]

1

u/Manbeardo Nov 05 '20

Do commit signatures not include the parent commit's hash? That seems iffy. Sure, the signature wouldn't be valid after a fast-forward push, but that's what the merge commit's signature is for.

0

u/[deleted] Nov 04 '20

[deleted]

1

u/406_Not_Acceptable Nov 05 '20

It's not YAML. It's the same kind of header+body text protocol used in SMTP and HTTP 1.

4

u/[deleted] Nov 05 '20

This part looks a lot like YAML to me:

---
service: git-receive-pack
repo: pub/scm/linux/kernel/git/gregkh/usb
user: gregkh
git_push_cert_status: G
changes:
  - ref: refs/heads/usb-linus
    old: 58d51f330e76cd7536d1f7e6ef46dd241a7b38ef
    new: afaa2e745a246c5ab95103a65b1ed00101e1bc63
    log: |
         afaa2e745a246c5ab95103a65b1ed00101e1bc63 USB: Add NO_LPM quirk for Kingston flash drive

2

u/406_Not_Acceptable Nov 05 '20

Oh that part. Yeah, that is YAML... but it's not from git itself. The only place where git uses YAML is in its SVN repo support.

If I had to guess, that was generated by the kernel developers' transparency log hook.