Here’s how two hypothetical attacks on the software supply chain could look like, with unsigned commits. Attacks on the software supply chain are getting more common, and their potential consequences more dangerous. things related to security, or mission-critical applications), the more you should pay attention.
#GITHUB VERIFY EMAIL CODE#
The more sensitive the code you’re working on (e.g. It also gives you the ability to ensure that no one can modify your commit (or its metadata, such as the time you claimed that was made at) in the future. Making a habit of signing your Git commits, instead, gives you the ability to prove that you were the author of a specific code change.
For example, just by setting my user.name to Martin’s, I do not get the ability to push code to his repositories: GitHub would require me to authenticate with his credentials before I could do that. Being able to impersonate other committers does not introduce a vulnerability per se. The committer details are designed just to identify who of your collaborators made a change, and are not meant to be used for authenticating people. Those are not hard to get at all: it only took me one minute to clone one of his repos then run git log in it.įrom the point of view of Git, this is actually working as intended. To make GitHub (and everyone) believe that Martin authored that really terrible commit, I just had to run git config user.name and git config user.email with values that match Martin’s. There’s only one problem: Martin did not do that I did. As you can see, my esteemed colleague and friend from GitHub committed in it right away: This means you could claim to be whoever you want when you create a commit.įor example, here’s a repo I just created. When you commit a change with Git, it accepts as author whatever value you want. Besides the desire to get that green, “Verified” badge on your work on GitHub, there are some concrete benefits. Why to sign Git commitsīefore we get into the how, let’s talk for a moment about why you should sign your Git commits. Just as it sounds, signed commits are …well, signed, cryptographically using a GPG key. Making a commit “verified”, or to be more precise, signed, is not as hard as you might think. Let’s leave everything else aside from a moment… isn’t it oddly satisfying to have a large, green “Verified” badge on your work? 😎 ( if you don’t know about signed Git commits, you might have seen this on GitHub:
0 kommentar(er)
