7
Any signed GitHub commit can be copied, without the author's secret key, creating a distinct commit with an identical tree, metadata, a valid signature, and a "Verified" badge (www.internationalcyberdigest.com)
submitted 4 months ago by to c/security@lemmy.ml
8 comments fedilink hide all child comments
 

PoC: https://github.com/JakeGinesin/git-chain-malleator

you are viewing a single comment's thread
view the rest of the comments
[–] [S] 1 point 4 months ago (4 children)

Right, it's not a serious exploit which would allow changing code, but it does allow compromising integrity because changing the id mutates history.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 4 months ago (3 children)

    It doesn't mutate history. It just creates a new branch of history in their own fork. Just like any new commit would do.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] [S] 0 points 4 months ago (2 children)

    but looking back you have no way to tell which branch is the real one

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 4 months ago (1 child)

    Please explain what you mean and how this could be abused. What does "real" mean in this context? They both have the same code. It would probably help if you can provide a specific attack that could actually cause harm rather than just stating facts that have unclear risk.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] [S] 0 points 4 months ago

    My understanding is that you'd end up with two divergent histories and you can't tell which one is the original. I don't know how it could be abused off top of my head, but generally speaking people tend to find ways to abuse these kinds of things.

  • permalink
  • fedilink
  • source
  • parent