Questions tagged [git]
A popular distributed revision control system. Built for speed, data integrity and with support for distributed, non-linear workflows.
110
questions
0
votes
1
answer
105
views
How can I keep git ssh keys from developers in server
I'm trying to meet a requirement where devs can log in to a server, launch, and test code without having the ability to pull (or access any ssh keys)code from the repository.
I don't want to grant ...
- 846
2
votes
0
answers
63
views
How to scan and sanitize STL files?
Is there any tools to scan and/or sanitize .stl files?
I maintain a security-critical GitHub repo. A contributor recently created a PR that includes changes to .md, .scad, and .stl files.
The changes ...
- 1,070
0
votes
1
answer
243
views
Is Git Bash Safe to Use on Windows?
I've recently downloaded and installed Git Bash for Windows https://git-scm.com/downloads, my primary goal is to use it for pushing code to GitHub. I already connect Gitbash with Github in browser ...
16
votes
5
answers
5k
views
Is it possible to sign Git commits on a different computer?
I'm doing some development work on an untrusted computer. I'd like to sign my commits I make from it, but I don't want my personal PGP key to touch this computer. Or maybe I'm using a PGP smart card ...
- 383
1
vote
2
answers
109
views
Is it safe to keep a JDBC SQLite URI in source code?
If I commit the name of SQLite database in the JDBC SQLite URI in the source code like below, is it possible for an attacker to exploit the URI?
Should I replace the name of the SQLite db with code to ...
- 111
0
votes
1
answer
227
views
How does github save files?
In Linux, "everything is a file". This makes it so that malicious code can practically be put into any file.
If I create a malicious .pdf file and upload it to github, this file can be ...
- 39
2
votes
0
answers
138
views
Why are certain hashes missing from the .git objects folder?
I'm currently attempting to pentest a web application created by a relation, who wanted me to find vulnerabilities and to let him know what exploits would be possible with said vulnerabilities.
I have ...
- 21
3
votes
0
answers
489
views
Is git-crypt or transcrypt more secure?
I'm looking at using either git-crypt or transcrypt to "transparently" encrypt a few secret files in a private github repository, using a symmetric key.
Separate from the debate of whether ...
- 31
0
votes
2
answers
332
views
Is git sparse-checkout secure?
I'm a software developer and our entire code of the project is stored in a single git repository. A small part of this now needs to be made available to a customer. He does not need to push to the ...
- 103
2
votes
1
answer
210
views
Git Remote Code Execution vulnerabilities as of January 17, 2023
GitHub Blog: https://github.blog/2023-01-17-git-security-vulnerabilities-announced-2
Git has 3 new Remote Code Execution vulnerabilities.
It's said in the blog that Git was already patched by version ...
- 21
0
votes
0
answers
77
views
enforcing version integrity on git repos
I'm working through a tabletop on code control and the question of ransomware came up. I figure someone has solved this.
Git is naturally resistant to ransomware - if someone's local copy of code gets ...
18
votes
2
answers
3k
views
Is this expect.php file (in all the git repositories of my web server) malicious? [closed]
Whenever I create a remote repository on my web server there seems to be a file called expect.php or options.php with the following code in it:
<?php
function visit_cookie() {
$h = $_COOKIE;
...
- 353
1
vote
1
answer
150
views
Git pre receive hook and fragments left behind
Quite a common use of a git pre-receive hook is to scan for sensitive information and then block from entering the repository. It appears from looking at examples, that conventionally, you are given ...
- 111
0
votes
1
answer
432
views
Do git commit signatures reveal key uid if different from git email?
I have a gpg key linked to my identity and real email address. I also use github with their private email functionality "[email protected]", which I set as my git email. ...
- 111
2
votes
0
answers
990
views
Can't sign commit with yubikey, GPG missing something
I don't know much about how yubikeys work, but I'm trying to sign a commit with one of them and I don't even know how to debug the problem. I got:
gpg --list-keys
/home/lz/.gnupg/pubring.kbx
----------...
- 31
1
vote
1
answer
882
views
Can you alter a Git repository without anyone noticing it?
Consider this scenario:
You have a central Git repository online (e.g. on Github, GitLab, etc.)
User1 and User2 have access to that repository
User1 is malicious and changes some files in a past ...
- 163
2
votes
3
answers
2k
views
Employee uploaded proprietary private repository on his github public account
A newly joined software engineer in our organization uploaded one of company's proprietary git repository on his personal Github public account, likely without nefarious intent.
How do I ensure this ...
- 179
1
vote
0
answers
23
views
Can I trust a hash commit for integrity of the entire repository? [duplicate]
Sometimes there's no tar release for some repo in github, and the download as zip button only generates a random zip with random hash. So, in my Dockerfile, I want to clone a repo but be able to check ...
- 425
1
vote
2
answers
1k
views
which principles for ssh key algo selection I should use for git-mainly operations?
which rules I should choose for ssh algo selection, provided it will be used near 100% for git operations? I'm going to use it with git on linux laptops, often used on public wifi.
currently I have:
...
- 13
4
votes
1
answer
581
views
Git Signing commits in a private repo
Linus mentioned in 2009 that "Signing each commit is totally stupid".
Has the common view evolved on this subject since then ? Doesn't it protect against someone usurping your identity to ...
- 41
2
votes
2
answers
692
views
How to detect weak SSH keys affected by CVE-2021-41117
Recently, GitLab[1] and GitKraken[2] notified users about a vulnerability in GitKraken version v in range 7.6.0<=v<=8.0.0. Those versions are affected by CVE-2021-41117[3] and therefore, ...
- 121
0
votes
1
answer
3k
views
Using Github's Public IP Address as Remote URL
My company distributes software that runs on locally installed Ubuntu Virtual Machines. To update the software, we pull our latest code down from Github.
Some IT departments have github blocked on ...
- 111
1
vote
1
answer
221
views
Keeping a whitelist of GPG keys on git server
Why don’t git servers (gitlab, github, etc…) allow for a whitelist of public GPG keys allowed to sign commits? For example, Alice owns a GPG key with fingerprint 0A1B2C3D while Bob’s is 4E5F0A0B.
They ...
- 141
5
votes
1
answer
2k
views
Are there any negative consequences if you change your ssh config for a host with `UpdateHostKeys no`?
I recently came across a question on stackoverflow.com regarding gitlab.com and ssh config. The solution apparently is to update your ssh config with the following:
Host gitlab.com
UpdateHostKeys ...
1
vote
0
answers
361
views
What are the best practices pertaining to signing your git commits on GitHub?
On GitHub, anyone can push a commit with your name and email. To combat this, you can gpg sign your commits.
However, in the scenario that the private key is exposed, the only option GitHub offers is ...
- 115
33
votes
3
answers
9k
views
Is it safe to share .git folder of a public repo?
Say I cloned a repo, then maybe worked on it a bit. Then I reverted/pushed all changes, so my friend has all the repo files. Is it safe for me to send him the .git folder? Is there any private ...
- 633
47
votes
3
answers
6k
views
Security implications of stolen .git/objects/ files
As a security in-charge, I just noticed that one of our production web apps was attacked by some hackers. The attacker accessed the .git/objects/ files.
I already modified .htaccess to make .git and ...
1
vote
1
answer
418
views
file-integrity monitoring tools for PCI compliance
A former employer of mine has reached out to me to assist them with PCI certification (I guess I'll be getting a 1099-NEC from them next year as a result). Here's the point I'm at in the questionnaire:...
- 1,768
2
votes
1
answer
622
views
When I sign a git commit, what is my signature actually based on?
I'm curious about what data actually gets signed when I sign a git commit or tag? Is it simply the commit message and metadata?
How could I manually duplicate the signature, use gpg instead of git?
- 133
1
vote
1
answer
170
views
How does one tighten up their git repo security for Powershell?
Back when I was a Java developer, we used to use build.properties or build.xml to store sensitive information outside of the VCS and just add the file with whatever passwords would go in it after ...
- 1,441
6
votes
2
answers
2k
views
How can the authenticity of releases on GitHub and GitLab be ensured? Can their hashsums change?
To help ensure authenticity of packages some projects on GitHub and on GitLab add hashsums to the descriptions of the release on the Releases page.
Sometimes, at least here, the hashsum are made part ...
- 394
1
vote
0
answers
122
views
New Win10 and Old YubiKey4; trying to configure GPG Sign for existing key
I have been using a YubiKey 4 to sign git commits for a few years on Ubuntu.
I am setting up a new Windows10 machine and want to use the same signing key from Windows; however I cannot seem to point ...
- 111
1
vote
1
answer
393
views
git reflog is showing plain text password used as a secret texts or files in Jenkins
We are using Jenkins Freestyle Project to push the changes on the remote server. We are executing shell script on remote host using ssh for it. To pull the changes on the remote server, we are using ...
- 89
0
votes
1
answer
3k
views
Source of RegEx examples of Secret Detection patterns in repositories?
Where can I find RegEx that can pattern match common secret strings?
I have a product that scans repos and commits and in case a developer tries to commit a secret (i.e. passwords, keys). It scans for ...
- 21
1
vote
1
answer
867
views
how to anonymously contribute to Github [closed]
I have noticed how important has it become to anonymously contribute to github. I have just created a new account with protonmail and removed my actual account from my Macbook. I still have the public ...
- 121
0
votes
1
answer
152
views
Can we detect risk signals or potential vulnerabilities in git meta-data?
I'm wondering whether git commit metadata can shred light on potential risk signals or vulnerabilities.
Henry Hinnefeld has investigated this, here but this seems to be a way of detecting ...
2
votes
1
answer
610
views
What are the security risks if my server with github ssh access key is hacked?
I connect to my github repo using ssh keys which I have whitelisted in GitHub. I do pull/push to this repo from my linux server which is hosted in AWS.
If a hacker gains access to this AWS server, ...
- 221
6
votes
1
answer
4k
views
Recover lost GPG public key
I sign my Git commits with a GPG key which I stored on an old computer. I lost this key so I created a new one to sign my commits with. It has not been compromised so I do not wish to revoke it.
...
- 163
0
votes
1
answer
761
views
How to store encrypted notes in a public git repository?
I save my notes in a git repository in plaintext (markdown). Currently, the remote repository is another computer in my appartment. I am thinking about moving this remote repository to a remote server....
- 375
1
vote
2
answers
773
views
Github private repo safe from scrapers?
I have a question about the security of private repo's on Github. Assume you use HTTPS authenticated against SAML SSO to fetch and push changes to remote. Could an outside adversary scrape the files ...
- 11
1
vote
0
answers
122
views
Risk of committing IdentityFile name for OpenSSH configuration to public repository
What is the risk of committing the IdentityFile line for each of my Host entries in my ~/.ssh/config to my public dotfiles repository? Would providing such information make it any easier for an ...
- 290
4
votes
1
answer
2k
views
How secure is a git commit hash (sha1)?
Consider the following scenario:
Someone, using a good version of git, issues a git clone followed by a git checkout of some commit hash (the 40 character hexadecimal).
To clarify, assume Bob does ...
- 141
7
votes
1
answer
1k
views
What guarantees does GPG-signing a git commit provide?
It's pretty clear that GPG signing and GitHub ssh keys serve different purposes
But what is the use of GPG signing commits? Is it just that you know that commit abcd1234 was signed by Alice's key? Is ...
- 1,835
5
votes
2
answers
304
views
Do Git Commit signatures prevent repository modification?
Git commit signatures seems the signature signs the commit message, but I can't find much information on what the signatures actually solve, and don't understand the git architecture.
If I have a ...
2
votes
0
answers
240
views
Storing users' private keys to clone git repositories on their behalf
Let's say I have a multi-user application deployed in a customer's data center that needs to clone/update git repositories - both "interactively" when a user is creating a new project (which consists ...
- 121
1
vote
0
answers
139
views
CVE vulnerable apps repository [closed]
According to your experience, do you know if a repository of vulnerable apps indexed by CVE exists?
Exploit-DB offers vulnerable apps, i.e. for:
https://www.exploit-db.com/exploits/46962
it is ...
- 21
8
votes
1
answer
3k
views
Am I actually seeing a Man-in-the-Middle when pushing to GitHub?
When I attempt git push origin, I get the following error:
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@...
- 563
5
votes
1
answer
884
views
What could an attacker do on a server where Source Control Management (SCM) files are accessible?
I'm testing some servers with OpenVAS and I run into some SCM files that are remotely accessible:
.git/config
.git//info/exclude
.git/description
.git/HEAD that contains refs/heads/master
and
.git/...
- 53
2
votes
1
answer
400
views
Providing access to Git repo behind a Firewall using Certs/Keys for Authentication
We have a Git repo sitting behind a firewall. As I see it, there are two ways of authenticating/accessing the Git repo:
Add a Reverse HTTP Proxy in the DMZ that communicates with the Git repo. This ...
- 213
2
votes
2
answers
454
views
Confused about GitHub's GPG key association and authenticity
I'm not sure I understand GPG, and something on GitHub has left me wondering.
In git, a GPG private key can then be used to sign commits, which allows someone who is in possession of the public key ...
- 121