Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [git]

A popular distributed revision control system. Built for speed, data integrity and with support for distributed, non-linear workflows.

0
votes
0answers
40 views

Handle secret/private credentials when using Git?

When using Git and 3rd party vendors for repositories (such a GitHub, GitLab or Bitbucket), is there any way to handle the system's private API tokens or the database setup configuration? More than ...
0
votes
0answers
30 views

Store secret for HS256 (JWT) in repository?

For JWT generation in my Java application I need to use the secret. Thus, I need to include this along with other source code into repository, which is a no-no. So how can I store the secret in ...
2
votes
1answer
163 views

Am I actually seeing a Man-in-the-Middle when pushing to GitHub?

When I attempt git push origin, I get the following error: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@...
5
votes
1answer
72 views

What could an attacker do on a server where Source Control Management (SCM) files are accessible?

I'm testing some servers with OpenVAS and I run into some SCM files that are remotely accessible: .git/config .git//info/exclude .git/description .git/HEAD that contains refs/heads/master and .git/...
3
votes
1answer
47 views

Providing access to Git repo behind a Firewall using Certs/Keys for Authentication

We have a Git repo sitting behind a firewall. As I see it, there are two ways of authenticating/accessing the Git repo: Add a Reverse HTTP Proxy in the DMZ that communicates with the Git repo. This ...
0
votes
2answers
51 views

Confused about GitHub's GPG key association and authenticity

I'm not sure I understand GPG, and something on GitHub has left me wondering. In git, a GPG private key can then be used to sign commits, which allows someone who is in possession of the public key ...
0
votes
1answer
75 views

How can a git repository be sanitized efficiently and effectively?

A git repository will contain information on every previous commit and all the information in that commit. That means that if you have a git repository that contained any information such as secret ...
1
vote
0answers
26 views

git credential cache and store

I just noticed we can use git credential in order to cache our username and password so we do not need to do it everytime especially if it's on server as usually for me I would add ssh for local ...
1
vote
0answers
40 views

Secure scanning of git repositories

Is it possible to scan files on a 3rd party gitlab installation before they are downloaded ? In the scenario I'm thinking about colleagues are worried about the potential for malware to be attached ...
1
vote
1answer
79 views

How can I improve the security of my protected branches in GitHub/GitLab?

Many online Git hosting services (such as GitHub and GitLab) allow you to 'protect' certain branches so that only project administrators can modify them. The purpose of this is to allow non-admin ...
1
vote
2answers
57 views

Automatic push on commit (on bitbucket repository)

I have a website which commits to a git local repository all the changes done. I need to automatically push them directly from the web server to a remote Bitbucket repository. The authentication ...
2
votes
0answers
102 views

PCI Compliance and Git

We are currently moving to get a ci\cd pipeline running on Gitlab. Our current set up is we have a non-production and a production environment on separate networks. This reduces the PCI scope to just ...
1
vote
2answers
133 views

Does git use the ssh user keys or the repository's deploy keys for encryption?

In this question I asked, why the SSH-Host key shown when connecting to a gitlab repository does not match the one shown on the instance configuration page. Nevertheless, the accepted answer says that ...
7
votes
2answers
2k views

Is it safe to store APK signing passwords in private git repository?

I develop android game using cocos2d-x. For android release, it contain this fields in proj.android/gradle.properties: # uncomment it and fill in sign information for release mode #RELEASE_STORE_FILE=...
0
votes
3answers
217 views

Does Git usage raise a valid security concern? If so, how? [closed]

This is about pure-and-simple Git; NOT the security concerns of using third party services like Github or Gitlab. While working on a closed source security project, during a meeting, one of the ...
6
votes
3answers
712 views

Safe to commit OpenVPN client config to Git?

I'd like to commit my OpenVPN client config to version control, in a repo that's remotely hosted and publicly accessible. This would reveal the server's hostname and port, as well as the filepaths to ...
1
vote
0answers
62 views

What are the security implications of publishing my web server & PHP config files?

I have a web server with many virtual hosts, config files, etc. I'd like to track all of my web server & PHP config files using Git and have them hosted on a public GitHub repository, as this ...
0
votes
3answers
314 views

Why does Github need to offer a GPG signature feature?

Github offers users to sign their work using GPG. I guess I missing the bigger picture, though how can people have your SSH keys or your credentials and not your GPG keys. Not sure what kind of layer ...
3
votes
1answer
109 views

What information in sent in the clear when git redirects from HTTP to HTTPS?

If a user tries git commands pointed at an http://gitlab.example.com address (and they have not connected to this domain before), the gitlab.example.com server redirects (or rewrites) to https://...
1
vote
1answer
101 views

Making an API repository private vs public

So I am currently working on the API of an application that will be serving many users. Currently the only "sensitive" information being stored using the API is user emails and names. The application ...
4
votes
1answer
75 views

Restrict compilation to certain machines

I am a software developer in a big company. I just realised that I could technically clone the repository of my employers git repository. The infrastructure is in docker images. So technically this ...
1
vote
2answers
1k views

Deleted commit still visible from GitLab web interface, exposing sensitive data [closed]

Some weeks ago I accidentally committed a configuration file containing some passwords and I pushed it on a GitLab remote managed by my company. After that I used BFG Repo-Cleaner to remove the ...
1
vote
0answers
165 views

Is standalone git susceptible to MITM?

Is standalone Git protocol susceptible to MITM where an attacker impersonates the server? According to https://git-scm.com/book/en/v2/Git-on-the-Server-The-Protocols There are 3 main protocols to ...
0
votes
2answers
376 views

Blindly downloading a git repo: specifically, generating .pack files

I'm pen-testing an application with a bug bounty program. I've found a .git folder which just gives a 403 forbidden error. However, when browsing to directories such as dodgy.com/.git/config, the ...
1
vote
1answer
468 views

Is it acceptable to share private SSH keys across servers for read-only access to a Git repository?

I'm working on a project currently stored in a private Git repository on Bitbucket, that will be deployed to multiple external servers. Because the repo is private, I need these servers to be able to ...
3
votes
3answers
222 views

In what ways is Git a security measure?

When the boss asks why Git is good, can I justify using security as one of the reasons? Under Git, it's easy to track changes. Maliciously altered files can be revealed with a simple 'git diff' on ...
2
votes
1answer
191 views

Reporting leaked passwords in github repository

I have just found a handful of repositories on github that contain database passwords. I want to let the concerned parties know about this so that they can change their passwords and remove the ...
8
votes
1answer
482 views

Is it safe to share your `gitconfig`'s `user.signingkey` value with the world?

I'd like to publish my .gitconfig file on GitHub, which includes a signing key. As far as I understand, since this is related to code signing, the key referenced there is the ID of my private GPG key....
5
votes
0answers
126 views

How could Git be exploited using an SHA-1 collision? [duplicate]

Now that Google has created an SHA-1 collision, I've been wondering how this affects Git, which is still using SHA-1 for some reason. What would happen if there were two objects with the same hash, ...
1
vote
1answer
213 views

Is making e-mail addresses visible and impersonation possible by GitHub an acceptable practice? [closed]

I am under impression that protecting privacy of user is a "big deal" - even if only declaratively. Example: discussion on meta about e-mail addresses on SO. Whilst I do expect that sooner or later ...
1
vote
1answer
1k views

How Secure is my Heroku Source Code?

I'm using Heroku to host a small number of services. I want to better understand the access permissions on the files that I'm putting onto my Heroku instances. First off, I am aware that I am handing ...
3
votes
0answers
525 views

Why does Linux Torvalds not sign his Git commits? [closed]

Why does Linux Torvalds not sign his Git commits (with GPG)? Recent example: https://github.com/torvalds/linux/commit/566cf877a1fcb6d6dc0126b076aad062054c2637 Pretty scary. How can I be sure that he ...
1
vote
1answer
120 views

Store github credentials

I am new to the security section. I want to write a cross-platform Java Desktop application which ask a user for their credentials and connects to their github account.What I want to do is If the ...
0
votes
2answers
720 views

Should I host portfolio website in public GitHub repository? [closed]

I have a small portfolio site that I work on in my spare time as a way of demonstrating and applying what I have learned from school/work. Part of this demonstration involves me currently listing the ...
2
votes
2answers
681 views

Can a ransomware “destroy” git remote repositories?

Instead of a backup, i store my important documents (my resumee, certificates and such) in a git repository - which is then pushed to sth like github. My reasons for using git instead of an backup ...
0
votes
2answers
93 views

Publishing proxy server IP address on github

Is it safe to store proxy IP address and port in a shell config file on github? I see some people doing that and don't worry about it.
1
vote
0answers
34 views

Would it be possible to construct a generic security advisory mechanism for git repositories?

It seems to have become easier, and thus more common for software to be deployed by simply checking it out of a git repository, rather than going via release versions. This makes it difficult to know ...
2
votes
1answer
4k views

Read all git cached password

in a 10+ people team we access the same ubuntu VM and we 'su' to the same user. On that user we make use of git-credential-cache feature to not type our personal password again and again. As all ...
13
votes
1answer
3k views

Can I use GitHub and be PCI DSS compliant?

Is it possible to use any remote DVCS (GitHub, Bitbucket, etc.) with PCI DSS or should I host Git on my own server?
2
votes
2answers
56 views

Is secure to enable tools like git on shared server?

I want to know if there is a real security reason to not enable tools like git, WP-CLI or npm. I want to run a server (Centos/CPanel), but I want to be sure that enabling them would not be a risk. ...
3
votes
1answer
281 views

What personally identifying data does does command line Git send?

What identifying data (such as hostname) does command line Git send when: cloning commiting/pushing I expect git config data (specified email and full name) to be sent when commiting/pushing. Does ...
1
vote
0answers
562 views

Storing password or access token in standalone Java app

I have a simple Java app that use Eclipse JGit to pull remote repositories into the app to analyze and provide the user with code metric details on their projects. This app is supposed to be able to ...
2
votes
0answers
180 views

Git Server with several repos

I'm not sure if I'm allowed to post and have one of my newly asked question on both security.stackexchange and unix.stackexchange or not, but I think it is appropriate to ask the question here too ...
1
vote
1answer
251 views

Why should I sign git commits/tags? Should I sign both commits and tags?

Easy question, but no one has asked it here as far as I see: Why should I sign git commits? To give some more things to answer there is also this question: Why should I sign git tags (releases)? And ...
1
vote
1answer
849 views

What's wrong with RSA host key mismatch when using git?

I was pushing codes to github from a repo via a proxy (socks5) proxychains git push -uv origin master Warning: the RSA host key for 'github.com' differs from the key for the IP address '224.0.0.1' ...
4
votes
3answers
218 views

What can be done to secure passwords that might be stored in plain text or hashed inside a git repository?

I've heard a lot lately about coders being really bad at security. For one they store passwords and sensitive information inside Git repos which are often not secured well enough. Someone then comes ...
10
votes
1answer
753 views

Should I recreate Git tags after revoking a signing key?

Let's say my signing key has been compromised and I have to revoke it. What happens to the changesets and tags already signed? Should I rewrite them with the new signing key?
9
votes
1answer
5k views

Should I worry about GitHub using IP addresses that are described as having an unknown host?

Today, I got a message while doing a git push, saying Warning: Permanently added the RSA host key for IP address '192.30.253.112' to the list of known hosts. It seems as if it's consistent with ...
3
votes
1answer
1k views

How do I know which subkey GitHub is using for signing?

I added my gpg subkey to GitHub today and noticed that regardless of which subkey I export, the PUBLIC KEY BLOCK is the same. I have since found this post, that explains why: is-it-possible-to-export-...
5
votes
5answers
206 views

Is there a safe way use a private key from a shared server?

I am working remotely on a school server via SSH from home. I would like to access a private GitHub repository from the remote system with SSH. If I create a new public/private key pair on the remote ...