Questions tagged [git]

A popular distributed revision control system. Built for speed, data integrity and with support for distributed, non-linear workflows.

Filter by
Sorted by
Tagged with
1 vote
1 answer
138 views

Can you alter a Git repository without anyone noticing it?

Consider this scenario: You have a central Git repository online (e.g. on Github, GitLab, etc.) User1 and User2 have access to that repository User1 is malicious and changes some files in a past ...
user avatar
0 votes
3 answers
149 views

Employee uploaded proprietary private repository on his github public account

A newly joined software engineer in our organization uploaded one of company's proprietary git repository on his personal Github public account, likely without nefarious intent. How do I ensure this ...
user avatar
  • 149
1 vote
0 answers
20 views

Can I trust a hash commit for integrity of the entire repository? [duplicate]

Sometimes there's no tar release for some repo in github, and the download as zip button only generates a random zip with random hash. So, in my Dockerfile, I want to clone a repo but be able to check ...
user avatar
0 votes
2 answers
34 views

which principles for ssh key algo selection I should use for git-mainly operations?

which rules I should choose for ssh algo selection, provided it will be used near 100% for git operations? I'm going to use it with git on linux laptops, often used on public wifi. currently I have: ...
user avatar
0 votes
0 answers
63 views

Risks / best practices in putting your `~`/user home under git to track configuration files only in that directory, not subdirectories?

I just had a warning from Vivaldi 5 that Vivaldi's profile might have been under a git repo, which could be a security risk exposing passwords and the like and that they had added a .gitignore to ...
user avatar
2 votes
1 answer
132 views

Git Signing commits in a private repo

Linus mentioned in 2009 that "Signing each commit is totally stupid". Has the common view evolved on this subject since then ? Doesn't it protect against someone usurping your identity to ...
user avatar
  • 21
1 vote
2 answers
232 views

How to detect weak SSH keys affected by CVE-2021-41117

Recently, GitLab[1] and GitKraken[2] notified users about a vulnerability in GitKraken version v in range 7.6.0<=v<=8.0.0. Those versions are affected by CVE-2021-41117[3] and therefore, ...
user avatar
  • 111
0 votes
1 answer
805 views

Using Github's Public IP Address as Remote URL

My company distributes software that runs on locally installed Ubuntu Virtual Machines. To update the software, we pull our latest code down from Github. Some IT departments have github blocked on ...
user avatar
0 votes
1 answer
103 views

Keeping a whitelist of GPG keys on git server

Why don’t git servers (gitlab, github, etc…) allow for a whitelist of public GPG keys allowed to sign commits? For example, Alice owns a GPG key with fingerprint 0A1B2C3D while Bob’s is 4E5F0A0B. They ...
user avatar
  • 121
2 votes
1 answer
690 views

Are there any negative consequences if you change your ssh config for a host with `UpdateHostKeys no`?

I recently came across a question on stackoverflow.com regarding gitlab.com and ssh config. The solution apparently is to update your ssh config with the following: Host gitlab.com UpdateHostKeys ...
user avatar
1 vote
0 answers
148 views

What are the best practices pertaining to signing your git commits on GitHub?

On GitHub, anyone can push a commit with your name and email. To combat this, you can gpg sign your commits. However, in the scenario that the private key is exposed, the only option GitHub offers is ...
user avatar
  • 115
32 votes
3 answers
6k views

Is it safe to share .git folder of a public repo?

Say I cloned a repo, then maybe worked on it a bit. Then I reverted/pushed all changes, so my friend has all the repo files. Is it safe for me to send him the .git folder? Is there any private ...
user avatar
  • 583
47 votes
3 answers
6k views

Security implications of stolen .git/objects/ files

As a security in-charge, I just noticed that one of our production web apps was attacked by some hackers. The attacker accessed the .git/objects/ files. I already modified .htaccess to make .git and ...
user avatar
1 vote
1 answer
186 views

file-integrity monitoring tools for PCI compliance

A former employer of mine has reached out to me to assist them with PCI certification (I guess I'll be getting a 1099-NEC from them next year as a result). Here's the point I'm at in the questionnaire:...
user avatar
  • 1,597
2 votes
1 answer
357 views

When I sign a git commit, what is my signature actually based on?

I'm curious about what data actually gets signed when I sign a git commit or tag? Is it simply the commit message and metadata? How could I manually duplicate the signature, use gpg instead of git?
user avatar
1 vote
1 answer
122 views

How does one tighten up their git repo security for Powershell?

Back when I was a Java developer, we used to use build.properties or build.xml to store sensitive information outside of the VCS and just add the file with whatever passwords would go in it after ...
user avatar
  • 1,237
1 vote
2 answers
388 views

How can the authenticity of releases on GitHub and GitLab be ensured? Can their hashsums change?

To help ensure authenticity of packages some projects on GitHub and on GitLab add hashsums to the descriptions of the release on the Releases page. Sometimes, at least here, the hashsum are made part ...
user avatar
1 vote
0 answers
79 views

New Win10 and Old YubiKey4; trying to configure GPG Sign for existing key

I have been using a YubiKey 4 to sign git commits for a few years on Ubuntu. I am setting up a new Windows10 machine and want to use the same signing key from Windows; however I cannot seem to point ...
user avatar
0 votes
1 answer
250 views

git reflog is showing plain text password used as a secret texts or files in Jenkins

We are using Jenkins Freestyle Project to push the changes on the remote server. We are executing shell script on remote host using ssh for it. To pull the changes on the remote server, we are using ...
user avatar
  • 79
-2 votes
1 answer
1k views

Source of RegEx examples of Secret Detection patterns in repositories?

Where can I find RegEx that can pattern match common secret strings? I have a product that scans repos and commits and in case a developer tries to commit a secret (i.e. passwords, keys). It scans for ...
user avatar
1 vote
1 answer
433 views

how to anonymously contribute to Github [closed]

I have noticed how important has it become to anonymously contribute to github. I have just created a new account with protonmail and removed my actual account from my Macbook. I still have the public ...
user avatar
0 votes
1 answer
108 views

Can we detect risk signals or potential vulnerabilities in git meta-data?

I'm wondering whether git commit metadata can shred light on potential risk signals or vulnerabilities. Henry Hinnefeld has investigated this, here but this seems to be a way of detecting ...
user avatar
1 vote
1 answer
339 views

What are the security risks if my server with github ssh access key is hacked?

I connect to my github repo using ssh keys which I have whitelisted in GitHub. I do pull/push to this repo from my linux server which is hosted in AWS. If a hacker gains access to this AWS server, ...
user avatar
  • 211
6 votes
1 answer
2k views

Recover lost GPG public key

I sign my Git commits with a GPG key which I stored on an old computer. I lost this key so I created a new one to sign my commits with. It has not been compromised so I do not wish to revoke it. ...
user avatar
  • 163
0 votes
1 answer
422 views

How to store encrypted notes in a public git repository?

I save my notes in a git repository in plaintext (markdown). Currently, the remote repository is another computer in my appartment. I am thinking about moving this remote repository to a remote server....
user avatar
  • 385
0 votes
1 answer
360 views

Github private repo safe from scrapers?

I have a question about the security of private repo's on Github. Assume you use HTTPS authenticated against SAML SSO to fetch and push changes to remote. Could an outside adversary scrape the files ...
user avatar
1 vote
0 answers
90 views

Risk of committing IdentityFile name for OpenSSH configuration to public repository

What is the risk of committing the IdentityFile line for each of my Host entries in my ~/.ssh/config to my public dotfiles repository? Would providing such information make it any easier for an ...
user avatar
  • 290
3 votes
1 answer
623 views

How secure is a git commit hash (sha1)?

Consider the following scenario: Someone, using a good version of git, issues a git clone followed by a git checkout of some commit hash (the 40 character hexadecimal). To clarify, assume Bob does ...
user avatar
7 votes
1 answer
531 views

What guarantees does GPG-signing a git commit provide?

It's pretty clear that GPG signing and GitHub ssh keys serve different purposes But what is the use of GPG signing commits? Is it just that you know that commit abcd1234 was signed by Alice's key? Is ...
user avatar
  • 1,755
4 votes
1 answer
222 views

Do Git Commit signatures prevent repository modification?

Git commit signatures seems the signature signs the commit message, but I can't find much information on what the signatures actually solve, and don't understand the git architecture. If I have a ...
user avatar
2 votes
0 answers
170 views

Storing users' private keys to clone git repositories on their behalf

Let's say I have a multi-user application deployed in a customer's data center that needs to clone/update git repositories - both "interactively" when a user is creating a new project (which consists ...
user avatar
1 vote
0 answers
108 views

CVE vulnerable apps repository [closed]

According to your experience, do you know if a repository of vulnerable apps indexed by CVE exists? Exploit-DB offers vulnerable apps, i.e. for: https://www.exploit-db.com/exploits/46962 it is ...
user avatar
  • 21
4 votes
1 answer
1k views

Am I actually seeing a Man-in-the-Middle when pushing to GitHub?

When I attempt git push origin, I get the following error: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@...
user avatar
5 votes
1 answer
421 views

What could an attacker do on a server where Source Control Management (SCM) files are accessible?

I'm testing some servers with OpenVAS and I run into some SCM files that are remotely accessible: .git/config .git//info/exclude .git/description .git/HEAD that contains refs/heads/master and .git/...
user avatar
3 votes
1 answer
204 views

Providing access to Git repo behind a Firewall using Certs/Keys for Authentication

We have a Git repo sitting behind a firewall. As I see it, there are two ways of authenticating/accessing the Git repo: Add a Reverse HTTP Proxy in the DMZ that communicates with the Git repo. This ...
user avatar
  • 213
2 votes
2 answers
276 views

Confused about GitHub's GPG key association and authenticity

I'm not sure I understand GPG, and something on GitHub has left me wondering. In git, a GPG private key can then be used to sign commits, which allows someone who is in possession of the public key ...
user avatar
  • 121
1 vote
1 answer
528 views

How can a git repository be sanitized efficiently and effectively?

A git repository will contain information on every previous commit and all the information in that commit. That means that if you have a git repository that contained any information such as secret ...
user avatar
1 vote
0 answers
103 views

git credential cache and store

I just noticed we can use git credential in order to cache our username and password so we do not need to do it everytime especially if it's on server as usually for me I would add ssh for local ...
user avatar
  • 111
1 vote
0 answers
111 views

Secure scanning of git repositories

Is it possible to scan files on a 3rd party gitlab installation before they are downloaded ? In the scenario I'm thinking about colleagues are worried about the potential for malware to be attached ...
user avatar
1 vote
1 answer
140 views

How can I improve the security of my protected branches in GitHub/GitLab?

Many online Git hosting services (such as GitHub and GitLab) allow you to 'protect' certain branches so that only project administrators can modify them. The purpose of this is to allow non-admin ...
user avatar
  • 425
1 vote
2 answers
247 views

Automatic push on commit (on bitbucket repository)

I have a website which commits to a git local repository all the changes done. I need to automatically push them directly from the web server to a remote Bitbucket repository. The authentication ...
user avatar
2 votes
0 answers
237 views

PCI Compliance and Git

We are currently moving to get a ci\cd pipeline running on Gitlab. Our current set up is we have a non-production and a production environment on separate networks. This reduces the PCI scope to just ...
user avatar
  • 121
1 vote
2 answers
276 views

Does git use the ssh user keys or the repository's deploy keys for encryption?

In this question I asked, why the SSH-Host key shown when connecting to a gitlab repository does not match the one shown on the instance configuration page. Nevertheless, the accepted answer says that ...
user avatar
10 votes
2 answers
3k views

Is it safe to store APK signing passwords in private git repository?

I develop android game using cocos2d-x. For android release, it contain this fields in proj.android/gradle.properties: # uncomment it and fill in sign information for release mode #RELEASE_STORE_FILE=...
user avatar
0 votes
3 answers
363 views

Does Git usage raise a valid security concern? If so, how? [closed]

This is about pure-and-simple Git; NOT the security concerns of using third party services like Github or Gitlab. While working on a closed source security project, during a meeting, one of the ...
user avatar
6 votes
3 answers
956 views

Safe to commit OpenVPN client config to Git?

I'd like to commit my OpenVPN client config to version control, in a repo that's remotely hosted and publicly accessible. This would reveal the server's hostname and port, as well as the filepaths to ...
user avatar
  • 163
2 votes
0 answers
106 views

What are the security implications of publishing my web server & PHP config files?

I have a web server with many virtual hosts, config files, etc. I'd like to track all of my web server & PHP config files using Git and have them hosted on a public GitHub repository, as this ...
user avatar
  • 425
1 vote
3 answers
2k views

Why does Github need to offer a GPG signature feature?

Github offers users to sign their work using GPG. I guess I missing the bigger picture, though how can people have your SSH keys or your credentials and not your GPG keys. Not sure what kind of layer ...
user avatar
  • 1,402
3 votes
1 answer
153 views

What information in sent in the clear when git redirects from HTTP to HTTPS?

If a user tries git commands pointed at an http://gitlab.example.com address (and they have not connected to this domain before), the gitlab.example.com server redirects (or rewrites) to https://...
user avatar
  • 193
1 vote
1 answer
151 views

Making an API repository private vs public

So I am currently working on the API of an application that will be serving many users. Currently the only "sensitive" information being stored using the API is user emails and names. The application ...
user avatar