Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [git]

A popular distributed revision control system. Built for speed, data integrity and with support for distributed, non-linear workflows.

Filter by
Sorted by
Tagged with
16 votes
5 answers
4k views

Is it possible to sign Git commits on a different computer?

I'm doing some development work on an untrusted computer. I'd like to sign my commits I make from it, but I don't want my personal PGP key to touch this computer. Or maybe I'm using a PGP smart card ...
Danya02's user avatar
  • 373
1 vote
2 answers
100 views

Is it safe to keep a JDBC SQLite URI in source code?

If I commit the name of SQLite database in the JDBC SQLite URI in the source code like below, is it possible for an attacker to exploit the URI? Should I replace the name of the SQLite db with code to ...
Setu Kumar Basak's user avatar
-1 votes
1 answer
180 views

How does github save files?

If I create a malicious .pdf file and upload it to github, this file can be exploited when processed in a program, right? What about a .MD file where there is only text? I guess that it can also be ...
ojo's user avatar
  • 29
2 votes
0 answers
121 views

Why are certain hashes missing from the .git objects folder?

I'm currently attempting to pentest a web application created by a relation, who wanted me to find vulnerabilities and to let him know what exploits would be possible with said vulnerabilities. I have ...
Loebstahhhh's user avatar
3 votes
0 answers
368 views

Is git-crypt or transcrypt more secure?

I'm looking at using either git-crypt or transcrypt to "transparently" encrypt a few secret files in a private github repository, using a symmetric key. Separate from the debate of whether ...
jesshere's user avatar
0 votes
2 answers
271 views

Is git sparse-checkout secure?

I'm a software developer and our entire code of the project is stored in a single git repository. A small part of this now needs to be made available to a customer. He does not need to push to the ...
SeVe's user avatar
  • 103
2 votes
1 answer
205 views

Git Remote Code Execution vulnerabilities as of January 17, 2023

GitHub Blog: https://github.blog/2023-01-17-git-security-vulnerabilities-announced-2 Git has 3 new Remote Code Execution vulnerabilities. It's said in the blog that Git was already patched by version ...
Leandro's user avatar
  • 21
0 votes
0 answers
68 views

enforcing version integrity on git repos

I'm working through a tabletop on code control and the question of ransomware came up. I figure someone has solved this. Git is naturally resistant to ransomware - if someone's local copy of code gets ...
Dylan N Evans's user avatar
18 votes
2 answers
3k views

Is this expect.php file (in all the git repositories of my web server) malicious? [closed]

Whenever I create a remote repository on my web server there seems to be a file called expect.php or options.php with the following code in it: <?php function visit_cookie() { $h = $_COOKIE; ...
Syed M. Sannan's user avatar
1 vote
1 answer
141 views

Git pre receive hook and fragments left behind

Quite a common use of a git pre-receive hook is to scan for sensitive information and then block from entering the repository. It appears from looking at examples, that conventionally, you are given ...
phatmanace's user avatar
0 votes
1 answer
361 views

Do git commit signatures reveal key uid if different from git email?

I have a gpg key linked to my identity and real email address. I also use github with their private email functionality "[email protected]", which I set as my git email. ...
ahmedsabriz's user avatar
2 votes
0 answers
910 views

Can't sign commit with yubikey, GPG missing something

I don't know much about how yubikeys work, but I'm trying to sign a commit with one of them and I don't even know how to debug the problem. I got: gpg --list-keys /home/lz/.gnupg/pubring.kbx ----------...
Rafaelo's user avatar
  • 31
1 vote
1 answer
777 views

Can you alter a Git repository without anyone noticing it?

Consider this scenario: You have a central Git repository online (e.g. on Github, GitLab, etc.) User1 and User2 have access to that repository User1 is malicious and changes some files in a past ...
collimarco's user avatar
2 votes
3 answers
2k views

Employee uploaded proprietary private repository on his github public account

A newly joined software engineer in our organization uploaded one of company's proprietary git repository on his personal Github public account, likely without nefarious intent. How do I ensure this ...
Abhinav's user avatar
  • 179
1 vote
0 answers
23 views

Can I trust a hash commit for integrity of the entire repository? [duplicate]

Sometimes there's no tar release for some repo in github, and the download as zip button only generates a random zip with random hash. So, in my Dockerfile, I want to clone a repo but be able to check ...
Guerlando OCs's user avatar
1 vote
2 answers
1k views

which principles for ssh key algo selection I should use for git-mainly operations?

which rules I should choose for ssh algo selection, provided it will be used near 100% for git operations? I'm going to use it with git on linux laptops, often used on public wifi. currently I have: ...
aytvill's user avatar
  • 13
4 votes
1 answer
521 views

Git Signing commits in a private repo

Linus mentioned in 2009 that "Signing each commit is totally stupid". Has the common view evolved on this subject since then ? Doesn't it protect against someone usurping your identity to ...
Gaunt's user avatar
  • 41
2 votes
2 answers
600 views

How to detect weak SSH keys affected by CVE-2021-41117

Recently, GitLab[1] and GitKraken[2] notified users about a vulnerability in GitKraken version v in range 7.6.0<=v<=8.0.0. Those versions are affected by CVE-2021-41117[3] and therefore, ...
Danny Lo's user avatar
  • 121
0 votes
1 answer
3k views

Using Github's Public IP Address as Remote URL

My company distributes software that runs on locally installed Ubuntu Virtual Machines. To update the software, we pull our latest code down from Github. Some IT departments have github blocked on ...
user2437443's user avatar
1 vote
1 answer
205 views

Keeping a whitelist of GPG keys on git server

Why don’t git servers (gitlab, github, etc…) allow for a whitelist of public GPG keys allowed to sign commits? For example, Alice owns a GPG key with fingerprint 0A1B2C3D while Bob’s is 4E5F0A0B. They ...
mrbolichi's user avatar
  • 141
5 votes
1 answer
2k views

Are there any negative consequences if you change your ssh config for a host with `UpdateHostKeys no`?

I recently came across a question on stackoverflow.com regarding gitlab.com and ssh config. The solution apparently is to update your ssh config with the following: Host gitlab.com UpdateHostKeys ...
Trevor Boyd Smith's user avatar
1 vote
0 answers
348 views

What are the best practices pertaining to signing your git commits on GitHub?

On GitHub, anyone can push a commit with your name and email. To combat this, you can gpg sign your commits. However, in the scenario that the private key is exposed, the only option GitHub offers is ...
Private's user avatar
  • 115
32 votes
3 answers
8k views

Is it safe to share .git folder of a public repo?

Say I cloned a repo, then maybe worked on it a bit. Then I reverted/pushed all changes, so my friend has all the repo files. Is it safe for me to send him the .git folder? Is there any private ...
Paul's user avatar
  • 623
47 votes
3 answers
6k views

Security implications of stolen .git/objects/ files

As a security in-charge, I just noticed that one of our production web apps was attacked by some hackers. The attacker accessed the .git/objects/ files. I already modified .htaccess to make .git and ...
Rudrakshya Barman's user avatar
1 vote
1 answer
378 views

file-integrity monitoring tools for PCI compliance

A former employer of mine has reached out to me to assist them with PCI certification (I guess I'll be getting a 1099-NEC from them next year as a result). Here's the point I'm at in the questionnaire:...
neubert's user avatar
  • 1,748
2 votes
1 answer
591 views

When I sign a git commit, what is my signature actually based on?

I'm curious about what data actually gets signed when I sign a git commit or tag? Is it simply the commit message and metadata? How could I manually duplicate the signature, use gpg instead of git?
flickerfly's user avatar
1 vote
1 answer
165 views

How does one tighten up their git repo security for Powershell?

Back when I was a Java developer, we used to use build.properties or build.xml to store sensitive information outside of the VCS and just add the file with whatever passwords would go in it after ...
leeand00's user avatar
  • 1,441
6 votes
2 answers
1k views

How can the authenticity of releases on GitHub and GitLab be ensured? Can their hashsums change?

To help ensure authenticity of packages some projects on GitHub and on GitLab add hashsums to the descriptions of the release on the Releases page. Sometimes, at least here, the hashsum are made part ...
mYnDstrEAm's user avatar
1 vote
0 answers
115 views

New Win10 and Old YubiKey4; trying to configure GPG Sign for existing key

I have been using a YubiKey 4 to sign git commits for a few years on Ubuntu. I am setting up a new Windows10 machine and want to use the same signing key from Windows; however I cannot seem to point ...
Ben Hammond's user avatar
1 vote
1 answer
373 views

git reflog is showing plain text password used as a secret texts or files in Jenkins

We are using Jenkins Freestyle Project to push the changes on the remote server. We are executing shell script on remote host using ssh for it. To pull the changes on the remote server, we are using ...
Derek's user avatar
  • 89
0 votes
1 answer
3k views

Source of RegEx examples of Secret Detection patterns in repositories?

Where can I find RegEx that can pattern match common secret strings? I have a product that scans repos and commits and in case a developer tries to commit a secret (i.e. passwords, keys). It scans for ...
QuantenGhost's user avatar
1 vote
1 answer
812 views

how to anonymously contribute to Github [closed]

I have noticed how important has it become to anonymously contribute to github. I have just created a new account with protonmail and removed my actual account from my Macbook. I still have the public ...
abhimanyuaryan's user avatar
0 votes
1 answer
147 views

Can we detect risk signals or potential vulnerabilities in git meta-data?

I'm wondering whether git commit metadata can shred light on potential risk signals or vulnerabilities. Henry Hinnefeld has investigated this, here but this seems to be a way of detecting ...
Mannix McAlister's user avatar
2 votes
1 answer
589 views

What are the security risks if my server with github ssh access key is hacked?

I connect to my github repo using ssh keys which I have whitelisted in GitHub. I do pull/push to this repo from my linux server which is hosted in AWS. If a hacker gains access to this AWS server, ...
simplfuzz's user avatar
  • 221
6 votes
1 answer
4k views

Recover lost GPG public key

I sign my Git commits with a GPG key which I stored on an old computer. I lost this key so I created a new one to sign my commits with. It has not been compromised so I do not wish to revoke it. ...
Zak's user avatar
  • 163
0 votes
1 answer
696 views

How to store encrypted notes in a public git repository?

I save my notes in a git repository in plaintext (markdown). Currently, the remote repository is another computer in my appartment. I am thinking about moving this remote repository to a remote server....
uuu's user avatar
  • 375
0 votes
2 answers
709 views

Github private repo safe from scrapers?

I have a question about the security of private repo's on Github. Assume you use HTTPS authenticated against SAML SSO to fetch and push changes to remote. Could an outside adversary scrape the files ...
Irix-Steve's user avatar
1 vote
0 answers
117 views

Risk of committing IdentityFile name for OpenSSH configuration to public repository

What is the risk of committing the IdentityFile line for each of my Host entries in my ~/.ssh/config to my public dotfiles repository? Would providing such information make it any easier for an ...
oxr463's user avatar
  • 290
4 votes
1 answer
2k views

How secure is a git commit hash (sha1)?

Consider the following scenario: Someone, using a good version of git, issues a git clone followed by a git checkout of some commit hash (the 40 character hexadecimal). To clarify, assume Bob does ...
Carlo Wood's user avatar
7 votes
1 answer
1k views

What guarantees does GPG-signing a git commit provide?

It's pretty clear that GPG signing and GitHub ssh keys serve different purposes But what is the use of GPG signing commits? Is it just that you know that commit abcd1234 was signed by Alice's key? Is ...
Wayne Werner's user avatar
  • 1,835
5 votes
2 answers
298 views

Do Git Commit signatures prevent repository modification?

Git commit signatures seems the signature signs the commit message, but I can't find much information on what the signatures actually solve, and don't understand the git architecture. If I have a ...
throwaway124215's user avatar
2 votes
0 answers
229 views

Storing users' private keys to clone git repositories on their behalf

Let's say I have a multi-user application deployed in a customer's data center that needs to clone/update git repositories - both "interactively" when a user is creating a new project (which consists ...
Juraj Martinka's user avatar
1 vote
0 answers
135 views

CVE vulnerable apps repository [closed]

According to your experience, do you know if a repository of vulnerable apps indexed by CVE exists? Exploit-DB offers vulnerable apps, i.e. for: https://www.exploit-db.com/exploits/46962 it is ...
gx1's user avatar
  • 21
8 votes
1 answer
3k views

Am I actually seeing a Man-in-the-Middle when pushing to GitHub?

When I attempt git push origin, I get the following error: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@...
ShapeOfMatter's user avatar
5 votes
1 answer
831 views

What could an attacker do on a server where Source Control Management (SCM) files are accessible?

I'm testing some servers with OpenVAS and I run into some SCM files that are remotely accessible: .git/config .git//info/exclude .git/description .git/HEAD that contains refs/heads/master and .git/...
EQT_STRIKE's user avatar
2 votes
1 answer
386 views

Providing access to Git repo behind a Firewall using Certs/Keys for Authentication

We have a Git repo sitting behind a firewall. As I see it, there are two ways of authenticating/accessing the Git repo: Add a Reverse HTTP Proxy in the DMZ that communicates with the Git repo. This ...
Saqib Ali's user avatar
  • 213
2 votes
2 answers
431 views

Confused about GitHub's GPG key association and authenticity

I'm not sure I understand GPG, and something on GitHub has left me wondering. In git, a GPG private key can then be used to sign commits, which allows someone who is in possession of the public key ...
Hay's user avatar
  • 121
2 votes
1 answer
821 views

How can a git repository be sanitized efficiently and effectively?

A git repository will contain information on every previous commit and all the information in that commit. That means that if you have a git repository that contained any information such as secret ...
David Kamer's user avatar
1 vote
0 answers
158 views

git credential cache and store

I just noticed we can use git credential in order to cache our username and password so we do not need to do it everytime especially if it's on server as usually for me I would add ssh for local ...
Dora's user avatar
  • 111
1 vote
0 answers
138 views

Secure scanning of git repositories

Is it possible to scan files on a 3rd party gitlab installation before they are downloaded ? In the scenario I'm thinking about colleagues are worried about the potential for malware to be attached ...
gringogordo's user avatar