Gentoo Archives: gentoo-scm

From: "Robin H. Johnson" <robbat2@g.o>
To: gentoo-scm@l.g.o
Subject: Re: [gentoo-scm] Git gpg commit signing
Date: Fri, 02 Sep 2011 22:59:01
Message-Id: robbat2-20110902T225612-212673199Z@orbis-terrarum.net
In Reply to: [gentoo-scm] Git gpg commit signing by Alexey Shvetsov
On Sat, Sep 03, 2011 at 01:41:09AM +0300, Alexey Shvetsov wrote:
> Hi all! > > Seems rsbac alive again and its people created a repo with git gpg > related things [1] > > [1] http://git.rsbac.org/cgi-bin/gitweb.cgi?p=git-gpg.git;a=summary
What this does provide, despite the vulnerability I noted in the other email, is a good framework for handling the signatures. To defeat the attack I mentioned before, the signatures need to cover: 1. git cat-file commit $commitid |egrep -v '^(tree|parent|commiter)' 2. git diff-tree --no-commit-id -r --raw $commitid 2.1. Grab all of the blobid's from the 4th column. 3. "git show $blobid" for each blobid from #2.1 -- Robin Hugh Johnson Gentoo Linux: Developer, Trustee & Infrastructure Lead E-Mail : robbat2@g.o GnuPG FP : 11AC BA4F 4778 E3F6 E4ED F38E B27B 944E 3488 4E85