On Omitting Commits and Committing Omissions: Preventing Git Metadata...
summary
Catalogs seven metadata-manipulation attacks and demonstrates how tampering with Git reference files enables subtle exploits like teleport attack and rollback that make users merge or install vulnerable versions. Defense is a backwards-compatible reference state log: each push includes a signed, hash-chained RSL entry (reference, target commit, previous hash, signature) plus a freshness nonce (non-spec) to prevent rollbacks. Prototype git-extension shows modest cost — under 1% storage, ~25 KB network overhead — and reduces attack surface under partial adoption while integrating with existing Git workflows.
AI-written summary · about
chapters (27)
- 0:00Intro
- 1:08A central repository and two Devs
- 1:21Git is a distributed version control system
- 2:25While we were having chips and guacamole...
- 3:10Repository compromises happen
- 3:53Luckily, we have git's security features
- 7:53Branch teleport attack: result
- 8:06Tag teleport attack
- 9:09Branch rollback attack
- 10:04Attack taxonomy: summary
- 10:52The problem with existing solutions
- 11:49Defense assumptions
- 13:03Defense goals: usability
- 14:35Defense: Overview
- 14:56The Reference State Log
- 15:29The RSL push entry
- 16:04Implementation: prototype
- 16:48Synchronization
- 17:41Verification
- 18:20How are attacks prevented
- 18:57RSL + Nonce Bag VS other mechanisms
- 19:55Partial adoption of our defense
- 20:19Storage overhead
- 20:33Network overhead
- 20:56Interaction with the Git community
- 22:30Other version control systems
- 23:11To wrap up 1. Do not trust the infrastructure
