Malicious code added to 35k GitHub repos, leaking user environments

Re:Malicious code added to 35k GitHub repos, leaking user en... by pilif on Wednesday August 03, 2022 @02:20AM (#32328264)

They have something under Settings > SSH and GPG keys where you can enable Vigilant mode.

While that still allows pushing unsigned commits, it will flag them with a warning batch.

I had this on for a while, but unfortunately as some open source projects tend to rebase commits before pushing them, this was causing warnings to be shown (as the rebase breaks my signature), so I turned it off again as to not scare people when looking at the commit history of a project and seeing warnings after my contributions were merged in.

[ Parent | on HN ]

Re:Malicious code added to 35k GitHub repos, leaking user en... by stevelacy on Wednesday August 03, 2022 @02:28AM (#32328307)

Good to know, I was not aware. The squash/rebase issue is definitely problematic, though a tree of signatures could be appended to each commit. Now... this does break how commits are currently signed.

[ Parent | on HN ]

Re:Malicious code added to 35k GitHub repos, leaking user en... by eurasiantiger on Wednesday August 03, 2022 @02:50AM (#32328446)

Would this be a problem if commits were stored in a blockchain? Rebase would effectively fork the chain.

[ Parent | on HN ]

Re:Malicious code added to 35k GitHub repos, leaking user en... by pilif on Wednesday August 03, 2022 @02:53AM (#32328460)

a git repo is practically a blockchain. Fixing this will require how git treats signatures, but no additional parallel architecture needs to be created.

[ Parent | on HN ]