Older versions of git would tell you the hashes were wrong. Implementations of git in other languages would tell you the hashes were wrong. Manually checking would tell you the hashes were wrong. It's just not feasible.
EDIT: Plus, git is stored in git, so you'd need to backdoor git first... ;)
Bootstrap operation from hell [1]
[1] - https://github.com/git/git/commit/e83c5163316f89bfbde7d9ab23...
Re:The Linux Backdoor Attempt of 2003
by ryanthejuggler on Wednesday October 09, 2013 @09:59AM
(#6521239)
Thanks for the link... I've never read the README before, and it's very entertaining. Now I'm going to have "goddamn idiotic truckload of sh*t" echoing through my head all day
I read, when the project was introduced, but forgotten it a long time ago. Goddamn Idiotic Truckload of Sh*t Hub, Inc. would make a memorable name for an incorporation.
Also, the source of git would also reveal a problem when examined. To get around that one starts hypothesizing the sort of globe-spanning conspiracy against which one might as well give up ("well, maybe all my compilers (not just gcc, all of them) are also backdoored to backdoor themselves, and each other if you cross-compile, then backdoor git too...").
This summer:
One man looked too deeply into the source code of his compilers and didn't like what he found.
Quickly, damon_c! To Kickstarter!
Re:The Linux Backdoor Attempt of 2003
by TheCraiggers on Wednesday October 09, 2013 @11:05AM
(#6521657)
The kernel hasn't always been tracked in git though. How would we know something wasn't added before the source was imported into git?
Because before it was tracked by git, it was in bitkeeper, and it was likely in some other system before that.
Re:The Linux Backdoor Attempt of 2003
by TheCraiggers on Wednesday October 09, 2013 @02:31PM
(#6522944)
I understand that. But what I don't know are the capabilities of those other, older systems that once tracked the kernel source. Do we have the same assurances there?
Great question.
BitKeeper wasnt as good as git when it comes to changesets and introducing bugs, still it was founded on more social side of changes needing approvals. Before that it was CVS and for that its almost easy to introduce backdoors.
Besides the whole source code compromise discussion I would really want to know whether there is any incident report planned.
Until the redesign kernel.org stated: "We will be writing up a report on the incident in the future.".
But since the compromise was more than 2 years ago it seems unlikely.
Such changes would be visible when comparing locally stored tree of older sources with new, supposedly backdored official sources stored on github. Someone should surely notice undocumented changes while doing backports, kernel upgrades etc. Heck, even integrity check by 3rd party tools could help here.
Many people say, calm down, its git they cant have inserted backdoors etc without messing up the git history/changelog/hashes/whatever. But what if, git was modified and backdoored previously to hide some objects/changes? How would such an attack work? Lets say you discover a problem in git, which allows you to omit changesets in its output. How would that work to backdoor the kernel?