.merge+ 2963

.merge+ #2963

Added

.merges

is there such a thing as immutable git? no "force push and backdating PRs/commits"?

Assuming SHA1 can not be pwned (or you use a post-SHA1 git repo), then you can't alter history without the commit hashes changing.

Assuming SHA1 can not be pwned is not quite sane at this moment.

kinghat[m]: what do you mean by "immutable"?

a force-push is a new branch of the commit graph

That which can be immuted. Obviously.

there's no way to prevent this, but it's detectable

(assuming no hash collisions...)

a repo host (like github) could always prevent this by its own policy

So I suppose it's "sort of" preventable =p

It's preventable by a repo host, but not inherently by the way git operates, is what I mean

we were talking about the hash checking on the gui updater in here on the 11th

fluffy was saying its not hard to change git history.

It's hard to change it without affecting the hash

It's very hard to change it if the commits are signed

What are you looking to do?

i was just wondering if it would be better to check the hash from two locations instead of a single source.

but selsta already mention that it was probably overkill the way it is and would be giving gh data about users checking the hash iirc

The hash of what?

the binary iirc

That has nothing to do with git

i then asked if there would be a public trace of the compromise. and thats where the backdating of a pr/commit came into context.

Compromise of what?

The binary or the git repo?

Or both?

a dev

Well, you're checking for two sigs from maintainers already, right?

dev > repo > binary

That does not make sense because if you have server access you can change a file, there would be no trace on github.

If you mean the auto updater specifically, you would see which maintainer signed the bad hashes.

ya but you would have to compromise the monero server and github

If someone compromises 3 DNS servers, the website and two maintainer signatures then there is no reason to believe that they couldn’t get into the Github of a maintainer.

true

I consider GPG sig compromised = fully compromised

something something repo builds 😂

soon^tm :D