Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:122889
Feedback-ID: id5114917:Fastmail
Content-Type: multipart/alternative;
 boundary="------------xst000WVsXsnFBGZ5pd0KfXL"
Message-ID: <33406173-693c-44c2-a378-fff49751f3b4@rwec.co.uk>
Date: Tue, 2 Apr 2024 19:48:01 +0100
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [PHP-DEV] Requiring GPG Commit Signing
To: internals@lists.php.net
References: <3e988b3b-65b8-13d3-16cf-1296bfdd7ed2@php.net>
 <CAPyj-LC9Ygr0vNB3RyTKmmYmq1VbNgzDS_J3bq6NaoXD1YaMhQ@mail.gmail.com>
Content-Language: en-GB
In-Reply-To: <CAPyj-LC9Ygr0vNB3RyTKmmYmq1VbNgzDS_J3bq6NaoXD1YaMhQ@mail.gmail.com>
From: imsop.php@rwec.co.uk ("Rowan Tommins [IMSoP]")

This is a multi-part message in MIME format.
--------------xst000WVsXsnFBGZ5pd0KfXL
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

On 02/04/2024 18:27, Ilija Tovilo wrote:
> If your GitHub account is compromised,
> [...] the attacker may simply register their
> own gpg key in your account, with the commits appearing as verified.
>
> If your ssh key is compromised instead, and you use ssh to sign your
> commits, the attacker may sign their malicious commits with that same
> key they may use to push.


The key point (pun not intended) is that git doesn't record who pushed a 
commit - pushing is just data synchronization, not part of the history. 
What it records is who "authored" the commit, and by default that's just 
plain text; so if somebody compromises an SSH key or access token 
authorised to your GitHub account, they can push commits "authored by" 
Derick, or Nikita, or Bill Gates, and there is no way to tell them apart 
from the real thing.

In fact, you don't need to compromise anybody's key: you could socially 
engineer a situation where you have push access to the repository, or 
break the security in some other way. As I understand it, this is 
exactly what happened 3 years ago: someone gained direct write access to 
the git.php.net server, and added commits "authored by" Nikita and 
others to the history in the repository.

If all commits are signed, a compromised key or account can only be used 
to sign commits with that specific identity: your GitHub account can't 
be used to sign commits as Derick or Nikita, only as you. The impact is 
limited to one identity, not the integrity of the entire repository.

Regards,

-- 
Rowan Tommins
[IMSoP]

--------------xst000WVsXsnFBGZ5pd0KfXL
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <div class="moz-cite-prefix">On 02/04/2024 18:27, Ilija Tovilo
      wrote:</div>
    <div class="moz-cite-prefix">
      <blockquote type="cite">
        <pre class="moz-quote-pre" wrap="">If your GitHub account is compromised,
[...<span style="white-space: normal"></span>] the attacker may simply register their
own gpg key in your account, with the commits appearing as verified.

If your ssh key is compromised instead, and you use ssh to sign your
commits, the attacker may sign their malicious commits with that same
key they may use to push.</pre>
      </blockquote>
    </div>
    <br>
    <p><br>
    </p>
    <p>The key point (pun not intended) is that git doesn't record who
      pushed a commit - pushing is just data synchronization, not part
      of the history. What it records is who "authored" the commit, and
      by default that's just plain text; so if somebody compromises an
      SSH key or access token authorised to your GitHub account, they
      can push commits "authored by" Derick, or Nikita, or Bill Gates,
      and there is no way to tell them apart from the real thing.<br>
    </p>
    <p>In fact, you don't need to compromise anybody's key: you could
      socially engineer a situation where you have push access to the
      repository, or break the security in some other way. As I
      understand it, this is exactly what happened 3 years ago: someone
      gained direct write access to the git.php.net server, and added
      commits "authored by" Nikita and others to the history in the
      repository. <br>
    </p>
    <p>If all commits are signed, a compromised key or account can only
      be used to sign commits with that specific identity: your GitHub
      account can't be used to sign commits as Derick or Nikita, only as
      you. The impact is limited to one identity, not the integrity of
      the entire repository.</p>
    <p>Regards,<br>
    </p>
    <pre class="moz-signature" cols="72">-- 
Rowan Tommins
[IMSoP]</pre>
  </body>
</html>

--------------xst000WVsXsnFBGZ5pd0KfXL--