bugGNU GRUB - Bugs: bug #50809, Require signed Git commits

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #50809: Require signed Git commits

Submitter:  Sam Kuper <sampablokuper>
Submitted:  Sat 15 Apr 2017 10:53:59 PM UTC
   
 
Category:  Security Severity:  Major
Priority:  5 - Normal Item Group:  Action Request
Status:  None Privacy:  Public
Assigned to:  None Originator Name: 
Open/Closed:  Open Release:  Git master
Release:  Reproducibility:  Every Time
Planned Release:  None

Sat 15 Apr 2017 10:53:59 PM UTC, original submission:  

None of GRUB's Git commits have been signed:

$ git log --pretty="format:%G?" | grep -v 'N$'
$

This exposes GRUB to tampering. See: https://mikegerwitz.com/papers/git-horror-story

GRUB should implement a Git hook to prevent unsigned commits being committed to the Savannah-hosted master branch or to Savannah-hosted tags.

(By "Savannah-hosted", I mean "hosted at savannah.gnu.org".)

Sam Kuper <sampablokuper>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by sampablokuper (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code