bugGNU GRUB - Bugs: bug #50809, Require signed Git commits

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #50809: Require signed Git commits

Submitted by:  Sam Kuper <sampablokuper>
Submitted on:  Sat 15 Apr 2017 10:53:59 PM UTC  
 
Category:  Security Severity:  Major
Priority:  5 - Normal Item Group:  Action Request
Status:  None Privacy:  Public
Assigned to:  None Originator Name: 
Open/Closed:  Open Release: 
Release:  Git master Reproducibility:  Every Time
Planned Release:  None

Sat 15 Apr 2017 10:53:59 PM UTC, original submission:

None of GRUB's Git commits have been signed:

$ git log --pretty="format:%G?" | grep -v 'N$'
$

This exposes GRUB to tampering. See: https://mikegerwitz.com/papers/git-horror-story

GRUB should implement a Git hook to prevent unsigned commits being committed to the Savannah-hosted master branch or to Savannah-hosted tags.

(By "Savannah-hosted", I mean "hosted at savannah.gnu.org".)

Sam Kuper <sampablokuper>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by sampablokuper (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    No changes have been made to this item

    Back to the top


    Powered by Savane 3.3