Re: [RCF] Secure git against involuntary arb. code execution without feature loss

On 8. Oct 2025, at 23:49, Taylor Blau [off-list ref] wrote:

On Wed, Oct 08, 2025 at 05:30:08PM -0400, Taylor Blau wrote:

quoted

On Wed, Oct 08, 2025 at 11:02:03PM +0200, Michael Lohmann wrote:

quoted

* Proposed solution (keeping all existing features):
- On first use, git generates a secret "token" (e.g. a random string in
 ~/.gitsecret)
- On calling `git init` or `git clone`, the secret is copied into the
 new .git directory and serves as proof that this clone was created by
 this user

Sure, but the problem is not with direct clones (at least, not using the
--local optimization), but with clones that recursively clone other
submodules.

This is a think-o. I meant to ask whether or not we would respect the
token from the top-most $GIT_DIR in nested bare repositories. I imagine
we would not (otherwise this proposal would not provide any additional
security guarantees), and so...

My understanding was that submodules would add their own git folder in
the top-level .git/modules/my-submodule, so obviously in order to trust
a submodule, you need to "sign" these too and you could automatically
also with --recursive.

(Sorry @Taylor - I missed adding the whole list as recipient, so you get
this twice...)