We’re launching Lyria 3.5 in Google Flow Music, with advances across musicality, lyrics, vocals, and creative control
deepmind.google·6d ago
AI Engineering
Lobsters·28d ago·5 min read
New Research: A "Verified" GitHub Commit Is NOT Unique
TL;DR
New research reveals that a 'Verified' GitHub commit is not unique due to a vulnerability called hash chain malleability. Attackers can create distinct commits with identical content and valid signatures, undermining the integrity of supply-chain security.
✦ Why It Matters
Engineers should review their dependency management practices to ensure they are not relying on potentially compromised verified commits.
Key Takeaways
- Implement stricter local verification processes for commits.
- Review and update dependency management tools to mitigate risks.
- Educate teams about the implications of signature malleability.
- Monitor GitHub's updates regarding signature verification practices.
Full Summary
Git uses hashes to uniquely identify commits, but new research by Jacob Ginesin from Carnegie Mellon University shows that this assumption is flawed. The study introduces the concept of hash chain malleability, where an attacker can generate a different commit with the same content and a valid signature without needing the signing key.
This is achieved through signature malleability techniques, which allow multiple valid serializations of a commit. The research outlines three methods that exploit GitHub's verification process, including ECDSA signature inversion and non-canonical S/MIME encoding.
GitHub's server-side behavior does not canonicalize signatures before verification, leading to multiple commits being marked as 'Verified' despite differing byte representations. This vulnerability poses significant risks to supply-chain security, as it undermines the trust in verified commits.