Commit Signatures for Centralized Version Control Systems - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2019

Commit Signatures for Centralized Version Control Systems

Résumé

Version Control Systems (VCS-es) play a major role in the software development life cycle, yet historically their security has been relatively underdeveloped compared to their importance. Recent history has shown that source code repositories represent appealing attack targets. Attacks that violate the integrity of repository data can impact negatively millions of users. Some VCS-es, such as Git, employ commit signatures as a mechanism to provide developers with cryptographic protections for the code they contribute to a repository. However, an entire class of other VCS-es, including the well-known Apache Subversion (SVN), lacks such protections.We design the first commit signing mechanism for centralized version control systems, which supports features such as working with a subset of the repository and allowing clients to work on disjoint sets of files without having to retrieve each other’s changes. We implement a prototype for the proposed commit signing mechanism on top of the SVN codebase and show experimentally that it only incurs a modest overhead. With our solution in place, the VCS security model is substantially improved.
Fichier principal
Vignette du fichier
485650_1_En_25_Chapter.pdf (498.86 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-03744292 , version 1 (02-08-2022)

Licence

Paternité

Identifiants

Citer

Sangat Vaidya, Santiago Torres-Arias, Reza Curtmola, Justin Cappos. Commit Signatures for Centralized Version Control Systems. 34th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC), Jun 2019, Lisbon, Portugal. pp.359-373, ⟨10.1007/978-3-030-22312-0_25⟩. ⟨hal-03744292⟩
14 Consultations
54 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More