I only see a list of files. Can you link to something more specific?
some stranger repos have been created and there is this issue https://github.com/CanonicalLtd/CAN_GOT_HAXXD/issues/1
Removed or made private (I see a 404 error only)
Canonical Ltd source code repositories have been compromised
11–20 of 78 posts
Re: Canonical Ltd source code repositories have been compromised
#12Earlier quoted context omitted.
some stranger repos have been created and there is this issue https://github.com/CanonicalLtd/CAN_GOT_HAXXD/issues/1
Removed or made private (I see a 404 error only)
Somebody on twitter took some screenshot https://twitter.com/dclauzel/status/1147525512794988544
Re: Canonical Ltd source code repositories have been compromised
#13We are lucky that they decided to vandalize instead of hiding something. Remember, on Github you can actually submit your commit with another’s email, and github automatically puts the identity associated with the email allowing people to spoof. Always sign your commits!
If they had an SSH key only then signing would be a defense. But if the attackers got OAuth access, stolen credentials, or a personal access token to someone with access to the org, they could do everything through the web interface which is signed by a common Github key.
Re: Canonical Ltd source code repositories have been compromised
#14We are lucky that they decided to vandalize instead of hiding something. Remember, on Github you can actually submit your commit with another’s email, and github automatically puts the identity associated with the email allowing people to spoof. Always sign your commits!
That’s not just on github. That’s totally a feature of git itself. You can set the email address to whatever you want.
Not knowing the details around this, but if they haven't done so, Github could add something to indicate whether particular commits were signed by the PGP key Github knows to belong to the user the commit claims it was authored by. A user could have a setting to enable Github warnings where there are commits supposedly authored by user but not signed. They could also always warn where there are commits authored by a user but signed by a key the user didn't inform Github of.
Likewise, I wonder if git differentiates signatures where the keys are set as trusted in gnupg, and those that are not.
Re: Canonical Ltd source code repositories have been compromised
#15Earlier quoted context omitted.
That’s not just on github. That’s totally a feature of git itself. You can set the email address to whatever you want.
Not knowing the details around this, but if they haven't done so, Github could add something to indicate whether particular commits were signed by the PGP key Github knows to belong to the user the commit claims it was authored by. A user could have a setting to enable Github warnings where there are commits supposedly authored by user but not signed. They could also always warn where there are commits authored by a…
> Not knowing the details around this, but if they haven't done so, Github could add something to indicate whether particular commits were signed by the PGP key Github knows to belong to the user the commit claims it was authored by.
They do this
Re: Canonical Ltd source code repositories have been compromised
#16We are lucky that they decided to vandalize instead of hiding something. Remember, on Github you can actually submit your commit with another’s email, and github automatically puts the identity associated with the email allowing people to spoof. Always sign your commits!
Isn't commit signing a bit like NuGet package signing? Not worth it unless _everyone_ does it all the time? Any valid commit doesn't necessarily invalidate unsigned commits. It only means this commit is really done by me, but it doesn't me the other commit wasn't done by me.
Re: Canonical Ltd source code repositories have been compromised
#17We are lucky that they decided to vandalize instead of hiding something. Remember, on Github you can actually submit your commit with another’s email, and github automatically puts the identity associated with the email allowing people to spoof. Always sign your commits!
I wonder if it was an actual outsider attack, or just a disgruntled (ex-)employee?
Re: Canonical Ltd source code repositories have been compromised
#18Are these not just mirrors though or do they actually use git? Woulda thought they used SVN primarily since they pull from Debian? Or do they just pull tarbals... And this all leads to me wondering how they do their process... Anybody got good docs on how Ubuntu or similar distros that base off a parent distro do their work?
[deleted]
Re: Canonical Ltd source code repositories have been compromised
#19Are these not just mirrors though or do they actually use git? Woulda thought they used SVN primarily since they pull from Debian? Or do they just pull tarbals... And this all leads to me wondering how they do their process... Anybody got good docs on how Ubuntu or similar distros that base off a parent distro do their work?
Debian stores packaging in Git too, these days, sometimes exclusively.
That’s true, but somewhat misleading. Though most Debian maintainers use a VCS for packaging, it’s incidental to what actually ends up in the Debian package tree. That’s all still based off of tarballs submitted off of a developer’s machine.
Re: Canonical Ltd source code repositories have been compromised
#20We are lucky that they decided to vandalize instead of hiding something. Remember, on Github you can actually submit your commit with another’s email, and github automatically puts the identity associated with the email allowing people to spoof. Always sign your commits!
Isn't commit signing a bit like NuGet package signing? Not worth it unless _everyone_ does it all the time? Any valid commit doesn't necessarily invalidate unsigned commits. It only means this commit is really done by me , but it doesn't me the other commit wasn't done by me.
Yes, but there are organizations that require all commits to be signed.