Commit Signatures for Centralized Version Control Systems (Extended Abstract)
Commit Signatures for Centralized Version Control Systems (Extended Abstract)
复制标题
集中版本控制系统的提交签名（扩展摘要）
DOI：
10.1007/978-3-030-22312-0_25
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
Cappos, Justin
中科院分区：
文献类型：
--
作者：
Vaidya, Sangat;Torres-Arias, Santiago;Curtmola, Reza;Cappos, Justin
版本控制系统（VCS-es）在软件开发生命周期中发挥着重要作用，但历史上，与其重要性相比，其安全性相对不足。最近的历史表明，源代码存储库是吸引人的攻击目标。破坏存储库数据完整性的攻击可能会对数百万用户产生负面影响。一些VCS-es，如Git，使用提交签名作为一种机制，为开发人员提供加密保护，以保护他们贡献给存储库的代码。然而，包括著名的Apache Subversion（SVN）在内的一整类其他VCS-es都缺乏这样的保护。我们为集中式版本控制系统设计了第一个提交签名机制，它支持诸如处理存储库的子集和允许客户端处理不相交的文件集而无需检索彼此的更改等功能。我们实现了一个原型的SVN代码库上提出的提交签名机制，并通过实验表明，它只会产生适度的开销。有了我们的解决方案，可大大改进网络安全模型。
Version Control Systems (VCS-es) play a major role in the software development life cycle, yet historically their security has been relatively underdeveloped compared to their importance. Recent history has shown that source code repositories represent appealing attack targets. Attacks that violate the integrity of repository data can impact negatively millions of users. Some VCS-es, such as Git, employcommit signaturesas a mechanism to provide developers with cryptographic protections for the code they contribute to a repository. However, an entire class of other VCS-es, including the well-known Apache Subversion (SVN), lacks such protections.We design the first commit signing mechanism for centralized version control systems, which supports features such as working with a subset of the repository and allowing clients to work on disjoint sets of files without having to retrieve each other’s changes. We implement a prototype for the proposed commit signing mechanism on top of the SVN codebase and show experimentally that it only incurs a modest overhead. With our solution in place, the VCS security model is substantially improved.