What happens if someone modifies repository without me knowing?

What happens if someone modifies repository without me knowing?

[Manuel Reimer]

Hello,

let's assume someone got access to the GIT server of my hoster and tries 
to hide a change within an old commit, done by me.

How will GIT tell me about this hidden change? Will a "git pull" just 
bring this change into my working copy, whithout telling me about the 
change?

Yours

Manuel

Re: What happens if someone modifies repository without me knowing?

[Sverre Rabbelier]

Heya,

On Sun, Sep 26, 2010 at 21:07, Manuel Reimer <Manuel.Spam@nurfuerspam.de> wrote:
> How will GIT tell me about this hidden change? Will a "git pull" just bring
> this change into my working copy, whithout telling me about the change?

It will tell you it did a "forced update", assuming the other side has
been set as your upstream. If you do a pull (rather than a fetch) it
will try to apply the changes right away too.

Demonstration:

sverre@laptop-sverre:~/code
$ git init test
Initialized empty Git repository in /home/sverre/code/test/.git/
sverre@laptop-sverre:~/code
$ cd test/
sverre@laptop-sverre:~/code/test
$ echo "content" > foo
sverre@laptop-sverre:~/code/test
$ git add foo
sverre@laptop-sverre:~/code/test
$ git commit -m "Initial"
[master (root-commit) 9d48240] Initial
 1 files changed, 1 insertions(+), 0 deletions(-)
 create mode 100644 foo
sverre@laptop-sverre:~/code/test
$ echo "second line" >> foo
sverre@laptop-sverre:~/code/test
$ git commit -am "Proper second modification"
[master 8367122] Proper second modification
 1 files changed, 1 insertions(+), 0 deletions(-)
sverre@laptop-sverre:~/code/test
$ cd ..
sverre@laptop-sverre:~/code
$ git clone test/ foo
Cloning into foo...
done.
sverre@laptop-sverre:~/code
$ cd test/
sverre@laptop-sverre:~/code/test
$ echo "and a third" >> content
sverre@laptop-sverre:~/code/test
$ git commit --amend -am "Tampered second modification"
[master 87d8e8a] Tampered second modification
 1 files changed, 1 insertions(+), 0 deletions(-)
sverre@laptop-sverre:~/code/test
$ cd ../foo/
sverre@laptop-sverre:~/code/foo
$ git pull
remote: Counting objects: 5, done.
remote: Total 3 (delta 0), reused 0 (delta 0)
Unpacking objects: 100% (3/3), done.
From /home/sverre/code/test
 + 8367122...87d8e8a master     -> origin/master  (forced update)
Merge made by recursive.

-- 
Cheers,

Sverre Rabbelier

Re: What happens if someone modifies repository without me knowing?

[Ilari Liusvaara]

On Sun, Sep 26, 2010 at 09:07:29PM +0200, Manuel Reimer wrote:
> Hello,
> 
> let's assume someone got access to the GIT server of my hoster and
> tries to hide a change within an old commit, done by me.

Commits can not be modified once created. So the attacker would have to
recreate that commit with nasty modifications and then recreate every commit
since. 
 
> How will GIT tell me about this hidden change? Will a "git pull"
> just bring this change into my working copy, whithout telling me
> about the change?

At least after git pull, the history will look very odd if displayed
graphically...

-Ilari