gittuf
Git
| gittuf | Git | |
|---|---|---|
| 3 | 289 | |
| 419 | 50,711 | |
| 21.7% | 1.5% | |
| 9.6 | 10.0 | |
| 3 days ago | 3 days ago | |
| Go | C | |
| Apache License 2.0 | GNU General Public License v3.0 or later |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
gittuf
- A Security Layer for Git
-
Git Branches: Intuition and Reality
It actually does but it's very much in alpha/active development (under the umbrella of OpenSSF with the intent of being integrated into mainline git eventually).
https://github.com/gittuf/gittuf
-
Gittuf – a security layer for Git using some concepts introduced by TUF
Hey Will, thanks!
The paper is from quite a few years ago now and the reference is for a subset of gittuf's threat model, specifically the metadata manipulation / reference state attacks. The paper talks about MITM as one way to carry out a ref state attack, but if you're communicating with a compromised repository, you can be a victim of such an attack even if you're using authenticated transport and using signed commits / tags that you have a way of verifying.
We do have a threat model for gittuf that we've been meaning to add [0] to the design doc. I'll try and get that done today. It should probably be in there before we tag our alpha release. :)
[0] https://github.com/gittuf/gittuf/issues/95
Git
-
Getting Started with GitHub CLI: A Quick Guide to Installation and Usage
When you have the necessary dependencies, you can obtain the latest tagged Git release from several sources. The tarball is available at the kernel.org site (https://www.kernel.org/pub/software/scm/git) or the GitHub mirror (https://github.com/git/git/tags). The GitHub page typically provides clearer visibility into the latest version, while the kernel.org site offers release signatures for download verification.
- Git RCE affects recursive clones on case-insensitive filesystems with symlinks
- Git tracks itself. See it's first commit of itself
-
Resistance against London tube map commit history (a.k.a. git merge hell) (2015)
Look at any PR/patch series that got merged into the Git project. https://github.com/git/git/
Any random one. Because those that did not meet the minimum criteria for a well-crafted history would not have passed review.
- GitHub Git Mirror Down
- Four ways to solve the "Remote Origin Already Exists" error.
-
So You Think You Know Git – Git Tips and Tricks by Scott Chacon
Boy, I can't find this either (but also, the kernel mailing list is _really_ difficult to search). I really remember Linus saying something like "it's not a real SCM, but maybe someone could build one on top of it someday" or something like that, but I cannot figure out how to find that.
You _can_ see, though, that in his first README, he refers to what he's building as not a "real SCM":
https://github.com/git/git/commit/e83c5163316f89bfbde7d9ab23...
- Maintain-Git.txt
-
Git Commit Messages by Jeff King
Here is the direct link, as HN somehow removes the query string: https://github.com/git/git/commits?author=peff&since=2023-10...
- Git commit messages by Jeff King
What are some alternatives?
gitsign - Keyless Git signing using Sigstore
scalar - Scalar: A set of tools and extensions for Git to allow very large monorepos to run on Git without a virtualization layer
attestation - in-toto Attestation Framework
PineappleCAS - A generic computer algebra system targeted for the TI-84+ CE calculators
build-extra - Additional files and scripts to help build Git for Windows on MSYS2.
Subversion - Mirror of Apache Subversion
git-secret - :busts_in_silhouette: A bash-tool to store your private data inside a git repository.
vscode-gitlens - Supercharge Git inside VS Code and unlock untapped knowledge within each repository — Visualize code authorship at a glance via Git blame annotations and CodeLens, seamlessly navigate and explore Git repositories, gain valuable insights via rich visualizations and powerful comparison commands, and so much more
go-tuf - Go implementation of The Update Framework (TUF)
linux - Linux kernel source tree
example
chromebrew - Package manager for Chrome OS [Moved to: https://github.com/chromebrew/chromebrew]