Create commit hooks which warn about private key material
@cfrantz is already working on this.
Since Feb 5, 2024.
- Dominant language
- SystemVerilog
- Stars
- 3.6k
- Forks
- 1.1k
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 141
Description
In the past, private key material has been accidentally exposed by submitting private keys into public codebases.
Example: This key is called the "test key" and its existence in a public repository allows anyone to sign code to run on a prior generation of security chip:
https://chromium.googlesource.com/chromiumos/platform/ec/+/ee86a8ce1f343186bcc545cd68d7ad54ec7f3ea6/util/signer/loader-testkey-A.pem
Although the above key does not confer any sort of prod authority to the user of that key, it effectively turns that prior generation of chip into an open sample.
We should have a commit-hook that warns about private key material and forbids commits without an explicit override from the committer. We have something like this in the "google3" codebase where submitting key material must be accompanied by a commit comment of the form `DISABLE_PRIVATE_KEY_CHECK=`.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.