Secure and Tamper Proof Code Management
Jeremy Tate, T. Charles Clancy · 2014
In this paper, we present an additional layer of security to source code repositories by combining Keyless Signature Infrastructure (KSI) with Git to protect against insider threats as well as provide security even in the event of a private key compromise. This work was done to show the minimal effort required to integrate these two technologies to provide additional security to software development efforts using Git compared to the security benefit gained. Additionally, we designed the solution to minimize the impact to the current Git workflow, requiring no additional commands when committing code and only one new command to verify past commits.