bradfitz / gitbrute Goto Github PK

See line

This replaces the timestamps as decimal strings directly. If the number of digits in the unix timestamp changes during the brute-force attempt, this will incorrectly replace the string.

This is a minor issue, as it will only occur pre 2002 or in 2286. This would be especially applicable to #5 if git had been created back then.

Thoughts about sigining gitbruted commit?

This means that it checks defaults and error conditions causing it to either fail itself or making gitbrute fail to generate the correct commit.

Examples:

• If the existing commit has an empty commit message the commit fails and gitbrute throws away the error message (missing cmd.Stderr = os.Stderr line for the last bit)
• The user details of the current user overwrite the user details in the commit giving the wrong commit if different.
• Timezones !! (I think?)

I suggest using git hash-object -t commit -w --no-filters --stdin to create the commit object.

Then git update-ref refs/heads/gitbrute deadbeef26024c00b62f744f9dc0418c4ccd49b1 0000000000000000000000000000000000000000 to create a new branch (or error).

The first command generally never fails.
The second command will fail if the branch exists and you give it the zeros, but the commit still exists in the repository even then and the user can see it with git log deadbeef

This doesn't touch the work tree so it even works on a bare repository. Because of this you may also want to checkout the new branch afterwards. If you don't want to create a branch or it fails you can checkout the detached HEAD instead.