Re: .gitmodules security

Vincent Lefevre <[email protected]>
Newsgroups gmane.comp.gnu.libtool.general
Message-ID <[email protected]> 
On 2022-02-06 21:22:11 +0100, Vincent Lefevre wrote:
> The .gitmodules file contains:
> 
> [submodule "gnulib"]
>         path = gnulib
>         url = git://git.sv.gnu.org/gnulib.git
> [submodule "bootstrap"]
>         path = gl-mod/bootstrap
>         url = https://github.com/gnulib-modules/bootstrap.git
> 
> but AFAIK, there is no host authentication done with the "git:"
> protocol, so that this is vulnerable to MitM attacks.
> 
> How about changing this to https?

Additional details: i.e. https://git.savannah.gnu.org/git/gnulib.git
according to what is described on

  https://www.gnu.org/software/gnulib/

-- 
Vincent Lefèvre <[email protected]> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.