NJIT Innovator Enhances Git Security, Fortifies Software Development Ecosystem

NJIT Innovator Enhances Git Security, Fortifies Software Development Ecosystem

• Innovation Spotlight: NJIT’s Reza Curtmola co-developed gittuf, a tool that hardens Git security.
• Addressing Vulnerabilities: The software spreads trust so no single server or admin can quietly tamper with a repository.
• Industry Impact: Bloomberg is piloting it.
• Future Implications: It could change how code repositories handle trust.

A Git fix from NJIT and NYU

Git is the most common way programmers track their code, and it is getting harder to tamper with. NJIT computer science professor Reza Curtmola worked with NYU professor Justin Cappos and graduate students Aditya Yelgundhalli and Patrick Zielinski on gittuf, open-source software that distributes control over a repository’s policies and administration. Their paper, Rethinking Trust in Forge-Based Git Security, won a Distinguished Paper award in February at the Network and Distributed System Security symposium in San Diego.

Understanding the Vulnerabilities: The Threat to Repositories

Git repositories hold the code for a huge number of software projects. Services built on Git rely on central administration. Users have to trust the server without being able to verify what it does, so a compromised server, or even a plain software bug, can let tampered code undermine an entire project.

Pressing Need for Improved Security

Curtmola has pointed to a specific gap: a compromised Git server could change a policy to grant itself privileges, act, and then put the policy back, leaving little trace. The activity log has the same weakness. Users simply have to trust it.

Technological Advancements: How gittuf works

Gittuf borrows ideas from TUF, The Update Framework, and the name is a joke about getting tough on security. It decentralizes repository tracking, so no single person can rewrite the log of who did what and when. Policy enforcement is spread out too.

Core Features and Functionality

Every user can check for themselves whether a change was authorized. Nobody is trusted unconditionally. The team built it to be easy to adopt, since developers won’t change how they work just for security. The cost is small: some new software and perhaps a few extra milliseconds when pushing code.

Industry Impact: Changing the Software Development Landscape

Gittuf is already moving into real use. Dennis Roellke, a security architect at Bloomberg, is leading a pilot across several departments there, where the goal is software supply chain integrity across billions of lines of code.

Early adopters

Bloomberg’s team is scaling its gittuf interfaces for larger and more varied engineering groups. Curtmola says mixed environments, with some plain Git users and some gittuf users, still need study. Any issues found there will need fixing.

Looking Ahead: Paving the Way for Future Innovations

The paper lists future work: sharing gittuf roots across multiple repositories, removing the dependence on synchronization points and expanding a metadata layer that ties in with other security efforts.

What developers can do now

Organizations that depend on Git can watch the project and consider piloting it. Curtmola calls adoption mostly an administrative or political decision, and argues that for organizations facing a strong adversary the benefits far outweigh the small cost.

Why it matters for the supply chain

Securing one forge or one language ecosystem is relatively simple. Doing it consistently across many forges and many ecosystems is still unsolved, and that is the problem gittuf is aimed at. It is one step in the long work of protecting the software supply chain.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.