2

If someone goes into git and rewrites the history post commit to update the author and date information, is there a way to find that someone ran this history update command?

For example: Developer Joe checks in code. Joe doesn't want to be associated with that checkin, so he goes and updates history to show that Jane actually checked in the code. Can I find out that this change was made by Joe?

Is there a git history of all commands run or anything?

EDIT: I should note I did find and try git reflog as noted here: History or log of commands executed in Git, but it doesn't seem to show all commands, only certain ones.

Community
  • 1
  • 1
John S.
  • 1,937
  • 2
  • 18
  • 28

1 Answers1

2

If you run commands like git log with --format=fuller, you will see two distinct dates:

commit 8140a5fb82480b585c9fe3be320fb2b73cd607a3
Author:     Matthieu Moy <Matthieu.Moy@imag.fr>
AuthorDate: Tue Apr 28 18:25:22 2015 +0200
Commit:     Matthieu Moy <Matthieu.Moy@imag.fr>
CommitDate: Tue Apr 28 18:25:35 2015 +0200

When creating a commit with git commit, Author and Commit are the same thing. But when you rewrite history, the Author field is not modified while the Commit corresponds to the last rewrite or patch application. Another situation where Author is different from Commit is when you apply a patch (git send-email + git am).

However, if a malicious user wants to rewrite the Author field, he or she can do so, and there will be no reliable way to find out afterwards.

Matthieu Moy
  • 15,151
  • 5
  • 38
  • 65