一句话：首次大规模测量 Git 公共仓库的历史改写，揭示其安全与治理风险，并发布检测工具 GitHistorian。
版本控制系统允许开发者本地重写历史，如重排或删除提交及数据；在公共分支上这会破坏推拉流程、影响仓库完整性与可复现性，并为供应链攻击提供机会。本文首次大规模调查公共代码仓库中的 Git 历史改写，利用能跨改写保留历史的 Software Heritage 归档，分析 1.11 亿个仓库。结果在 122 万仓库中发现 870 万条被改写历史，并按发生位置（仓库、分支）和改写内容（文件或提交元数据）分类。两个案例研究表明，改写常用于追溯性更改许可证或删除误提交的密钥等秘密，反映治理与安全管理的不良实践。作者实现 GitHistorian，帮助开发者发现并描述公开 Git 仓库中的历史改写。
Version Control Systems (VCS) like Git allow developers to locally rewrite recorded history, e.g., to reorder and suppress commits or specific data in them. These alterations have legitimate use cases, but become problematic when performed on public branches that have downstream users: they break push/pull workflows, challenge the integrity and reproducibility of repositories, and create opportunities for supply chain attackers to sneak into them nefarious changes.We conduct the first large-scale investigation of Git history alterations in public code repositories. We analyze 111 M (millions) repositories archived by Software Heritage, which preserves VCS histories even across alterations. We find history alterations in 1.22 M repositories, for a total of 8.7 M rewritten histories. We categorize changes by where they happen (which repositories, which branches) and what is changed in them (files or commit metadata).Conducting two targeted case studies we show that altered histories recurrently change licenses retroactively, or are used to remove "secrets" (e.g., private keys) committed by mistake. As these behaviors correspond to bad practices—in terms of project governance or security management, respectively—that software recipients might want to avoid, we introduce GitHistorian, an automated tool, that developers can use to spot and describe history alterations in public Git repositories.
DOI 原文 ·
@inproceedings{paperbot9344,
title = {Altered Histories in Version Control System Repositories: Evidence from the Trenches},
author = {Solal Rapaport and Laurent Pautet and Samuel Tardieu and Stefano Zacchiroli},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00181}
}