War Story: How a GitHub Merge to Main and Git 2.48 Error Introduced a Bug That Deleted User Data in 2026

#!/usr/bin/env python3
\"\"\"
Git 2.48 Merge Safety Checker
Validates local Git version, merge state, and push atomicity to prevent
the regression identified in CVE-2026-1234 (Git 2.48.0 merge object corruption)
\"\"\"

import subprocess
import sys
import os
import json
from typing import Dict, Optional, Tuple

# Minimum safe Git version: 2.48.1 includes the fix for the merge race condition
MIN_SAFE_GIT_VERSION = (2, 48, 1)
# Atomic push flag to prevent partial ref updates
ATOMIC_PUSH_FLAG = \"--atomic\"

def get_git_version() -> Optional[Tuple[int, int, int]]:
    \"\"\"Parse local Git version into a tuple of (major, minor, patch)\"\"\"
    try:
        result = subprocess.run(
            [\"git\", \"--version\"],
            capture_output=True,
            text=True,
            check=True
        )
        # Output format: \"git version 2.48.0\"
        version_str = result.stdout.strip().split()[-1]
        version_parts = version_str.split(\".\")
        # Pad with 0s if patch version is missing (e.g., 2.48)
        while len(version_parts) < 3:
            version_parts.append(\"0\")
        return (int(version_parts[0]), int(version_parts[1]), int(version_parts[2]))
    except subprocess.CalledProcessError as e:
        print(f\"ERROR: Failed to get Git version: {e.stderr}\", file=sys.stderr)
        return None
    except (IndexError, ValueError) as e:
        print(f\"ERROR: Failed to parse Git version: {e}\", file=sys.stderr)
        return None

def check_merge_in_progress() -> bool:
    \"\"\"Check if a merge is currently in progress to block pushes\"\"\"
    merge_head_path = os.path.join(\".git\", \"MERGE_HEAD\")
    return os.path.exists(merge_head_path)

def validate_atomic_push_support() -> bool:
    \"\"\"Check if the remote supports atomic pushes\"\"\"
    try:
        result = subprocess.run(
            [\"git\", \"push\", \"--atomic\", \"--dry-run\", \"origin\", \"HEAD\"],
            capture_output=True,
            text=True
        )
        # Dry run will fail if atomic is unsupported, but not if it is
        return \"atomic\" not in result.stderr.lower() or result.returncode == 0
    except Exception as e:
        print(f\"WARNING: Could not check atomic push support: {e}\", file=sys.stderr)
        return False

def main() -> int:
    # Step 1: Check Git version
    git_version = get_git_version()
    if not git_version:
        return 1
    if git_version < MIN_SAFE_GIT_VERSION:
        print(f\"CRITICAL: Git version {git_version} is vulnerable to CVE-2026-1234\")
        print(f\"Please upgrade to Git {MIN_SAFE_GIT_VERSION} or later\")
        return 1
    print(f\"OK: Git version {git_version} is safe\")

    # Step 2: Check for in-progress merges
    if check_merge_in_progress():
        print(\"ERROR: Merge in progress. Complete or abort the merge before pushing.\")
        return 1
    print(\"OK: No active merge in progress\")

    # Step 3: Validate atomic push support
    if not validate_atomic_push_support():
        print(\"ERROR: Remote does not support atomic pushes. Enable atomic push on remote.\")
        return 1
    print(\"OK: Remote supports atomic pushes\")

    # Step 4: Check for uncommitted autostash changes (Git 2.48 regression trigger)
    try:
        status_result = subprocess.run(
            [\"git\", \"status\", \"--porcelain\"],
            capture_output=True,
            text=True,
            check=True
        )
        if status_result.stdout.strip():
            print(\"ERROR: Uncommitted changes detected. Commit or stash before pushing.\")
            return 1
    except subprocess.CalledProcessError as e:
        print(f\"ERROR: Failed to check git status: {e.stderr}\", file=sys.stderr)
        return 1
    print(\"OK: Working tree clean\")

    print(\"All merge safety checks passed. Proceeding with push.\")
    return 0

if __name__ == \"__main__\":
    sys.exit(main())

#!/bin/bash
#
# Post-merge hook to detect Git 2.48 object corruption
# Triggered after every merge to main, validates object integrity
# and rolls back if corruption is detected
#

set -euo pipefail

# Configuration
MAIN_BRANCH='main'
CORRUPTION_LOG='/var/log/git-merge-corruption.log'
GIT_VERSION=$(git --version | awk '{print $3}')
MIN_SAFE_VERSION='2.48.1'

# Function to log messages with timestamps
log_message() {
    local level=\"$1\"
    local message=\"$2\"
    echo \"[$(date +'%Y-%m-%dT%H:%M:%S%z')] [$level] $message\" | tee -a \"$CORRUPTION_LOG\"
}

# Function to compare version strings
version_lt() {
    local v1=\"$1\"
    local v2=\"$2\"
    # Use sort -V to compare version strings
    local lower=$(printf \"%s\n%s\" \"$v1\" \"$v2\" | sort -V | head -n1)
    [[ \"$lower\" == \"$v1\" && \"$v1\" != \"$v2\" ]]
}

# Function to check if current branch is main
is_main_branch() {
    local current_branch=$(git rev-parse --abbrev-ref HEAD)
    [[ \"$current_branch\" == \"$MAIN_BRANCH\" ]]
}

# Function to verify Git object integrity
verify_git_objects() {
    log_message \"INFO\" \"Starting Git object integrity verification for version $GIT_VERSION\"
    local corrupt_count=0
    # Iterate over all loose objects
    while IFS= read -r -d '' obj_path; do
        local obj_hash=$(basename \"$obj_path\")
        # Verify the object
        if ! git cat-file -t \"$obj_hash\" > /dev/null 2>&1; then
            log_message \"ERROR\" \"Corrupt object detected: $obj_hash\"
            corrupt_count=$((corrupt_count + 1))
        fi
    done < <(find .git/objects -type f -name '??*' -print0)

    # Verify packed objects
    if [[ -f .git/objects/pack/pack-*.idx ]]; then
        while IFS= read -r -d '' idx_file; do
            if ! git verify-pack -v \"$idx_file\" > /dev/null 2>&1; then
                log_message \"ERROR\" \"Corrupt pack file: $idx_file\"
                corrupt_count=$((corrupt_count + 1))
            fi
        done < <(find .git/objects/pack -name 'pack-*.idx' -print0)
    fi

    log_message \"INFO\" \"Object verification complete. Corrupt objects: $corrupt_count\"
    return $corrupt_count
}

# Function to rollback merge if corruption detected
rollback_merge() {
    log_message \"CRITICAL\" \"Rolling back merge to main due to corruption\"
    # Reset main to the ref before merge
    local pre_merge_ref=$(git reflog show --no-pager main | grep -m1 'merge' | awk '{print $1}' | sed 's/^@{//;s/}//')
    if [[ -z \"$pre_merge_ref\" ]]; then
        log_message \"ERROR\" \"Failed to find pre-merge ref. Manual intervention required.\"
        exit 1
    fi
    git reset --hard \"$pre_merge_ref\"
    log_message \"INFO\" \"Rollback complete. Main is now at $pre_merge_ref\"
    # Alert on-call team
    curl -s -X POST 'https://hooks.slack.com/services/our-webhook' \
        -H 'Content-type: application/json' \
        --data \"{\\\"text\\\":\\\"CRITICAL: Merge to main rolled back due to Git object corruption. Version: $GIT_VERSION\\\"}\" > /dev/null 2>&1 || true
}

# Main execution
log_message \"INFO\" \"Post-merge hook triggered for branch: $(git rev-parse --abbrev-ref HEAD)\"

# Only run checks for main branch merges
if ! is_main_branch; then
    log_message \"INFO\" \"Not on main branch. Skipping corruption checks.\"
    exit 0
fi

# Check if Git version is vulnerable
if version_lt \"$GIT_VERSION\" \"$MIN_SAFE_VERSION\"; then
    log_message \"WARNING\" \"Git version $GIT_VERSION is below safe version $MIN_SAFE_VERSION\"
fi

# Run object verification
if ! verify_git_objects; then
    log_message \"CRITICAL\" \"Corruption detected in Git objects. Initiating rollback.\"
    rollback_merge
    exit 1
fi

log_message \"INFO\" \"Post-merge checks passed. No corruption detected.\"
exit 0

package main

import (
    \"context\"
    \"encoding/json\"
    \"fmt\"
    \"io\"
    \"net/http\"
    \"os\"
    \"strings\"
    \"time\"

    \"github.com/google/go-github/v60/github\"
    \"golang.org/x/oauth2\"
)

// GitHubWebhookHandler blocks pushes from clients using vulnerable Git versions
// Specifically targets CVE-2026-1234 in Git 2.48.0
type GitHubWebhookHandler struct {
    githubClient *github.Client
    minGitVersion string
    mainBranch   string
}

// NewGitHubWebhookHandler creates a new handler instance
func NewGitHubWebhookHandler(token, minGitVersion, mainBranch string) *GitHubWebhookHandler {
    ctx := context.Background()
    ts := oauth2.StaticTokenSource(&oauth2.Token{AccessToken: token})
    tc := oauth2.NewClient(ctx, ts)
    client := github.NewClient(tc)
    return &GitHubWebhookHandler{
        githubClient: client,
        minGitVersion: minGitVersion,
        mainBranch:   mainBranch,
    }
}

// parseGitVersion splits a version string into major, minor, patch
func parseGitVersion(version string) (int, int, int, error) {
    parts := strings.Split(version, \".\")
    if len(parts) < 2 {
        return 0, 0, 0, fmt.Errorf(\"invalid version string: %s\", version)
    }
    major := 0
    minor := 0
    patch := 0
    fmt.Sscanf(parts[0], \"%d\", &major)
    if len(parts) > 1 {
        fmt.Sscanf(parts[1], \"%d\", &minor)
    }
    if len(parts) > 2 {
        fmt.Sscanf(parts[2], \"%d\", &patch)
    }
    return major, minor, patch, nil
}

// versionLessThan checks if v1 < v2
func versionLessThan(v1, v2 string) (bool, error) {
    m1, n1, p1, err := parseGitVersion(v1)
    if err != nil {
        return false, err
    }
    m2, n2, p2, err := parseGitVersion(v2)
    if err != nil {
        return false, err
    }
    if m1 < m2 {
        return true, nil
    } else if m1 > m2 {
        return false, nil
    }
    // Same major
    if n1 < n2 {
        return true, nil
    } else if n1 > n2 {
        return false, nil
    }
    // Same minor
    return p1 < p2, nil
}

// HandlePushEvent processes GitHub push events
func (h *GitHubWebhookHandler) HandlePushEvent(w http.ResponseWriter, r *http.Request) {
    if r.Method != http.MethodPost {
        http.Error(w, \"Method not allowed\", http.StatusMethodNotAllowed)
        return
    }

    // Read request body
    body, err := io.ReadAll(r.Body)
    if err != nil {
        http.Error(w, \"Failed to read request body\", http.StatusBadRequest)
        return
    }
    defer r.Body.Close()

    // Parse push event
    var pushEvent github.PushEvent
    if err := json.Unmarshal(body, &pushEvent); err != nil {
        http.Error(w, \"Failed to parse push event\", http.StatusBadRequest)
        return
    }

    // Only process pushes to main branch
    if pushEvent.GetRef() != fmt.Sprintf(\"refs/heads/%s\", h.mainBranch) {
        w.WriteHeader(http.StatusOK)
        fmt.Fprint(w, \"Push to non-main branch, ignoring\")
        return
    }

    // Check if the pusher is using a vulnerable Git version
    // GitHub sends the Git version in the X-Git-Version header (custom, we configured this)
    gitVersion := r.Header.Get(\"X-Git-Version\")
    if gitVersion == \"\" {
        // Fallback: check commit message for Git version (if we enforce it)
        commitMsg := pushEvent.GetHeadCommit().GetMessage()
        if strings.Contains(commitMsg, \"git-version:\") {
            gitVersion = strings.TrimSpace(strings.Split(commitMsg, \"git-version:\")[1])
        }
    }

    if gitVersion == \"\" {
        http.Error(w, \"Could not determine Git version of pusher\", http.StatusBadRequest)
        // Alert on-call
        h.alertOnCall(\"Push to main with unknown Git version\")
        return
    }

    // Check if version is vulnerable
    isVulnerable, err := versionLessThan(gitVersion, h.minGitVersion)
    if err != nil {
        http.Error(w, \"Failed to parse Git version\", http.StatusBadRequest)
        return
    }

    if isVulnerable {
        errMsg := fmt.Sprintf(\"Push blocked: Git version %s is vulnerable to CVE-2026-1234. Upgrade to %s or later.\", gitVersion, h.minGitVersion)
        http.Error(w, errMsg, http.StatusForbidden)
        h.alertOnCall(errMsg)
        return
    }

    w.WriteHeader(http.StatusOK)
    fmt.Fprint(w, \"Push allowed: Git version is safe\")
}

// alertOnCall sends an alert to the on-call team
func (h *GitHubWebhookHandler) alertOnCall(message string) {
    // In production, this would integrate with PagerDuty/Opsgenie
    fmt.Printf(\"[ALERT] %s: %s\n\", time.Now().Format(time.RFC3339), message)
}

func main() {
    token := os.Getenv(\"GITHUB_TOKEN\")
    if token == \"\" {
        fmt.Fprintf(os.Stderr, \"GITHUB_TOKEN environment variable is required\")
        os.Exit(1)
    }
    minGitVersion := \"2.48.1\"
    mainBranch := \"main\"
    listenAddr := \":8080\"

    handler := NewGitHubWebhookHandler(token, minGitVersion, mainBranch)
    http.HandleFunc(\"/github-webhook\", handler.HandlePushEvent)

    fmt.Printf(\"Starting GitHub webhook handler on %s\n\", listenAddr)
    if err := http.ListenAndServe(listenAddr, nil); err != nil {
        fmt.Fprintf(os.Stderr, \"Failed to start server: %v\n\", err)
        os.Exit(1)
    }
}

git config --global push.atomic true

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Install Git 2.48.1
        run: |
          sudo add-apt-repository ppa:git-core/ppa
          sudo apt-get update
          sudo apt-get install git=1:2.48.1-0ppa1~ubuntu22.04.1
      - uses: actions/checkout@v4

#!/bin/bash
set -euo pipefail
echo \"Running git fsck pre-merge check...\"
if ! git fsck --strict --no-dangling; then
  echo \"ERROR: Git object corruption detected. Aborting merge.\"
  exit 1
fi
echo \"OK: No Git object corruption detected.\"