Tamper detection system for DI/OT build system
Following #72 (closed), in this MR I propose a tamper detection system. This system leverages git's file status detection to discover which files, that were already present in the system, were modified. As we also provide some files that the user is free to modify, these can be specified on the .tamperignore
file present in the root of the repository. This file has a similar behavior to git's .gitignore
file.
When the system (during compilation) detects tampering, it prints a red message on the terminal. For example:
As shown in the image, this system is also able to track if new patches were introduced to the project, and alert as well.
As new entry points for users are added, they should be specified on appropriate .tamperignore
. The gold standard hash should also be updated before creating a user release.
MR left on draft to discuss the tag/commit hash that should be used as ground truth for this system. System checks for changes comparing to the most recent tag.