Today I saw a rumor in the community that Linus Torvalds was involved in the $zailgo project, and it also included a github link : https://github.com/notwedtm/zailgo
I was quite surprised to see this news. Who is Linus Torvalds? Lets take a look at the introduction on the wiki:
Linus Torvalds is the author of the Linux kernel, and the open source project git also belongs to him. It is really puzzling why such an ancient giant would come to web3 to participate in a small project. There is only one truth, let us find it.
Let’s click “commit” first to see what Giant God submitted:
After clicking it, you will find that the status of this commit is Unverified, indicating that this commit has not been verified.
We can also see a prompt by clicking this status that Linus Torvalds did not sign with his public key.
How is this submission forged? In fact, it is very simple. GitHub only needs GIT_AUTHOR_NAME, GIT_AUTHOR_EMAIL and other fields to record the owner of the submission information. So can we forge this information?
Lets do an experiment and set several related environment variables. These are all public information from Linus Torvalds:
export GIT_AUTHOR_NAME=Linus Torvalds
export GIT_AUTHOR_EMAIL=torvalds@linux-foundation.org
export GIT_COMMITTER_NAME=Linus Torvalds
export GIT_COMMITTER_EMAIL=torvalds@linux-foundation.org
Then we change some content in the source file and commit it. Lets see what the log is:
The top one is the information I tested. You can see that the author information in the log has become Linus Torvalds. At this time, if I want to submit, it will be displayed on GitHub that Linus Torvalds participated in this project. The second information is the fake information we currently see on GitHub.
So how do we judge this kind of fake submission? There are several ways:
1. Click on commit to see the status of the current commit. If it is a real commit, there will be nothing in the status. If it is a fake, the above Unverified will appear.
2. We can also go to Linus Torvalds github homepage to see what projects he has contributed to. His github is https://github.com/torvalds . In Contribution activity, we can see that zailgo is not one of the projects he has participated in.
3. The administrator of the project can see the detailed submission log, and the forgers information can also be found at this time, but we do not have management authority.
The Zailgo project is a good project, but it is unacceptable to falsify information for publicity. Everyone should also be careful not to be deceived by such fake news.
