Git files hidden in plain sight 🫥
Tyler Cipriani Posted

I doubt that it is a good practice to ship the public key used to sign things in the repository in the repository itself

– Junio C Hamano, git@vger.kernel.org: expired key in junio-gpg-pub

Git ships with the maintainer’s public key.

But you won’t find it in your worktree—it’s hidden in plain sight.

Junio Hamano’s public key is a blob in the git object database. It’s tagged with junio-gpg-pub, so you can only see it with git cat-file:

(/^ヮ^)/*:・゚✧ git cat-file blob junio-gpg-pub
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1
...

In 2021, Junio pretty much said that this was a bad idea.

But it led me to think about some other wonderful bad ideas.

Fake empty GitHub repos 📦

I made an empty GitHub repo called hidden-zangief.

hidden-zangief

Except it’s not empty.

Instead, it’s chockfull of sweet ANSI art—Zangief from Street Fighter II.

Zangief + Figlet = magic

And if you clone it, after an initial warning, you can see Zangief is still in there:

(/^ヮ^)/*:・゚✧ git clone https://github.com/thcipriani/hidden-zangief && cd hidden-zangief
Cloning into 'hidden-zangief'...
warning: You appear to have cloned an empty repository.
(/^ヮ^)/*:・゚✧ git fetch origin refs/atomic/piledriver
remote: Enumerating objects: 1, done.
remote: Counting objects: 100% (1/1), done.
remote: Total 1 (delta 0), reused 1 (delta 0), pack-reused 0
Unpacking objects: 100% (1/1), 1.71 KiB | 1.71 MiB/s, done.
From https://github.com/thcipriani/hidden-zangief
 * branch            refs/atomic/piledriver -> FETCH_HEAD
(/^ヮ^)/*:・゚✧ git show FETCH_HEAD

                        [...sweet zangief ansi art...]
                        _____                 _       __ 
                       |__  /__ _ _ __   __ _(_) ___ / _|
                         / // _` | '_ \ / _` | |/ _ \ |_ 
                        / /| (_| | | | | (_| | |  __/  _|
                       /____\__,_|_| |_|\__, |_|\___|_|  
                                        |___/        

Dubious git plumbing hacks 🪓

Inspired by Junio, I misused and finagled a couple of git plumbing commands to make this fake empty repo:

  1. git hash-object
  2. git update-ref

First, I used hash-object to create a dangling git object with the ~/zangief.txt contents.

(/^ヮ^)/*:・゚✧ mkdir /tmp/hidden-zangief && cd /tmp/hidden-zangief
(/^ヮ^)/*:・゚✧ git init
(/^ヮ^)/*:・゚✧ git hash-object -w ~/zangief.txt
7dd9e2d2d2d8b5107d225b4708e1177abb08e7c8

Now Zangief is lurking in your git plumbing, atomic-suplexing your other git objects.

I imagine this is how Junio added his public key to the git object database. Then he tagged it with junio-gpg-pub and pushed it to the git repo.

But a tag would appear in the GitHub UI, and I wondered whether I could hide it.

So I opted to abuse the wide-open git ref namespace, imagining a ref beyond tags and branches: refs/atomic/piledriver.

Then I schlepped that ref to GitHub.

(/^ヮ^)/*:・゚✧ git update-ref refs/atomic/piledriver 7dd9e2d2d2d8b5107d225b4708e1177abb08e7c8
(/^ヮ^)/*:・゚✧ git remote add origin https://github.com/thcipriani/hidden-zangief
(/^ヮ^)/*:・゚✧ git push origin refs/atomic/piledriver:refs/atomic/piledriver

And, of course, Microsoft GitHub foolishly neglects the refs/atomic/* namespace in their UI, rendering our 400 lb wrestler friend invisible.

Infinite magic awaits the intrepid developer willing to abuse git plumbing. After all, git is just a database with a terrible interface.

Review: Beepy, the pocket-sized, linux-powered cyberdeck
Tyler Cipriani Posted

THIS IS NOT A REAL FINISHED PRODUCT.

Erohead, birther of Beepy

The SQFMI Beepy alongside my cat printer

The Beepy is a handheld Linux console designed by artists and built for nerds.

From the first announcement, Beepy’s creator—SQFMI—was candid about the device’s lack of polish.

“Buyer beware!” was a direct quote.

But I snagged one anyway. And so far, the punishment has been minor.

What I dislike

Day one: I breezed through the “Getting Started” docs and readied myself for hacking.

Then the keyboard wailed “aaaaaaaaaa” at me until I rebooted.

Day one: The spirit trapped in the Beepy keyboard cries for freedom.

Off to a bad start.

Undeterred, I took to the Beepy Discord, where I found solace among other new and confused Beepy owners.

The Beepy Discord

Thanks to the active Discord community, I was clued into to the fix: downgrade all the things.1

While this experience was bumpy, everyone in the discord was helpful and awesome—I’m grateful for all the volunteers assisting us wayward nerds.

I’ve contributed some pending documentation changes to pay it forward.

What I like

The idea of a breakable computer was important to us.

– Eben Upton, CEO, Raspberry Pi Ltd

The Beepy is scrappy—an ideal platform for hacking and tinkering.

The form factor inspired some fun ideas for me:

  1. gphoto2 intervalometer for my camera (a compact version of what I used for the last solar eclipse)
  2. Catprinter-powered low-fi photobooth
  3. Ham radio fox hunting with retrogram~rtlsdr
  4. Distraction-free RSS reader and podcasting device via newsboat

Sure, I could do all these things with termux on my phone.

But something about the cold monolithic slab of modern smartphones feels considerably less cyberpunk—you’ll never hack an ATM ála Terminator 2 with a smartphone.

The keyboard is clicky and satisfying. Key chording gets you all the characters you need to use the terminal.

Bonus points for the stellar ASCII-art key chord documentation.

Plus, it’s a delightful Frankenstein’s monster of off-the-shelf parts:

As Hackaday already pointed out—the parts alone make the Beepy a screaming deal at $99.

Final verdict

The PocketCHIP next to its spiritual successor

I’m a sucker for pocket-sized Linux devices. And a glutton for a certain kind of punishment.

The Beepy is not a finished product, but that’s the whole point.

It scratches an itch I’ve always had: the desire to hack alongside like-minded nerds, all tilting at our joyless monolithic slabs.


  1. - Install the old firmware from here: https://github.com/sqfmi/i2c_puppet/raw/df121c7273a204f17f0d21b28f48cd938787216b/i2c_puppet.uf2
    - Set up a new sd card and boot Beepy. Wait until it finishes resizing its partition then connect via ssh.
    - Run this setup script which installs the latest sharp drm driver and the old keyboard driver: `curl -s https://raw.githubusercontent.com/TheMediocritist/beepy_setup/main/temp_beepy_setup.sh | bash`

    The “Downgrade all the things” fix, for posterity, via the Beepy Discord↩︎

Aug 2023
S M T W T F S