01. Git Internals: Blobs, Trees, Commits & Annotated Tags (The .git Directory Anatomy) • Git, System Design & Web Security (OWASP Top 10) • Rishabh Ki Kaksha

Git, System Design & Web Security (OWASP Top 10) › 01. Git Internals: Blobs, Trees, Commits & Annotated Tags (The .git Directory Anatomy)

40 mins

Course Syllabus

Module 1: Git Internals, Plumbing Commands & DAG Graph Architecture

01. Git Internals: Blobs, Trees, Commits & Annotated Tags (The .git Directory Anatomy) 02. Git DAG (Directed Acyclic Graph) & Plumbing Commands (cat-file, hash-object, write-tree) 03. Git Three Trees Architecture: Working Directory, Staging Index & HEAD

Part 1: Git Mastery, Security Defense & Caching

Module 2: Advanced Branching Strategies & Disaster Recovery

04. Advanced Rebasing: Interactive Rebase (squash, edit, fixup) vs Merge 05. Git Disaster Recovery: git reflog, Cherry-Pick & Recovering Deleted Commits/Branches 06. Enterprise Branching: Trunk-Based Development vs GitFlow vs Feature Flag Architecture

Module 3: Web Application Security: OWASP Top 10 Defenses

07. OWASP #1 & #3: SQL Injection (SQLi) & Server-Side Request Forgery (SSRF) Hardening 08. Cross-Site Scripting (XSS): Stored, Reflected, DOM-based & Content Security Policy (CSP) 09. CSRF vs Cross-Origin Traps: SameSite Cookies, Anti-CSRF Tokens & CORS Preflight Rules 10. Broken Object-Level Authorization (BOLA/IDOR) & Role-Based Access Control (RBAC/ABAC)

Module 4: Cryptography, PKI, SSL/TLS & Mutual Auth (mTLS)

11. Asymmetric Cryptography (RSA vs ECC) & Digital Signatures with GPG Keys 12. Public Key Infrastructure (PKI), TLS 1.3 Handshake & Let's Encrypt Automation 13. Mutual TLS (mTLS) for Zero-Trust Service-to-Service Communication

Module 5: DevSecOps, Secret Scanning & Zero-Trust Security Architecture

14. Automated Secret Scanning (Gitleaks, Trufflehog) & Git Pre-Commit Hooks 15. Software Supply Chain Security: Dependabot, SBOM (Software Bill of Materials) & Signed Commits 16. Enterprise Zero-Trust Architecture: Cloud IAM, Bastion Hosts & WireGuard VPN Networks

Interactive Lesson Studio

# 01. Git Internals: Blobs, Trees, Commits & Annotated Tags (The .git Directory Anatomy)

> Git & Web Security Notes by Rishabh - Topic 01

---

### 1. Git Is a Content-Addressable Key-Value Store 🗄️

Git koi magic nahi hai — internally ye ek C-based **Content-Addressable Key-Value Object Store** hai!
*   **Key:** 40-character SHA-1 (ya SHA-256) Hexadecimal Hash (e.g. `e69de29bb2d1d6434b8b29ae775ad8c2e48c5391`).
*   **Value:** Zlib-compressed binary object stored under `.git/objects/`.

```
.git/
 ├── HEAD                 (Points to active branch: ref: refs/heads/main)
 ├── config               (Repository-specific configuration)
 ├── index                (Binary Staging Area tracking SHA1s and file paths)
 ├── refs/                (Pointers to commits: heads/main, tags/v1.0)
 └── objects/             (The immutable Object Database!)
      ├── e6/9de29bb2...  (First 2 chars = directory, remaining 38 = file)
      └── ...
```

---

### 2. The 4 Fundamental Git Objects 🧱

1. **Blob (Binary Large Object):** Sirf file ka raw content store karta hai (File name aur permissions blob me store NAHI hote!).
2. **Tree:** Directory structure represent karta hai; file names, file modes (`100644` standard, `100755` executable) aur unke respective Blobs/Sub-trees ke SHA1 pointers rakhta hai.
3. **Commit:** Top-level Root Tree SHA1, Parent Commit SHA1, Author, Committer, Timestamp, aur Commit Message ka immutable cryptographic record.
4. **Annotated Tag:** Specific commit pointer with dedicated tagger name, date, message aur optional GPG signature.

```
[ Commit Object (SHA: 4a2b...) ]
   ├── Root Tree (SHA: 9f1c...)
   │      ├── README.md ➔ [ Blob Object (SHA: a1b2...) ]
   │      └── src/      ➔ [ Sub-Tree Object (SHA: 8e3d...) ]
   │                            └── index.js ➔ [ Blob Object (SHA: c3d4...) ]
   ├── Parent Commit: (SHA: 1e0f...)
   └── Author / Message: "Initial Commit"
```

---

### 3. Master Comparison Matrix

| Object Type | Stores Content? | Stores File Name? | Stores Parent Pointers? |
| :--- | :--- | :--- | :--- |
| **Blob** | ✅ Yes (Raw File Data) | ❌ No | ❌ No |
| **Tree** | ❌ No (Directory Map) | ✅ **Yes (Path & Mode)** | ❌ No |
| **Commit** | ❌ No (References Tree) | ❌ No | ✅ **Yes (Parent SHA1)** |
| **Tag** | ❌ No (Metadata) | ❌ No | ✅ Single target commit |

---

### 4. Interview Ke 3 Sawal Is Topic Se

1. **Agar repo me 10 identical files hon (different names par same content), toh Git kitne Blobs create karega?** -> Exactly 1 Blob! Kyunki Git content-addressable hai, isliye identical content ka SHA-1 same banta hai; Tree object me alag-alag file names same single Blob SHA-1 ko point karte hain (Huge disk space savings!).
2. **`.git/objects/` folder me 2-character subdirectories kyu hoti hain?** -> File system performance optimization ke liye; ek hi directory me lakho files hone par OS directory index seek slow ho jata hai, isliye pehle 2 hex characters se 256 subdirectories banayi jaati hain.
3. **Detached HEAD state ka kya matlab hota hai?** -> Jab `HEAD` kisi named branch pointer (`refs/heads/main`) ke badle direct kisi specific raw Commit SHA1 ko point kar raha hota hai.

---
**Next Topic:** 02. Git DAG (Directed Acyclic Graph) & Plumbing Commands (cat-file, hash-object, write-tree)

Loading lesson content...

Python 3.12

Full IDE

Live Execution Terminal

Click "Execute Live" to run code.
                

Lesson Mastery AI Quiz

AI Doubt Solver

CERTIFICATE OF COMPLETION

Rishabh Gehlot

PHP 8+ & Laravel 11 Master Track