Version control

Version control developed in generations. SCCS (Marc Rochkind, Bell Labs, 1972) and RCS (Walter Tichy, 1982) versioned single files with locking; CVS (from 1986) and Subversion (2000) introduced a central server holding the history of whole projects, with atomic commits arriving in Subversion. Distributed systems - BitKeeper, then Git (created by Linus Torvalds in April 2005 after the Linux kernel lost its free BitKeeper licence) and Mercurial (also 2005) - give every clone the full history, making commits, branches and merges local operations. Git is now the de facto standard, hosted on platforms such as GitHub, GitLab, Bitbucket and Azure DevOps that add pull requests, reviews and access control on top.

Git's core is a content-addressed object store. A blob holds file content, a tree maps names and modes to blobs and subtrees, a commit points to one tree, zero or more parent commits, author and committer identities with timestamps, and a message; an annotated tag points to an object with its own metadata. Each object's ID is the hash of its content, historically SHA-1 (hardened with collision detection after the 2017 SHAttered collision), with a SHA-256 object format available since Git 2.29 but still little used because of interoperability limits. Because every commit hashes its parents, history forms a Merkle DAG: altering an old commit changes every descendant ID, which makes tampering evident to anyone holding the previous IDs. Branches and tags are merely named refs; merging uses a three-way merge against the common ancestor, while rebasing rewrites commits and therefore their IDs.

The hash chain proves integrity, not authorship: the author and committer fields are free text anyone can set. Signed commits and tags (OpenPGP, SSH keys since Git 2.34, or X.509 and Sigstore's gitsign) bind a commit to a key, and hosting platforms can require verified signatures on protected branches. Other controls are branch protection with required reviews and status checks, disabled force-pushes, CODEOWNERS files routing changes to accountable reviewers, and MFA or hardware keys for accounts with write access. NIST SSDF practice PS.1 asks producers to protect all forms of code from unauthorised access and tampering, and SLSA's Source track sets levels for such guarantees.

A frequent failure mode is committed secrets: deleting a file in a new commit leaves the credential in history and in every clone and fork, so the credential must be rotated, and history rewriting (git filter-repo) is only a secondary clean-up. Version control differs from backup, which restores state but carries no reviewed change history, and from GitOps, which uses a repository as the operational source of truth rather than just a record of change.