# Solution
We have to reconstruct the original code by generating each of the commits in the commit history. Each commit's sha must exactly match each sha in the history. The commit messages give hints about the specific code change that need to be made.
### Commit 1
```commit 7cababac3f3499755d64cf216e237b6969dceddeAuthor: CTF Organizer <[email protected]>Date:   Wed Nov 1 09:36:47 2023 -0700
    Add hello example from https://go.dev/tour/welcome/1```
- Create a new directory that will contain our git repo and run `git init`.- The message says what code is needed for this commit. Go to the URL, copy the code, and notice the file name is `hello.go`. Add the code to a new file named `hello.go`, and then run `git add hello.go`.- To regenerate a commit with the same sha as the original, we have to set the author, email, date, and message to be the same as the example. See how to set the author, email, and date using environment variables as described in [Git Internals - Environment Variables](https://git-scm.com/book/en/v2/Git-Internals-Environment-Variables).- After adding `hello.go` and setting the environment variables appropriately, run `git commit -m "Add hello example from https://go.dev/tour/welcome/1"` to regenerate the commit with the same sha as the one in the history (`7201f4b76583397b0a363611da39dbf811ffe912`).
```gopackage main
import "fmt"
func main() {	fmt.Println("Hello, 世界")}```
### Commit 2
```commit 7f29b946f68f2cef5bbaab03cbe8049c64dbc29cAuthor: CTF Organizer <[email protected]>Date:   Wed Nov 1 09:47:39 2023 -0700
    I forgot how to run go code... go mod init ctf```
- Run `go mod init ctf`. You might need to install go if it's not already installed.- Set the environment variables appropriately and run `git commit` with the same message.- In order to get the correct sha, go version `1.21.3` must be used inside `go.mod`. This is not explicitly stated so we have to guess for it. At the time of the commit, `1.21.3` was the latest version.
```gomodule ctf
go 1.21.3```
### Commit 3
```commit 391229073873729b50318bf385494d0b195a9cb1Author: CTF Organizer <[email protected]>Date:   Wed Nov 1 10:09:11 2023 -0700
    Rename hello.go to main.go and update the prompt. Almost forgot about go fmt .```
- `git mv hello.go main.go`- Connect to the server and notice that the prompt is "Password: ".- Also, be careful to notice there is no newline after the prompt, so we change `fmt.Println` to `fmt.Print`.- The message also gives a hint that you should use `go fmt .` to format the code. *This should be used for all of the following challenges.*
```gopackage main
import "fmt"
func main() {	fmt.Print("Password: ")}```
### Commit 4
```commit 70d45a6d98f5642cdc5c79921815a760d290abe2Author: CTF Organizer <[email protected]>Date:   Wed Nov 1 10:26:51 2023 -0700
    So many ways to read from stdin in go... create a bufio scanner and just call scanner.Scan() I guess? Also, simplify the imports since there are 3 now.```
- Add the code to read from stdin. The variable name is hinted at in the message.- Simplify the imports by parenthesizing them.
```gopackage main
import (	"bufio"	"fmt"	"os")
func main() {	fmt.Print("Password: ")
	scanner := bufio.NewScanner(os.Stdin)	scanner.Scan()}```
### Commit 5
```commit 27eeebb5355d8430b5c72757580c7875eba3a6b1Author: CTF Organizer <[email protected]>Date:   Wed Nov 1 10:43:07 2023 -0700
    Read the flag file and print it to stdout as a string. Who needs error handling, it's just a ctf!```
- Add the `os.ReadFile` and `fmt.Println`.- The file name and the fact that we ignore the error are hinted at in the message.
```gopackage main
import (	"bufio"	"fmt"	"os")
func main() {	fmt.Print("Password: ")
	scanner := bufio.NewScanner(os.Stdin)	scanner.Scan()
	flag, _ := os.ReadFile("flag")	fmt.Println(string(flag))}```
### Commit 6
```commit aa188dbd6fc8342a63c81f2625b7e35a8d605359Author: CTF Organizer <[email protected]>Date:   Wed Nov 1 11:05:29 2023 -0700
    Actually, only print the flag if the scanned bytes matches foo. Make sure to compare in constant time so we don't leak any info!```
- Wrap the flag print block with an if statement.- Use `subtle.ConstantTimeCompare` as hinted at in the message.
```gopackage main
import (	"bufio"	"crypto/subtle"	"fmt"	"os")
func main() {	fmt.Print("Password: ")
	scanner := bufio.NewScanner(os.Stdin)	scanner.Scan()
	if subtle.ConstantTimeCompare(scanner.Bytes(), []byte("foo")) == 1 {		flag, _ := os.ReadFile("flag")		fmt.Println(string(flag))	}}```
### Commit 7
```commit 152c3c6a671eebf80447224edb6ffce3459cb25fAuthor: CTF Organizer <[email protected]>Date:   Wed Nov 1 11:33:56 2023 -0700
    Add a sleep before the compare, this will be so hard to crack!```
- Add `time.Sleep` statement- The amount of time to sleep is not given and must be guessed from the binary running on the server.
```gopackage main
import (	"bufio"	"crypto/subtle"	"fmt"	"os"	"time")
func main() {	fmt.Print("Password: ")
	scanner := bufio.NewScanner(os.Stdin)	scanner.Scan()
	time.Sleep(5 * time.Second)
	if subtle.ConstantTimeCompare(scanner.Bytes(), []byte("foo")) == 1 {		flag, _ := os.ReadFile("flag")		fmt.Println(string(flag))	}}```
### Commit 8
```commit 958290ed4c52c380e0ebd0797a298119bcb3ba5dAuthor: CTF Organizer <[email protected]>Date:   Wed Nov 1 11:57:38 2023 -0700
    Replace foo with an actual password. How about the git tree hash? That should be random enough.```
Find the git tree hash by running
```git cat-file commit HEAD | head -n1 | sed 's/tree \(.*\)/\1/'```
Submit that to the server and get back the flag!
```gopackage main
import (	"bufio"	"crypto/subtle"	"fmt"	"os"	"time")
func main() {	fmt.Print("Password: ")
	scanner := bufio.NewScanner(os.Stdin)	scanner.Scan()
	time.Sleep(5 * time.Second)
	if subtle.ConstantTimeCompare(scanner.Bytes(), []byte("41156adeacb68c10705f9a6f50c8e9ef92de4e58")) == 1 {		flag, _ := os.ReadFile("flag")		fmt.Println(string(flag))	}}```