mirror of
https://github.com/git/git
synced 2024-10-28 19:25:47 +00:00
b89363e4a5
In order to prevent a valid push certificate for pushing into an repository from getting replayed in a different push operation, send a nonce string from the receive-pack process and have the signer include it in the push certificate. The receiving end uses an HMAC hash of the path to the repository it serves and the current time stamp, hashed with a secret seed (the secret seed does not have to be per-repository but can be defined in /etc/gitconfig) to generate the nonce, in order to ensure that a random third party cannot forge a nonce that looks like it originated from it. The original nonce is exported as GIT_PUSH_CERT_NONCE for the hooks to examine and match against the value on the "nonce" header in the certificate to notice a replay, but returned "nonce" header in the push certificate is examined by receive-pack and the result is exported as GIT_PUSH_CERT_NONCE_STATUS, whose value would be "OK" if the nonce recorded in the certificate matches what we expect, so that the hooks can more easily check. Signed-off-by: Junio C Hamano <gitster@pobox.com>
127 lines
3 KiB
Bash
Executable file
127 lines
3 KiB
Bash
Executable file
#!/bin/sh
|
|
|
|
test_description='signed push'
|
|
|
|
. ./test-lib.sh
|
|
. "$TEST_DIRECTORY"/lib-gpg.sh
|
|
|
|
prepare_dst () {
|
|
rm -fr dst &&
|
|
test_create_repo dst &&
|
|
|
|
git push dst master:noop master:ff master:noff
|
|
}
|
|
|
|
test_expect_success setup '
|
|
# master, ff and noff branches pointing at the same commit
|
|
test_tick &&
|
|
git commit --allow-empty -m initial &&
|
|
|
|
git checkout -b noop &&
|
|
git checkout -b ff &&
|
|
git checkout -b noff &&
|
|
|
|
# noop stays the same, ff advances, noff rewrites
|
|
test_tick &&
|
|
git commit --allow-empty --amend -m rewritten &&
|
|
git checkout ff &&
|
|
|
|
test_tick &&
|
|
git commit --allow-empty -m second
|
|
'
|
|
|
|
test_expect_success 'unsigned push does not send push certificate' '
|
|
prepare_dst &&
|
|
mkdir -p dst/.git/hooks &&
|
|
write_script dst/.git/hooks/post-receive <<-\EOF &&
|
|
# discard the update list
|
|
cat >/dev/null
|
|
# record the push certificate
|
|
if test -n "${GIT_PUSH_CERT-}"
|
|
then
|
|
git cat-file blob $GIT_PUSH_CERT >../push-cert
|
|
fi
|
|
EOF
|
|
|
|
git push dst noop ff +noff &&
|
|
! test -f dst/push-cert
|
|
'
|
|
|
|
test_expect_success 'talking with a receiver without push certificate support' '
|
|
prepare_dst &&
|
|
mkdir -p dst/.git/hooks &&
|
|
write_script dst/.git/hooks/post-receive <<-\EOF &&
|
|
# discard the update list
|
|
cat >/dev/null
|
|
# record the push certificate
|
|
if test -n "${GIT_PUSH_CERT-}"
|
|
then
|
|
git cat-file blob $GIT_PUSH_CERT >../push-cert
|
|
fi
|
|
EOF
|
|
|
|
git push dst noop ff +noff &&
|
|
! test -f dst/push-cert
|
|
'
|
|
|
|
test_expect_success 'push --signed fails with a receiver without push certificate support' '
|
|
prepare_dst &&
|
|
mkdir -p dst/.git/hooks &&
|
|
test_must_fail git push --signed dst noop ff +noff 2>err &&
|
|
test_i18ngrep "the receiving end does not support" err
|
|
'
|
|
|
|
test_expect_success GPG 'no certificate for a signed push with no update' '
|
|
prepare_dst &&
|
|
mkdir -p dst/.git/hooks &&
|
|
write_script dst/.git/hooks/post-receive <<-\EOF &&
|
|
if test -n "${GIT_PUSH_CERT-}"
|
|
then
|
|
git cat-file blob $GIT_PUSH_CERT >../push-cert
|
|
fi
|
|
EOF
|
|
git push dst noop &&
|
|
! test -f dst/push-cert
|
|
'
|
|
|
|
test_expect_success GPG 'signed push sends push certificate' '
|
|
prepare_dst &&
|
|
mkdir -p dst/.git/hooks &&
|
|
git -C dst config receive.certnonceseed sekrit &&
|
|
write_script dst/.git/hooks/post-receive <<-\EOF &&
|
|
# discard the update list
|
|
cat >/dev/null
|
|
# record the push certificate
|
|
if test -n "${GIT_PUSH_CERT-}"
|
|
then
|
|
git cat-file blob $GIT_PUSH_CERT >../push-cert
|
|
fi &&
|
|
|
|
cat >../push-cert-status <<E_O_F
|
|
SIGNER=${GIT_PUSH_CERT_SIGNER-nobody}
|
|
KEY=${GIT_PUSH_CERT_KEY-nokey}
|
|
STATUS=${GIT_PUSH_CERT_STATUS-nostatus}
|
|
NONCE_STATUS=${GIT_PUSH_CERT_NONCE_STATUS-nononcestatus}
|
|
NONCE=${GIT_PUSH_CERT_NONCE-nononce}
|
|
E_O_F
|
|
|
|
EOF
|
|
|
|
git push --signed dst noop ff +noff &&
|
|
|
|
(
|
|
cat <<-\EOF &&
|
|
SIGNER=C O Mitter <committer@example.com>
|
|
KEY=13B6F51ECDDE430D
|
|
STATUS=G
|
|
NONCE_STATUS=OK
|
|
EOF
|
|
sed -n -e "s/^nonce /NONCE=/p" -e "/^$/q" dst/push-cert
|
|
) >expect &&
|
|
|
|
grep "$(git rev-parse noop ff) refs/heads/ff" dst/push-cert &&
|
|
grep "$(git rev-parse noop noff) refs/heads/noff" dst/push-cert &&
|
|
test_cmp expect dst/push-cert-status
|
|
'
|
|
|
|
test_done
|