signed push: add "pushee" header to push certificate
Record the URL of the intended recipient for a push (after anonymizing it if it has authentication material) on a new "pushee URL" header. Because the networking configuration (SSH-tunnels, proxies, etc.) on the pushing user's side varies, the receiving repository may not know the single canonical URL all the pushing users would refer it as (besides, many sites allow pushing over ssh://host/path and https://host/path protocols to the same repository but with different local part of the path). So this value may not be reliably used for replay-attack prevention purposes, but this will still serve as a human readable hint to identify the repository the certificate refers to. Signed-off-by: Junio C Hamano <gitster@pobox.com>
Junio C Hamano committed
Aug 22, 2014 at 18:15 UTC
9be89160e7382a88e56a02bcf38f4694dd6542d6
4 files changed
+13
Documentation/technical/pack-protocol.txt
+6
@@ -484,6 +484,7 @@ references.
484
push-cert = PKT-LINE("push-cert" NUL capability-list LF)
485
PKT-LINE("certificate version 0.1" LF)
486
PKT-LINE("pusher" SP ident LF)
487
+ PKT-LINE("pushee" SP url LF)
488
PKT-LINE(LF)
489
*PKT-LINE(command LF)
490
*PKT-LINE(gpg-signature-lines LF)
@@ -527,6 +528,11 @@ Currently, the following header fields are defined:
528
Identify the GPG key in "Human Readable Name <email@address>"
529
format.
530
531
+`pushee` url::
532
+ The repository URL (anonymized, if the URL contains
533
+ authentication material) the user who ran `git push`
534
+ intended to push into.
535
+
536
The GPG signature lines are a detached signature for the contents
537
recorded in the push certificate before the signature block begins.
538
The detached signature is used to certify that the commands were
send-pack.c
+5
@@ -240,6 +240,11 @@ static int generate_push_cert(struct strbuf *req_buf,
240
datestamp(stamp, sizeof(stamp));
241
strbuf_addf(&cert, "certificate version 0.1\n");
242
strbuf_addf(&cert, "pusher %s %s\n", signing_key, stamp);
243
+ if (args->url && *args->url) {
244
+ char *anon_url = transport_anonymize_url(args->url);
245
+ strbuf_addf(&cert, "pushee %s\n", anon_url);
246
+ free(anon_url);
247
+ }
248
strbuf_addstr(&cert, "\n");
249
250
for (ref = remote_refs; ref; ref = ref->next) {
send-pack.h
+1
@@ -2,6 +2,7 @@
2
#define SEND_PACK_H
3
4
struct send_pack_args {
5
+ const char *url;
6
unsigned verbose:1,
7
quiet:1,
8
porcelain:1,
transport.c
+1
@@ -827,6 +827,7 @@ static int git_transport_push(struct transport *transport, struct ref *remote_re
827
args.dry_run = !!(flags & TRANSPORT_PUSH_DRY_RUN);
828
args.porcelain = !!(flags & TRANSPORT_PUSH_PORCELAIN);
829
args.push_cert = !!(flags & TRANSPORT_PUSH_CERT);
830
+ args.url = transport->url;
831
832
ret = send_pack(&args, data->fd, data->conn, remote_refs,
833
&data->extra_have);