diff options
| author |  Joey Hess <joeyh@joeyh.name> | 2017-02-27 13:01:32 -0400 |
|---|---|---|
| committer | Joey Hess <joeyh@joeyh.name> | 2017-02-27 13:33:59 -0400 |
| commit | 48119806dd24214e88f3f3c62f4dcb14b60dc207 (patch) | |
| tree | 088064fb81ff6ac585cab63e775ac43159e9cc9b /Types | |
| parent | 7416d4a970e0dd45c27c71fcf7ee868b26ec4c09 (diff) | |
annex.securehashesonly
Cryptographically secure hashes can be forced to be used in a repository,
by setting annex.securehashesonly. This does not prevent the git repository
from containing files with insecure hashes, but it does prevent the content
of such files from being pulled into .git/annex/objects from another
repository.
We want to make sure that at no point does git-annex accept content into
.git/annex/objects that is hashed with an insecure key. Here's how it
was done:
* .git/annex/objects/xx/yy/KEY/ is kept frozen, so nothing can be
written to it normally
* So every place that writes content must call, thawContent or modifyContent.
We can audit for these, and be sure we've considered all cases.
* The main functions are moveAnnex, and linkToAnnex; these were made to
check annex.securehashesonly, and are the main security boundary
for annex.securehashesonly.
* Most other calls to modifyContent deal with other files in the KEY
directory (inode cache etc). The other ones that mess with the content
are:
- Annex.Direct.toDirectGen, in which content already in the
annex directory is moved to the direct mode file, so not relevant.
- fix and lock, which don't add new content
- Command.ReKey.linkKey, which manually unlocks it to make a
copy.
* All other calls to thawContent appear safe.
Made moveAnnex return a Bool, so checked all callsites and made them
deal with a failure in appropriate ways.
linkToAnnex simply returns LinkAnnexFailed; all callsites already deal
with it failing in appropriate ways.
This commit was sponsored by Riku Voipio.
Diffstat (limited to 'Types')
| -rw-r--r-- | Types/GitConfig.hs | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/Types/GitConfig.hs b/Types/GitConfig.hs index af901fcf1..af699a7b9 100644 --- a/Types/GitConfig.hs +++ b/Types/GitConfig.hs @@ -82,6 +82,7 @@ data GitConfig = GitConfig , annexPidLock :: Bool , annexPidLockTimeout :: Seconds , annexAddUnlocked :: Bool + , annexSecureHashesOnly :: Bool , coreSymlinks :: Bool , coreSharedRepository :: SharedRepository , receiveDenyCurrentBranch :: DenyCurrentBranch @@ -136,6 +137,7 @@ extractGitConfig r = GitConfig , annexPidLockTimeout = Seconds $ fromMaybe 300 $ getmayberead (annex "pidlocktimeout") , annexAddUnlocked = getbool (annex "addunlocked") False + , annexSecureHashesOnly = getbool (annex "securehashesonly") False , coreSymlinks = getbool "core.symlinks" True , coreSharedRepository = getSharedRepository r , receiveDenyCurrentBranch = getDenyCurrentBranch r |