diff options
| author |  Joey Hess <joey@kitenet.net> | 2014-09-18 17:58:03 -0400 |
|---|---|---|
| committer | Joey Hess <joey@kitenet.net> | 2014-09-18 17:58:03 -0400 |
| commit | 2df9a6f1c9eff911cf27ab788cb28c78f6d20535 (patch) | |
| tree | 0734065e2c55cea4620facea921da2001956640e /debian/changelog | |
| parent | 2fb7ad68637cc4e1092f835055a974f141808ca0 (diff) | |
deal with old repositories with non-encrypted creds
See 2fb7ad68637cc4e1092f835055a974f141808ca0 for backstory about how a repo
could be in this state.
When decryption fails, the repo must be using non-encrypted creds. Note
that creds are encrypted/decrypted using the encryption cipher which is
stored in the repo, so the decryption cannot fail due to missing gpg keys
etc. (For !shared encryptiom, the cipher is iteself encrypted using some
gpg key(s), and the decryption of the cipher happens earlier, so not
affected by this change.
Print a warning message for !shared repos, and continue on using the
cipher. Wrote a page explaining what users hit by this bug should do.
This commit was sponsored by Samuel Tardieu.
Diffstat (limited to 'debian/changelog')
| -rw-r--r-- | debian/changelog | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/debian/changelog b/debian/changelog index ffb760b7b..5bfba77ed 100644 --- a/debian/changelog +++ b/debian/changelog @@ -3,6 +3,9 @@ git-annex (5.20140916) UNRELEASED; urgency=medium * Security fix for S3 and glacier when using embedcreds=yes with encryption=pubkey or encryption=hybrid. The creds embedded in the git repo were *not* encrypted. + git-annex enableremote will warn when used on a remote that has + this problem. For details, see: + https://git-annex.branchable.com/upgrades/insecure_embedded_creds/ * assistant: Detect when repository has been deleted or moved, and automatically shut down the assistant. Closes: #761261 * Windows: Avoid crashing trying to list gpg secret keys, for gcrypt |