From: "Michał Górny" <mgorny@gentoo.org>
To: gentoo-dev@lists.gentoo.org
Cc: "Michał Górny" <mgorny@gentoo.org>
Subject: [gentoo-dev] [PATCH 2/2] git-r3.eclass: Explicitly warn about unsecure protocols
Date: Sat, 19 Aug 2017 10:25:02 +0200 [thread overview]
Message-ID: <20170819082502.27716-2-mgorny@gentoo.org> (raw)
In-Reply-To: <20170819082502.27716-1-mgorny@gentoo.org>
Explicitly warn about any URI that uses an unsecure protocol (git, http)
even if it's a fallback URI. This is necessary because an attacker may
block HTTPS connections, effectively forcing the fallback to
the unsecure protocol.
---
eclass/git-r3.eclass | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/eclass/git-r3.eclass b/eclass/git-r3.eclass
index 42b586811368..1eb0baedc67f 100644
--- a/eclass/git-r3.eclass
+++ b/eclass/git-r3.eclass
@@ -570,6 +570,15 @@ git-r3_fetch() {
[[ ${repos[@]} ]] || die "No URI provided and EGIT_REPO_URI unset"
+ local r
+ for r in "${repos[@]}"; do
+ if [[ ${r} == git:* || ${r} == http:* ]]; then
+ ewarn "git-r3: ${r%%:*} protocol in unsafe and may be subject to MITM attacks"
+ ewarn "(even if used only as fallback). Please use https instead."
+ ewarn "[URI: ${r}]"
+ fi
+ done
+
local -x GIT_DIR
_git-r3_set_gitdir "${repos[0]}"
@@ -582,7 +591,7 @@ git-r3_fetch() {
fi
# try to fetch from the remote
- local r success saved_umask
+ local success saved_umask
if [[ ${EVCS_UMASK} ]]; then
saved_umask=$(umask)
umask "${EVCS_UMASK}" || die "Bad options to umask: ${EVCS_UMASK}"
--
2.14.1
next prev parent reply other threads:[~2017-08-19 8:25 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-08-19 8:25 [gentoo-dev] [PATCH 1/2] git-r3.eclass: Update docs to discourage unsafe protocols Michał Górny
2017-08-19 8:25 ` Michał Górny [this message]
2017-08-19 22:01 ` [gentoo-dev] Re: [PATCH 2/2] git-r3.eclass: Explicitly warn about unsecure protocols Duncan
2017-08-19 22:39 ` Michał Górny
2017-08-23 8:46 ` [gentoo-dev] " Andrew Savchenko
2017-08-25 13:51 ` Michał Górny
2017-09-03 18:00 ` Andrew Savchenko
2017-08-25 15:46 ` Hanno Böck
2017-09-03 18:08 ` Andrew Savchenko
2017-08-20 18:05 ` [gentoo-dev] [PATCH 1/2] git-r3.eclass: Update docs to discourage unsafe protocols William Hubbs
2017-08-20 19:25 ` Michał Górny
2017-08-25 13:52 ` Michał Górny
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170819082502.27716-2-mgorny@gentoo.org \
--to=mgorny@gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox