Commits
- Commit:
8b925c6ccd3968917253ea191906a1710c40ed2d
- From:
- Thomas Adam <thomas@xteddy.org>
- Date:
portable: add back sys/queue.h
Now that the handling of including sys/queue.h is better, there's no
need to remove those lines from the source. Copy the location of those
original sys/queue.h lines from upstream at the same line number, so as
to avoid any conflicts in the future.
- Commit:
ff5e1f096349d36a0ba772c0d78a21b2ab54e060
- From:
- Josh Rickmar <jrick@zettaport.com>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
add signer_id option to got.conf(5)
Setting this option will cause 'got tag' to sign all created tags using
the SSH key, unless overridden by the -s flag.
ok stsp@
- Commit:
871bd038071fdaf6129995ef9f56226616b47d25
- From:
- Josh Rickmar <jrick@zettaport.com>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
create and verify tags signed by SSH keys
This adds a new -s flag to 'got tag' that specifies the signer
identity (for example, a key file) of the tagger. The tag object will
include a signature that validates each of the tag object headers and
the tag message.
Verifying these signed tags requires maintaining an allowed signers
file which maps signer identities (i.e. the email address of the
tagger) to SSH public keys. See ssh-keygen(1) for more details of the
allowed signers file. After creating this file and providing the path
to it in got.conf(5) using the allowed_signers option, tags may be
verified using with 'got tag -V tag_name'. The return code will be
non-zero if a signature fails to verify.
ok stsp@
- Commit:
5d120ea8410ddc2808e476d554ba931dc19d8c50
- From:
- Omar Polo <op@omarpolo.com>
- Date:
use capsicum on FreeBSD
Thanks to the design of Got, the libexec helpers don't need any resource
(in fact they run under pledge "stdio recvfd" on OpenBSD) and so using
cap_enter(2) on FreeBSD is dead-easy.
While the main process can't be sandboxed on FreeBSD (needs to exec the
helpers), all the tough work is done by these small libexec helpers
which is also the biggest attack surface.
tested by naddy, ok thomas
- Commit:
e9f1a409ccc66a6fb79a3022695ca78ad26972ea
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
imsg_add() frees its msg argument on error; avoid double-free in error paths
- Commit:
97799ccd4b67a81f97039305d4fdd66588da9962
- From:
- Thomas Adam <thomas@xteddy.org>
- Date:
portable: add support for landlock
landlock is a new set of linux APIs that is conceptually similar to
unveil(2): the idea is to restrict what a process can do on a
specified part of the filesystem. There are some differences in the
behaviour: the major one being that the landlock ruleset is inherited
across execve(2).
This just restricts the libexec helpers by completely revoking ANY
filesystem access; after all they are the biggest attack surface. got
send/fetch/clone *may* end up spawning ssh(1), so at the moment is not
possible to landlock the main process.
From Omar Polo.
- Commit:
92a9e85d28a30997176ce0d3c2915e3ea70782c7
- From:
- Thomas Adam <thomas@xteddy.org>
- Date:
portable: add FreeBSD support
This adds the capability to compile got-portable on FreeBSD.
- Commit:
dd038bc6ec835ad3fd3c0b5303b8af9ad506c8cc
- From:
- Thomas Adam <thomas@xteddy.org>
- Via:
- Thomas Adam <thomas.adam@smoothwall.net>
- Date:
portable: initial Linux compilation
This commit modifies the GoT main branch to be able to compile it under
linux.
- Commit:
93f8a3371abdcbfdc9e411ff44942acb0198ca47
- From:
- Christian Weisgerber <naddy@mips.inka.de>
- Date:
tweak implementation of separate send {} and fetch {} conf blocks
Tweak man page.
Factor out repeated code in if/else branches in send_gotconfig_remotes().
ok stsp@
- Commit:
6480c871c8f9ffdce90c10e7a7313e1187de019a
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
provide separate send {} and fetch {} configuration blocks in got.conf
Feature requested by naddy.
ok naddy, who also suggested some tweaks that will arrive shortly
- Commit:
f1cacac799e48da059d50c727b25d240483bed12
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
validate non-optional settings in send {} and fetch {} config blocks.
- Commit:
08578a35f60be8657db97b705f27a55ab61850c8
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
make close(2) failure checks consistent; check 'close() == -1' everywhere
ok millert, naddy
- Commit:
99495ddb79841fe89b0746d35a49bb81e9220096
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
add a 'reference' directive to remote repositories in got.conf(5)
Make use of this in 'got clone' to persist -R option arguments given on
the command line in the cloned repository's got.conf(5) file.
- Commit:
0c8b29c50669cb8958428fbf923f02a5b69184db
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
add a 'fetch-all-branches' configuration setting to got.conf(5)
Set fetch-all-branches in the got.conf(5) file created by 'got clone -a'
in order to make a future 'got fetch' act like 'got fetch -a' by default.
- Commit:
b8adfa5529205d58ab21c9c8fc76b50068ebbaa2
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
add "branch" keyword to got.conf which specifies a list of branches to fetch
ok tracey
- Commit:
5e08262609e4b99fae21c63ff12d7c9cbfc981e2
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
remove redundant leading slashes from repository path parsed from got.conf
- Commit:
be96c417e34cf83ef497d65c5eb4dcf44abef57c
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
fix got.conf overriding GOT_AUTHOR even if no author is set in got.conf
- Commit:
e12e0e217d39c07988378fa6c8f492892a4979be
- From:
- Christian Weisgerber <naddy@mips.inka.de>
- Date:
do not rely on <zlib.h> to pull in <unistd.h>
- Commit:
23c57b285fdcf9a8a0a5913ea096232038bf0ac3
- From:
- Christian Weisgerber <naddy@mips.inka.de>
- Date:
Stop including <sys/syslimits.h> directly.
POSIX says the limits defined there are available from <limits.h>,
which almost all affected source files already included anyway.
ok millert stsp
- Commit:
53dfa00d415bb0c005a2b76db8398bc38583065f
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
initialize variable in got-read-gotconfig to fix SIGBUS in free(3) on sparc64
- Commit:
257add310e4b16ae43b467b91f66b773da39f470
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
add got.conf(5) configuration file
ok tracey