initremote: Avoid creating a remote that is not encrypted when gpg is broken

checksize was applied lazily, so the exception didn't happen until the
remote was set up.

Sponsored-by: k0ld on Patreon

diff --git a/CHANGELOG b/CHANGELOG
index 94df9218a2cb860a9f2366aa556221c46e980215..a8d2a7476e2c01ba7d07027902763eb4df60a003 100644 (file)
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -35,6 +35,8 @@ git-annex (10.20230408) UNRELEASED; urgency=medium
     .git/annex/journal/* with permissions configured by core.sharedRepository.
   * Bug fix: Lock files were created with wrong modes for some combinations
     of core.sharedRepository and umask.
+  * initremote: Avoid creating a remote that is not encrypted when gpg is
+    broken.
 
  -- Joey Hess <id@joeyh.name>  Sat, 08 Apr 2023 13:57:18 -0400
 

diff --git a/Utility/Gpg.hs b/Utility/Gpg.hs
index b5967fab0e1505854bf45aeb68a8f86ec3b29d3a..445f65768cd11406bc9781fc3048ac83c3fc7540 100644 (file)
--- a/Utility/Gpg.hs
+++ b/Utility/Gpg.hs
@@ -302,7 +302,10 @@ genSecretKey (GpgCmd cmd) keytype passphrase userid keysize =
  - It is armored, to avoid newlines, since gpg only reads ciphers up to the
  - first newline. -}
 genRandom :: GpgCmd -> Bool -> Size -> IO String
-genRandom cmd highQuality size = checksize <$> readStrict cmd params
+genRandom cmd highQuality size = do
+       s <- readStrict cmd params
+       checksize s
+       return s
   where
        params = 
                [ Param "--gen-random"
@@ -325,9 +328,8 @@ genRandom cmd highQuality size = checksize <$> readStrict cmd params
        expectedlength = size * 8 `div` 6
 
        checksize s = let len = length s in
-               if len >= expectedlength
-                       then s
-                       else shortread len
+               unless (len >= expectedlength) $
+                       shortread len
 
        shortread got = giveup $ unwords
                [ "Not enough bytes returned from gpg", show params

diff --git a/doc/bugs/shared_encryption_bypassed_if_gpg_error_on_init.mdwn b/doc/bugs/shared_encryption_bypassed_if_gpg_error_on_init.mdwn
index a4170bec243b1c289fc8030d178da79b635336b5..2162f5b3ed77e6e1d20afcb33519daae54283252 100644 (file)
--- a/doc/bugs/shared_encryption_bypassed_if_gpg_error_on_init.mdwn
+++ b/doc/bugs/shared_encryption_bypassed_if_gpg_error_on_init.mdwn
@@ -22,3 +22,6 @@ tried with `10.20230329` and `10.20230408+gc70677e31` on Manjaro
 ### Have you had any luck using git-annex before? (Sometimes we get tired of reading bug reports all day and a lil' positive end note does wonders)
 
 It's awesome 👍
+
+> Indeed, there was a laziness bug that prevented it from exiting early
+> enough. [[fixed|done]] --[[Joey]]