prevent changing onlyencryptcreds of existing remote

That would break accessing data already stored in the remote, the same
as changing encryption type would do.

Sponsored-by: Jack Hill

diff --git a/Remote/Helper/Encryptable.hs b/Remote/Helper/Encryptable.hs
index c18c5acf7f685b66ad8f381871e9127141397238..7bc73e115ff8d7ab24600014a8cde770f6ff05c1 100644 (file)
--- a/Remote/Helper/Encryptable.hs
+++ b/Remote/Helper/Encryptable.hs
@@ -1,6 +1,6 @@
 {- common functions for encryptable remotes
  -
- - Copyright 2011-2021 Joey Hess <id@joeyh.name>
+ - Copyright 2011-2025 Joey Hess <id@joeyh.name>
  -
  - Licensed under the GNU AGPL version 3 or higher.
  -}
@@ -165,8 +165,8 @@ parseMac (Just (Proposed s)) = case readMac s of
  - could opt to use a shared cipher, which is stored unencrypted. -}
 encryptionSetup :: SetupStage -> RemoteConfig -> RemoteGitConfig -> Annex (RemoteConfig, EncryptionIsSetup)
 encryptionSetup setupstage c gc = do
-       checkallowedchange
        pc <- either giveup return $ parseEncryptionConfig c
+       checkallowedchange pc
        gpgcmd <- gpgCmd <$> Annex.getGitConfig
        maybe (genCipher pc gpgcmd) (updateCipher pc gpgcmd) (extractCipher pc)
   where
@@ -220,23 +220,24 @@ encryptionSetup setupstage c gc = do
                -- public-key encryption, hence we leave it on newer
                -- remotes (while being backward-compatible).
                (map Accepted ["keyid", "keyid+", "keyid-", "highRandomQuality"])
-       oldpc = either (const Nothing) Just $ parseEncryptionConfig $
+       moldpc = either (const Nothing) Just $ parseEncryptionConfig $
                case setupstage of
                        Init -> mempty
                        Enable oldc -> oldc
                        AutoEnable oldc -> oldc
-       checkallowedchange = case oldpc of
+       checkallowedchange pc = case moldpc of
                Nothing -> return ()
-               Just oldpc' -> case extractCipher oldpc' of
-                       Nothing -> req NoneEncryption
-                       Just (EncryptedCipher _ Hybrid _) -> req HybridEncryption
-                       Just (EncryptedCipher _ PubKey _) -> req PubKeyEncryption
-                       Just (SharedCipher _) -> req SharedEncryption
-                       Just (SharedPubKeyCipher _ _) -> req SharedPubKeyEncryption
+               Just oldpc -> do
+                       case extractCipher oldpc of
+                               Nothing -> req NoneEncryption
+                               Just (EncryptedCipher _ Hybrid _) -> req HybridEncryption
+                               Just (EncryptedCipher _ PubKey _) -> req PubKeyEncryption
+                               Just (SharedCipher _) -> req SharedEncryption
+                               Just (SharedPubKeyCipher _ _) -> req SharedPubKeyEncryption
+                       when (onlyEncryptCreds oldpc /= onlyEncryptCreds pc) $
+                               giveup "Cannot change onlyencryptcreds of existing remotes."
          where
-               req v
-                       | encryption /= Right v = cannotchange
-                       | otherwise = return ()
+               req v = when (encryption /= Right v) cannotchange
 
 data CipherPurpose t = CipherAllPurpose t | CipherOnlyCreds t
 

diff --git a/doc/bugs/prevent_enableremote_changing_encryption.mdwn b/doc/bugs/prevent_enableremote_changing_encryption.mdwn
index b4e92e571e2445238dea8f53945731fda720b5f9..8ed9f1761ea4a31ac3d9e9364b18e6b1f5504e71 100644 (file)
--- a/doc/bugs/prevent_enableremote_changing_encryption.mdwn
+++ b/doc/bugs/prevent_enableremote_changing_encryption.mdwn
@@ -7,9 +7,15 @@ encryption for such a remote:
        enableremote d (encryption setup) (encryption key stored in git repository) ok
        (recording state in git...)
 
-This config change should not be allowed. This is a reversion,
-probably introduced around [[!commit 71f78fe45dc91dbef0bedd79b33d6a9fed85704d]]
+This config change should not be allowed.
+
+Indeed, changing encryption type of an existing special remote should never
+be allowed, whether or not it uses exporttree. This is a reversion, 
+probably introduced around
+[[!commit 71f78fe45dc91dbef0bedd79b33d6a9fed85704d]]
 
 Also, the new onlyencryptcreds=yes setting can passed to enableremote,
 which changes a previously encrypted remote to not use encryption for the
 data stored on it. That should also not be allowed. --[[Joey]]
+
+> [[fixed|done]] --[[Joey]]