From: Joey Hess <joeyh@joeyh.name>
Date: Thu, 21 Aug 2025 17:47:50 +0000 (-0400)
Subject: prevent changing onlyencryptcreds of existing remote
X-Git-Tag: archive/raspbian/10.20251029-1+rpi1~1^2~3^2~193
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=bc18b11cb8984b4b987cdf1f0272669c8746c88f;p=git-annex.git

prevent changing onlyencryptcreds of existing remote

That would break accessing data already stored in the remote, the same
as changing encryption type would do.

Sponsored-by: Jack Hill
---

diff --git a/Remote/Helper/Encryptable.hs b/Remote/Helper/Encryptable.hs
index c18c5acf7f..7bc73e115f 100644
--- a/Remote/Helper/Encryptable.hs
+++ b/Remote/Helper/Encryptable.hs
@@ -1,6 +1,6 @@
 {- common functions for encryptable remotes
  -
- - Copyright 2011-2021 Joey Hess <id@joeyh.name>
+ - Copyright 2011-2025 Joey Hess <id@joeyh.name>
  -
  - Licensed under the GNU AGPL version 3 or higher.
  -}
@@ -165,8 +165,8 @@ parseMac (Just (Proposed s)) = case readMac s of
  - could opt to use a shared cipher, which is stored unencrypted. -}
 encryptionSetup :: SetupStage -> RemoteConfig -> RemoteGitConfig -> Annex (RemoteConfig, EncryptionIsSetup)
 encryptionSetup setupstage c gc = do
-	checkallowedchange
 	pc <- either giveup return $ parseEncryptionConfig c
+	checkallowedchange pc
 	gpgcmd <- gpgCmd <$> Annex.getGitConfig
 	maybe (genCipher pc gpgcmd) (updateCipher pc gpgcmd) (extractCipher pc)
   where
@@ -220,23 +220,24 @@ encryptionSetup setupstage c gc = do
 		-- public-key encryption, hence we leave it on newer
 		-- remotes (while being backward-compatible).
 		(map Accepted ["keyid", "keyid+", "keyid-", "highRandomQuality"])
-	oldpc = either (const Nothing) Just $ parseEncryptionConfig $
+	moldpc = either (const Nothing) Just $ parseEncryptionConfig $
 		case setupstage of
 			Init -> mempty
 			Enable oldc -> oldc
 			AutoEnable oldc -> oldc
-	checkallowedchange = case oldpc of
+	checkallowedchange pc = case moldpc of
 		Nothing -> return ()
-		Just oldpc' -> case extractCipher oldpc' of
-			Nothing -> req NoneEncryption
-			Just (EncryptedCipher _ Hybrid _) -> req HybridEncryption
-			Just (EncryptedCipher _ PubKey _) -> req PubKeyEncryption
-			Just (SharedCipher _) -> req SharedEncryption
-			Just (SharedPubKeyCipher _ _) -> req SharedPubKeyEncryption
+		Just oldpc -> do
+			case extractCipher oldpc of
+				Nothing -> req NoneEncryption
+				Just (EncryptedCipher _ Hybrid _) -> req HybridEncryption
+				Just (EncryptedCipher _ PubKey _) -> req PubKeyEncryption
+				Just (SharedCipher _) -> req SharedEncryption
+				Just (SharedPubKeyCipher _ _) -> req SharedPubKeyEncryption
+			when (onlyEncryptCreds oldpc /= onlyEncryptCreds pc) $
+				giveup "Cannot change onlyencryptcreds of existing remotes."
 	  where
-		req v
-			| encryption /= Right v = cannotchange
-			| otherwise = return ()
+		req v = when (encryption /= Right v) cannotchange
 
 data CipherPurpose t = CipherAllPurpose t | CipherOnlyCreds t
 
diff --git a/doc/bugs/prevent_enableremote_changing_encryption.mdwn b/doc/bugs/prevent_enableremote_changing_encryption.mdwn
index b4e92e571e..8ed9f1761e 100644
--- a/doc/bugs/prevent_enableremote_changing_encryption.mdwn
+++ b/doc/bugs/prevent_enableremote_changing_encryption.mdwn
@@ -7,9 +7,15 @@ encryption for such a remote:
 	enableremote d (encryption setup) (encryption key stored in git repository) ok
 	(recording state in git...)
 
-This config change should not be allowed. This is a reversion,
-probably introduced around [[!commit 71f78fe45dc91dbef0bedd79b33d6a9fed85704d]]
+This config change should not be allowed.
+
+Indeed, changing encryption type of an existing special remote should never
+be allowed, whether or not it uses exporttree. This is a reversion, 
+probably introduced around
+[[!commit 71f78fe45dc91dbef0bedd79b33d6a9fed85704d]]
 
 Also, the new onlyencryptcreds=yes setting can passed to enableremote,
 which changes a previously encrypted remote to not use encryption for the
 data stored on it. That should also not be allowed. --[[Joey]]
+
+> [[fixed|done]] --[[Joey]]