From bc18b11cb8984b4b987cdf1f0272669c8746c88f Mon Sep 17 00:00:00 2001 From: Joey Hess Date: Thu, 21 Aug 2025 13:47:50 -0400 Subject: [PATCH] prevent changing onlyencryptcreds of existing remote That would break accessing data already stored in the remote, the same as changing encryption type would do. Sponsored-by: Jack Hill --- Remote/Helper/Encryptable.hs | 27 ++++++++++--------- ...vent_enableremote_changing_encryption.mdwn | 10 +++++-- 2 files changed, 22 insertions(+), 15 deletions(-) diff --git a/Remote/Helper/Encryptable.hs b/Remote/Helper/Encryptable.hs index c18c5acf7f..7bc73e115f 100644 --- a/Remote/Helper/Encryptable.hs +++ b/Remote/Helper/Encryptable.hs @@ -1,6 +1,6 @@ {- common functions for encryptable remotes - - - Copyright 2011-2021 Joey Hess + - Copyright 2011-2025 Joey Hess - - Licensed under the GNU AGPL version 3 or higher. -} @@ -165,8 +165,8 @@ parseMac (Just (Proposed s)) = case readMac s of - could opt to use a shared cipher, which is stored unencrypted. -} encryptionSetup :: SetupStage -> RemoteConfig -> RemoteGitConfig -> Annex (RemoteConfig, EncryptionIsSetup) encryptionSetup setupstage c gc = do - checkallowedchange pc <- either giveup return $ parseEncryptionConfig c + checkallowedchange pc gpgcmd <- gpgCmd <$> Annex.getGitConfig maybe (genCipher pc gpgcmd) (updateCipher pc gpgcmd) (extractCipher pc) where @@ -220,23 +220,24 @@ encryptionSetup setupstage c gc = do -- public-key encryption, hence we leave it on newer -- remotes (while being backward-compatible). (map Accepted ["keyid", "keyid+", "keyid-", "highRandomQuality"]) - oldpc = either (const Nothing) Just $ parseEncryptionConfig $ + moldpc = either (const Nothing) Just $ parseEncryptionConfig $ case setupstage of Init -> mempty Enable oldc -> oldc AutoEnable oldc -> oldc - checkallowedchange = case oldpc of + checkallowedchange pc = case moldpc of Nothing -> return () - Just oldpc' -> case extractCipher oldpc' of - Nothing -> req NoneEncryption - Just (EncryptedCipher _ Hybrid _) -> req HybridEncryption - Just (EncryptedCipher _ PubKey _) -> req PubKeyEncryption - Just (SharedCipher _) -> req SharedEncryption - Just (SharedPubKeyCipher _ _) -> req SharedPubKeyEncryption + Just oldpc -> do + case extractCipher oldpc of + Nothing -> req NoneEncryption + Just (EncryptedCipher _ Hybrid _) -> req HybridEncryption + Just (EncryptedCipher _ PubKey _) -> req PubKeyEncryption + Just (SharedCipher _) -> req SharedEncryption + Just (SharedPubKeyCipher _ _) -> req SharedPubKeyEncryption + when (onlyEncryptCreds oldpc /= onlyEncryptCreds pc) $ + giveup "Cannot change onlyencryptcreds of existing remotes." where - req v - | encryption /= Right v = cannotchange - | otherwise = return () + req v = when (encryption /= Right v) cannotchange data CipherPurpose t = CipherAllPurpose t | CipherOnlyCreds t diff --git a/doc/bugs/prevent_enableremote_changing_encryption.mdwn b/doc/bugs/prevent_enableremote_changing_encryption.mdwn index b4e92e571e..8ed9f1761e 100644 --- a/doc/bugs/prevent_enableremote_changing_encryption.mdwn +++ b/doc/bugs/prevent_enableremote_changing_encryption.mdwn @@ -7,9 +7,15 @@ encryption for such a remote: enableremote d (encryption setup) (encryption key stored in git repository) ok (recording state in git...) -This config change should not be allowed. This is a reversion, -probably introduced around [[!commit 71f78fe45dc91dbef0bedd79b33d6a9fed85704d]] +This config change should not be allowed. + +Indeed, changing encryption type of an existing special remote should never +be allowed, whether or not it uses exporttree. This is a reversion, +probably introduced around +[[!commit 71f78fe45dc91dbef0bedd79b33d6a9fed85704d]] Also, the new onlyencryptcreds=yes setting can passed to enableremote, which changes a previously encrypted remote to not use encryption for the data stored on it. That should also not be allowed. --[[Joey]] + +> [[fixed|done]] --[[Joey]] -- 2.30.2