diff options
| author |   Michał Górny <mgorny@gentoo.org> | 2017-08-19 10:23:47 +0200 |
|---|---|---|
| committer | Michał Górny <mgorny@gentoo.org> | 2017-08-25 15:51:54 +0200 |
| commit | 2b46203c6c3e47fdf4e1ff99e9f3fb267314acd7 (patch) | |
| tree | 5a6cc82226d839caf3d4d46683e39db7e898c2f6 /eclass | |
| parent | git-r3.eclass: Update docs to discourage unsafe protocols (diff) | |
| download | gentoo-2b46203c6c3e47fdf4e1ff99e9f3fb267314acd7.tar.gz gentoo-2b46203c6c3e47fdf4e1ff99e9f3fb267314acd7.tar.bz2 gentoo-2b46203c6c3e47fdf4e1ff99e9f3fb267314acd7.zip | |
git-r3.eclass: Explicitly warn about unsecure protocols
Explicitly warn about any URI that uses an unsecure protocol (git, http)
even if it's a fallback URI. This is necessary because an attacker may
block HTTPS connections, effectively forcing the fallback to
the unsecure protocol.
Diffstat (limited to 'eclass')
| -rw-r--r-- | eclass/git-r3.eclass | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/eclass/git-r3.eclass b/eclass/git-r3.eclass index a0aa004caa25..ee6050c3cdd2 100644 --- a/eclass/git-r3.eclass +++ b/eclass/git-r3.eclass @@ -570,6 +570,16 @@ git-r3_fetch() { [[ ${repos[@]} ]] || die "No URI provided and EGIT_REPO_URI unset" + local r + for r in "${repos[@]}"; do + if [[ ${r} == git:* || ${r} == http:* ]]; then + ewarn "git-r3: ${r%%:*} protocol is completely unsecure and may render the ebuild" + ewarn "easily suspectible to MITM attacks (even if used only as fallback). Please" + ewarn "use https instead." + ewarn "[URI: ${r}]" + fi + done + local -x GIT_DIR _git-r3_set_gitdir "${repos[0]}" @@ -582,7 +592,7 @@ git-r3_fetch() { fi # try to fetch from the remote - local r success saved_umask + local success saved_umask if [[ ${EVCS_UMASK} ]]; then saved_umask=$(umask) umask "${EVCS_UMASK}" || die "Bad options to umask: ${EVCS_UMASK}" |