Adam Dinwoodie [off-list ref] writes:
SSH keys are expected to be created with very restrictive permissions,
and SSH commands will fail if the permissions are not appropriate. When
creating a directory for SSH keys in test scripts, attempt to clear any
ACLs that might otherwise cause the private key to inherit less
restrictive permissions than it requires.
All of the above makes sense as an explanation as to why the
ssh-keygen command may be unhappy with the $GNUPGHOME directory that
is prepared here, but ...
This change is required in particular to avoid tests relating to SSH
signing failing in Cygwin.
... I am not quite sure how this explains "tests relating to ssh
signing failing on Cygwin". After all, this piece of code is
lazy_prereq, which means that ssh-keygen in this block that fails
(due to a less restrictive permissions) would merely mean that tests
that are protected with GPGSSH prerequisite will be skipped without
causing test failures. After all that is the whole point of
computing prereq on the fly.
Signed-off-by: Adam Dinwoodie <redacted>
Helped-by: Fabian Stelzer [off-list ref]
Please order these chronologically, i.e. Fabian helped and the patch
was finished, and finally you sent with your sign off.
quoted hunk
---
t/lib-gpg.sh | 1 +
1 file changed, 1 insertion(+)
diff --git a/t/lib-gpg.sh b/t/lib-gpg.sh
index f99ef3e859..1d8e5b5b7e 100644
--- a/t/lib-gpg.sh
+++ b/t/lib-gpg.sh
@@ -106,6 +106,7 @@ test_lazy_prereq GPGSSH '
test $? = 0 || exit 1;
mkdir -p "${GNUPGHOME}" &&
chmod 0700 "${GNUPGHOME}" &&
+ (setfacl -k "${GNUPGHOME}" 2>/dev/null || true) &&
ssh-keygen -t ed25519 -N "" -C "git ed25519 key" -f "${GPGSSH_KEY_PRIMARY}" >/dev/null &&
echo "\"principal with number 1\" $(cat "${GPGSSH_KEY_PRIMARY}.pub")" >> "${GPGSSH_ALLOWED_SIGNERS}" &&
ssh-keygen -t rsa -b 2048 -N "" -C "git rsa2048 key" -f "${GPGSSH_KEY_SECONDARY}" >/dev/null &&
There are other uses of ssh-keygen in the real tests but presumably
they just use the GNUPGHOME directory prepared with this lazy_prereq
block, and "setfacl -k" here would have wiped any possible loosening
of permission, and that is why this is the only place that needs a
change, right? That fact might deserve recording in the proposed
log message.
Thanks.
On Thursday 04 November 2021 at 12:49 pm -0700, Junio C Hamano wrote:
Adam Dinwoodie [off-list ref] writes:
quoted
SSH keys are expected to be created with very restrictive permissions,
and SSH commands will fail if the permissions are not appropriate. When
creating a directory for SSH keys in test scripts, attempt to clear any
ACLs that might otherwise cause the private key to inherit less
restrictive permissions than it requires.
All of the above makes sense as an explanation as to why the
ssh-keygen command may be unhappy with the $GNUPGHOME directory that
is prepared here, but ...
quoted
This change is required in particular to avoid tests relating to SSH
signing failing in Cygwin.
... I am not quite sure how this explains "tests relating to ssh
signing failing on Cygwin". After all, this piece of code is
lazy_prereq, which means that ssh-keygen in this block that fails
(due to a less restrictive permissions) would merely mean that tests
that are protected with GPGSSH prerequisite will be skipped without
causing test failures. After all that is the whole point of
computing prereq on the fly.
The issue is that the prerequisite check isn't _just_ checking a
prerequisite: it's also creating an SSH key that's used without further
modification by the tests.
There are three cases to consider:
- On systems where this prerequisite check fails, a key may or may not
be created, but the tests that rely on the key won't be run, so it
doesn't matter either way.
- On (clearly the mainline) systems where this check passes and there
are no ACL problems, the key that's generated is stored with
sufficiently restrictive permissions that the tests that rely on the
key can pass.
- On my system, where ACLs are a problem, the prerequisite check passes,
and a key is created, but it has permissions that are too permissive.
As a result, when a test calls OpenSSH to use that key, OpenSSH
refuses due to the permissions, and the test fails.
quoted
Signed-off-by: Adam Dinwoodie <redacted>
Helped-by: Fabian Stelzer [off-list ref]
Please order these chronologically, i.e. Fabian helped and the patch
was finished, and finally you sent with your sign off.
Shall do! I'll resubmit a corrected version as soon as all the other
discussions about this patch seem tidied up.
quoted
---
t/lib-gpg.sh | 1 +
1 file changed, 1 insertion(+)
diff --git a/t/lib-gpg.sh b/t/lib-gpg.sh
index f99ef3e859..1d8e5b5b7e 100644
--- a/t/lib-gpg.sh
+++ b/t/lib-gpg.sh
@@ -106,6 +106,7 @@ test_lazy_prereq GPGSSH '
test $? = 0 || exit 1;
mkdir -p "${GNUPGHOME}" &&
chmod 0700 "${GNUPGHOME}" &&
+ (setfacl -k "${GNUPGHOME}" 2>/dev/null || true) &&
ssh-keygen -t ed25519 -N "" -C "git ed25519 key" -f "${GPGSSH_KEY_PRIMARY}" >/dev/null &&
echo "\"principal with number 1\" $(cat "${GPGSSH_KEY_PRIMARY}.pub")" >> "${GPGSSH_ALLOWED_SIGNERS}" &&
ssh-keygen -t rsa -b 2048 -N "" -C "git rsa2048 key" -f "${GPGSSH_KEY_SECONDARY}" >/dev/null &&
There are other uses of ssh-keygen in the real tests but presumably
they just use the GNUPGHOME directory prepared with this lazy_prereq
block, and "setfacl -k" here would have wiped any possible loosening
of permission, and that is why this is the only place that needs a
change, right? That fact might deserve recording in the proposed
log message.
More than that: the uses of ssh-keygen elsewhere are calling `ssh-keygen
-l`. That command doesn't generate a key at all, it merely calculates
the fingerprint from the keys that are generated with the ssh-keygen
commands in this prerequisite check.
I think it's unusual that this test_lazy_prereq check isn't just
checking the state of the system but is creating the keys that will be
used in later tests, but I didn't think to document that in my log
because that was clearly a decision that had been made earlier. But I'm
very happy to make that logic clearer in my commit message!
On Fri, Nov 05, 2021 at 11:25:25AM +0000, Adam Dinwoodie wrote:
quoted
... I am not quite sure how this explains "tests relating to ssh
signing failing on Cygwin". After all, this piece of code is
lazy_prereq, which means that ssh-keygen in this block that fails
(due to a less restrictive permissions) would merely mean that tests
that are protected with GPGSSH prerequisite will be skipped without
causing test failures. After all that is the whole point of
computing prereq on the fly.
The issue is that the prerequisite check isn't _just_ checking a
prerequisite: it's also creating an SSH key that's used without further
modification by the tests.
This is sort of a side note to your main issue, but I think that relying
on a lazy_prereq for side effects is an anti-pattern. We make no
promises about when or how often the prereqs might be run, and we try to
insulate them from the main tests (by putting them in a subshell and
switching their cwd).
It does happen to work here because the prereq script writes directly to
$GNUPGHOME, and we run the lazy prereqs about when you'd expect. So I
don't think it's really in any danger of breaking, but it is definitely
not using the feature as it was intended. :)
I think the more usual way would be to have an actual
test_expect_success block that creates the keys as a setup step
(possibly triggered by a function, since it's included via lib-gpg.sh).
If we don't want to decide whether we have the GPGSSH prereq until then,
then that test can call test_set_prereq. See the LONG_REF case in t1401
for an example.
Again, that's mostly a tangent to your issue, and maybe not worth
futzing with at this point in the release cycle. I'm mostly just
registering my surprise. ;)
There are three cases to consider:
- On systems where this prerequisite check fails, a key may or may not
be created, but the tests that rely on the key won't be run, so it
doesn't matter either way.
- On (clearly the mainline) systems where this check passes and there
are no ACL problems, the key that's generated is stored with
sufficiently restrictive permissions that the tests that rely on the
key can pass.
- On my system, where ACLs are a problem, the prerequisite check passes,
and a key is created, but it has permissions that are too permissive.
As a result, when a test calls OpenSSH to use that key, OpenSSH
refuses due to the permissions, and the test fails.
FWIW, that explanation makes perfect sense to me (and your patch seems
like the right thing to do).
-Peff
On 05.11.2021 08:06, Jeff King wrote:
On Fri, Nov 05, 2021 at 11:25:25AM +0000, Adam Dinwoodie wrote:
quoted
quoted
... I am not quite sure how this explains "tests relating to ssh
signing failing on Cygwin". After all, this piece of code is
lazy_prereq, which means that ssh-keygen in this block that fails
(due to a less restrictive permissions) would merely mean that tests
that are protected with GPGSSH prerequisite will be skipped without
causing test failures. After all that is the whole point of
computing prereq on the fly.
The issue is that the prerequisite check isn't _just_ checking a
prerequisite: it's also creating an SSH key that's used without further
modification by the tests.
This is sort of a side note to your main issue, but I think that relying
on a lazy_prereq for side effects is an anti-pattern. We make no
promises about when or how often the prereqs might be run, and we try to
insulate them from the main tests (by putting them in a subshell and
switching their cwd).
It does happen to work here because the prereq script writes directly to
$GNUPGHOME, and we run the lazy prereqs about when you'd expect. So I
don't think it's really in any danger of breaking, but it is definitely
not using the feature as it was intended. :)
I think the more usual way would be to have an actual
test_expect_success block that creates the keys as a setup step
(possibly triggered by a function, since it's included via lib-gpg.sh).
If we don't want to decide whether we have the GPGSSH prereq until then,
then that test can call test_set_prereq. See the LONG_REF case in t1401
for an example.
I was not aware of this. I assumed prereq not just meant checking for
pre requisites but also setting them up. Since i still have a follow up
patch series in progress i will keep that in mind and move the actual
setup code into a function in lib-gpg. There are gpg ssh tests in
multiple different test files so i didn't want to create keys for each
of them repeatedly. And i'm not a fan of checking in those file (like
the gpg keyring for testing) since it also needs documentation on how it
was generated that is not quaranteed to match how it was done.
We still could add the actual sign test into the prereq for now.
A `echo "test" | ssh-keygen -Y sign -f $GPGSSHKEY_PRIMARY -n "git"`
will make sure that the keys actually work.
Again, that's mostly a tangent to your issue, and maybe not worth
futzing with at this point in the release cycle. I'm mostly just
registering my surprise. ;)
quoted
There are three cases to consider:
- On systems where this prerequisite check fails, a key may or may not
be created, but the tests that rely on the key won't be run, so it
doesn't matter either way.
- On (clearly the mainline) systems where this check passes and there
are no ACL problems, the key that's generated is stored with
sufficiently restrictive permissions that the tests that rely on the
key can pass.
- On my system, where ACLs are a problem, the prerequisite check passes,
and a key is created, but it has permissions that are too permissive.
As a result, when a test calls OpenSSH to use that key, OpenSSH
refuses due to the permissions, and the test fails.
FWIW, that explanation makes perfect sense to me (and your patch seems
like the right thing to do).
-Peff