Repository navigation
forge/: mirror binds the trail to the followed key, checks reachability, drops replays, hides refs/mirror - #15
Open
jjohare wants to merge 1 commit into
Conversation
…rk is reachable, drops replays and hides refs/mirror An independent read of the opt-in kind-30618 mirror found four gaps: - trailLists only checked profile and states, so a blocktrails.json copied from any other repository and listing the marked commit passed. The trail's pubkeyBase must now carry the followed agent's x-only key. - the marked commit was never required to be the moved-to commit or in its history; merge-base --is-ancestor now checks it after the fetch. - a validly signed older state could roll branches back when a newer one had been held by the rate limit. The record keeps newestSeenAt and drops anything older; an equal one (the catch-up resend) is kept. - a state with a partial or garbled chain/txo/commit read as "no mark", which switches the trail check off. It now reads as no state. Also: refs/mirror/ joins uploadpack.hideRefs, because the fetch lands every branch there before any verdict and a held branch was still fetchable by name. The verdict text no longer implies chain verification. Two existing tests are updated for the stricter rules; four cases added. 150 forge tests pass. Co-Authored-By: jjohare <github@thedreamlab.uk>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Four hardening fixes to the opt-in kind-30618 mirror (
40efb47,bd55eda,80a83d9). The mirror is off unlessconfig.mirroris set, so default installs are unaffected. These came out of porting the mirror to Rust (solid-pod-rs,solid-pod-rs-forge) and having it reviewed independently.trailListschecksprofileandstatesonly. Ablocktrails.jsoncopied from any other repository, listing the marked commit, satisfies the check. The trail'spubkeyBase(02/03+ x, or bare x) must now equal the followed agent's key (trailBelongsTo).git merge-base --is-ancestor <mark.commit> <sha>must hold, so the mark is the moved-to commit or in its history.update-refforce-moves to it. The record now keepsnewestSeenAt; older states are dropped, an equal one (the catch-up resend) is kept.chain/txo/commitset returnedmark: null, which moves the branch with no trail check.readStatenow returnsnullfor it.Also:
refs/mirror/is added touploadpack.hideRefs. The fetch lands every branch there before any verdict, so a branch the mirror held back was still fetchable by name from the served repo. The verdict text no longer reads as chain verification (the chain is not consulted; the stance that the browser checks it is unchanged).Not in this PR
Residual items left alone: DNS rebinding between the host check and git's own resolution, no fetch size cap beyond the 60 s timeout, and
applybeing awaited inside the socket loop.Tests
node --test --test-concurrency=1 forge/test.js: 150 pass (was 149). Two existing tests are updated for the stricter rules (the verdict test now supplies a key; the replay test expects the new reason). Added: partial/garbled marks read as null, foreign trail refused, unreachable mark refused,trailBelongsTocases.