GNU bug report logs - #26717
Avoid references to the store in authorized_keys

Previous Next

Full log

View this message in rfc822 format

From: Clément Lassieur <clement <at> lassieur.org>
To: ng0 <contact.ng0 <at> cryptolab.net>
Cc: Marius Bakke <mbakke <at> fastmail.com>, 26717 <at> debbugs.gnu.org
Subject: bug#26717: [PATCH] gnu: gitolite: Avoid references to the store in authorized_keys.
Date: Sun, 30 Apr 2017 23:57:58 +0200

ng0 <contact.ng0 <at> cryptolab.net> writes:

> Clément Lassieur transcribed 1.3K bytes:
>> * gnu/packages/version-control.scm (gitolite)[arguments]: Substitute
>> '$glshell' with 'gitolite-shell' in ssh-authkeys.
>> ---
>>  gnu/packages/version-control.scm | 8 +++++++-
>>  1 file changed, 7 insertions(+), 1 deletion(-)
>> 
>> diff --git a/gnu/packages/version-control.scm b/gnu/packages/version-control.scm
>> index e0770dc58..1cad0f285 100644
>> --- a/gnu/packages/version-control.scm
>> +++ b/gnu/packages/version-control.scm
>> @@ -628,7 +628,13 @@ also walk each side of a merge and test those changes individually.")
>>                          ;; invokes Perl.
>>                          (substitute* (find-files "." ".*")
>>                            ((" perl -")
>> -                           (string-append " " perl " -"))))))
>> +                           (string-append " " perl " -")))
>> +
>> +                        ;; Avoid references to the store in authorized_keys.
>> +                        ;; This works because gitolite-shell is in the PATH.
>> +                        (substitute* "src/triggers/post-compile/ssh-authkeys"
>> +                          (("\\$glshell \\$user")
>> +                           "gitolite-shell $user")))))
>>                    (replace 'install
>>                      (lambda* (#:key outputs #:allow-other-keys)
>>                        (let* ((output (assoc-ref outputs "out"))
>> -- 
>> 2.12.2
>> 
>> 
>> 
>> 
>
> This looks good. I have yet to test it. Do you think we could fix the hook files of gitolite like this too?

Well, I don't think so because the mechanism used in hooks is different:
the reference to the store is in the shebang and shebangs need absolute
paths, they don't look at PATH.  We could use 'env' though, as suggested
by Marius here:
http://lists.gnu.org/archive/html/guix-patches/2017-03/msg00339.html.
As in:

    #!/run/current-system/profile/bin/env perl

Assuming /run/current-system/profile/bin/env exists on all possible
setups.  WDYT?

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.