<feed xmlns='http://www.w3.org/2005/Atom'>
<title>delta/gitlab/gitlab-shell.git/internal, branch master</title>
<subtitle>gitlab.com: gitlab-org/gitlab-shell.git
</subtitle>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/gitlab/gitlab-shell.git/'/>
<entry>
<title>Add 2fa_verify command</title>
<updated>2020-12-10T14:23:44+00:00</updated>
<author>
<name>Imre Farkas</name>
<email>ifarkas@gitlab.com</email>
</author>
<published>2020-12-01T13:46:27+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/gitlab/gitlab-shell.git/commit/?id=1293a33014c9cfc82b0bc1b9525987476b2aa857'/>
<id>1293a33014c9cfc82b0bc1b9525987476b2aa857</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>Include key ID and type in metadata</title>
<updated>2020-11-19T23:59:19+00:00</updated>
<author>
<name>Ash McKenzie</name>
<email>amckenzie@gitlab.com</email>
</author>
<published>2020-11-19T23:59:19+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/gitlab/gitlab-shell.git/commit/?id=97bb3321f711a21a33d1b9e1f3975654e23660b4'/>
<id>97bb3321f711a21a33d1b9e1f3975654e23660b4</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>use testhelper for SSH_CONNECTION</title>
<updated>2020-11-19T13:32:14+00:00</updated>
<author>
<name>Igor Wiedler</name>
<email>iwiedler@gitlab.com</email>
</author>
<published>2020-11-19T13:32:14+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/gitlab/gitlab-shell.git/commit/?id=f558aa505cb2803cc0680e9176f1e78b1f1a711a'/>
<id>f558aa505cb2803cc0680e9176f1e78b1f1a711a</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>test for client identity propagation</title>
<updated>2020-11-19T13:30:30+00:00</updated>
<author>
<name>Igor Wiedler</name>
<email>iwiedler@gitlab.com</email>
</author>
<published>2020-11-19T13:30:30+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/gitlab/gitlab-shell.git/commit/?id=cd3129c383d02aadbd8703a0483e85b444072205'/>
<id>cd3129c383d02aadbd8703a0483e85b444072205</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>Propagate client identity to gitaly</title>
<updated>2020-11-17T14:22:51+00:00</updated>
<author>
<name>Igor Wiedler</name>
<email>iwiedler@gitlab.com</email>
</author>
<published>2020-11-17T14:22:51+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/gitlab/gitlab-shell.git/commit/?id=f9384a90497bedc0002633b21076336c29a2c406'/>
<id>f9384a90497bedc0002633b21076336c29a2c406</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>GitLab API Client support for client certificates</title>
<updated>2020-11-17T04:01:50+00:00</updated>
<author>
<name>Paul Okstad</name>
<email>pokstad@gitlab.com</email>
</author>
<published>2020-11-17T04:01:50+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/gitlab/gitlab-shell.git/commit/?id=b16898c348ad4c110a87695903f8189ffd314033'/>
<id>b16898c348ad4c110a87695903f8189ffd314033</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>Fix incorrect actor used to check permissions for SSH receive-pack</title>
<updated>2020-10-19T20:26:46+00:00</updated>
<author>
<name>Stan Hu</name>
<email>stanhu@gmail.com</email>
</author>
<published>2020-10-19T20:06:59+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/gitlab/gitlab-shell.git/commit/?id=354f5bf20c3d1b48481bd4e6f4d4219f830b986b'/>
<id>354f5bf20c3d1b48481bd4e6f4d4219f830b986b</id>
<content type='text'>
During a SSH receive-pack request (e.g. `git push`), gitlab-shell was
incorrectly using the user returned by the `/internal/allowed` API
endpoint to make an SSHReceivePack RPC call. This caused a number of
problems with deploy keys with write access:

1. Keys that were generated by a blocked user would be denied the
ability to write.

2. Keys that were generated by user that did not have write access to
the project would also be denied.

GitLab 12.4 removed the Ruby implementation of gitlab-shell in favor of
the Golang implementation, and these implementations worked slightly
differently. In
https://gitlab.com/gitlab-org/gitlab-shell/blob/v10.1.0/lib/gitlab_shell.rb,
the Ruby implementation would always use `@who` (e.g. `key-123`), but in
gitlab-shell v10.2.0 the Go implementation would always use the user
from the API response.

Reads did not have this issue because the user/deploy key is never
passed to Gitaly for additional permission checks. Writes need this
information for the pre-receive to check access to protected branches,
push rules, etc.

Relates to https://gitlab.com/gitlab-org/gitlab-shell/-/issues/479
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
During a SSH receive-pack request (e.g. `git push`), gitlab-shell was
incorrectly using the user returned by the `/internal/allowed` API
endpoint to make an SSHReceivePack RPC call. This caused a number of
problems with deploy keys with write access:

1. Keys that were generated by a blocked user would be denied the
ability to write.

2. Keys that were generated by user that did not have write access to
the project would also be denied.

GitLab 12.4 removed the Ruby implementation of gitlab-shell in favor of
the Golang implementation, and these implementations worked slightly
differently. In
https://gitlab.com/gitlab-org/gitlab-shell/blob/v10.1.0/lib/gitlab_shell.rb,
the Ruby implementation would always use `@who` (e.g. `key-123`), but in
gitlab-shell v10.2.0 the Go implementation would always use the user
from the API response.

Reads did not have this issue because the user/deploy key is never
passed to Gitaly for additional permission checks. Writes need this
information for the pre-receive to check access to protected branches,
push rules, etc.

Relates to https://gitlab.com/gitlab-org/gitlab-shell/-/issues/479
</pre>
</div>
</content>
</entry>
<entry>
<title>Set SSL_CERT_DIR env var when building command</title>
<updated>2020-10-19T07:53:12+00:00</updated>
<author>
<name>Ash McKenzie</name>
<email>amckenzie@gitlab.com</email>
</author>
<published>2020-10-19T03:29:12+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/gitlab/gitlab-shell.git/commit/?id=0478ba97950bd6606f823c8a26eeeecf617df653'/>
<id>0478ba97950bd6606f823c8a26eeeecf617df653</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>Remove prefixing with SSL_CERT_DIR</title>
<updated>2020-10-19T07:53:11+00:00</updated>
<author>
<name>Ash McKenzie</name>
<email>amckenzie@gitlab.com</email>
</author>
<published>2020-10-19T03:41:45+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/gitlab/gitlab-shell.git/commit/?id=f5f9ffc086fe52e2651fb498a76673bda3392bfd'/>
<id>f5f9ffc086fe52e2651fb498a76673bda3392bfd</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>tests: Replace assert with require</title>
<updated>2020-10-15T06:44:05+00:00</updated>
<author>
<name>Zeger-Jan van de Weg</name>
<email>git@zjvandeweg.nl</email>
</author>
<published>2020-10-15T06:44:05+00:00</published>
<link rel='alternate' type='text/html' href='http://git.baserock.org/cgit/delta/gitlab/gitlab-shell.git/commit/?id=308948b3838c88621e738762241e8d1980881a17'/>
<id>308948b3838c88621e738762241e8d1980881a17</id>
<content type='text'>
Testify features sub packages `assert` and `require`. The difference is
subtle, and lost on novice Golang developers that don't read the docs.
To create a more consistent code base `assert` will no longer be used.

This change was generated by a running a sed command on all `_test.go`
files, followed by `goimports -w`.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Testify features sub packages `assert` and `require`. The difference is
subtle, and lost on novice Golang developers that don't read the docs.
To create a more consistent code base `assert` will no longer be used.

This change was generated by a running a sed command on all `_test.go`
files, followed by `goimports -w`.
</pre>
</div>
</content>
</entry>
</feed>
