git-remote-entire: document TLS-skip caveat; test empty advertised cores

eadaf60·

Soph·1mo ago·2 files·+24 added/-0 removed

• Note in the resolveEnvTokenCreds SECURITY comment that the trust gate is only as strong as TLS verification: ENTIRE_TLS_SKIP_VERIFY degrades it, so it must not be combined with ENTIRE_TOKEN in CI.
• Add TestResolveEnvTokenCreds_EmptyAdvertisedCoresAborts: discovery returning HTTP 200 with an empty core_urls list must fail closed, not trust the aud.

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

Changes

2

• cmd/git-remote-entire

• Mmain.go+6

• Mmain_test.go+18

180 unmodified lines

// actually advertises — anchored to the clone URL's host the user typed (TLS to
// its /.well-known/entire-cluster.json), not to the token's own claims. Without
// this gate a forged aud could redirect the token to an attacker-chosen host.
//
// The gate is only as strong as that TLS verification: with
// ENTIRE_TLS_SKIP_VERIFY=true (a local-dev escape hatch) the well-known fetch
// is no longer authenticated, so a MITM could advertise an attacker host as a
// trusted core. Do not combine ENTIRE_TOKEN with ENTIRE_TLS_SKIP_VERIFY in
// CI / workload-identity environments.
func resolveEnvTokenCreds(ctx context.Context, envToken, clusterHost, clusterBaseURL, cacheDir string, httpClient *http.Client) (*repocreds.Cache, error) {
    // Trim once here so both the aud-derivation and the exchanged subject_token
    // use the cleaned value. A token sourced via $(cat token) often carries a

161 unmodified lines

func TestResolveEnvTokenCreds_EmptyAdvertisedCoresAborts(t *testing.T) {
    t.Parallel()
    // Discovery succeeds (HTTP 200) but advertises no cores. With nothing to
    // trust, the gate must fail closed rather than trusting the token's aud.
    srv, clusterHost := wellKnownServer(t, []string{})

creds, err := resolveEnvTokenCreds(
        t.Context(), makeTestJWT(t, "https://core.us.entire.io"), clusterHost,
        "https://cluster.example.com", t.TempDir(), srv.Client(),
    )
    if err == nil {
        t.Fatal("expected empty advertised core set to be rejected")
    }
    if creds != nil {
        t.Fatal("expected nil creds when no cores are advertised")
    }
}

func TestResolveEnvTokenCreds_DiscoveryFailureAborts(t *testing.T) {
    t.Parallel()
    // Cluster advertises no cores (HTTP 503) → discovery fails → we must abort