Allow users to tag each branch tip and sign it · Entire

Allow users to tag each branch tip and sign it

3001f9a→main·

nodo·1mo ago·4 files·+244 added/-9 removed

This allows to "sign" the conversion.

Sessions

Transcript data is unavailable for this checkpoint.

Changes

4

81 unmodified lines

82
83
84
85
86
87
88
89
90
91

81 unmodified lines

"show live per-phase object counts on stderr (TTY only)")
    cmd.Flags().BoolVar(&req.Check, "check", false,
        "verify the output after conversion (config, HEAD, refs, git fsck --full)")
    cmd.Flags().BoolVar(&req.Sign, "sign", false,
        "after conversion, sign each branch tip as refs/tags/converted/<branch> via `git tag -s`")
    cmd.Flags().StringVar(&req.SignKey, "sign-key", "",
        "signing key id to pass to `git tag -s -u`; default uses the repo's user.signingkey")
    cmd.Flags().BoolVar(&req.KeepSourceObjects, "keep-source-objects", false,
        "keep the temporary SHA1 store on disk after conversion (for debugging)")
    cmd.Flags().StringVar(&req.MappingFile, "write-mapping", "",

Mcmd/git-sync/convert_sha256.go+4

65 unmodified lines

66
67
68
69
70
71
72
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
34 unmodified lines

119
120
121
122
123
124
125
43 unmodified lines

169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
177 unmodified lines

367
368
369
370
371
372
373
374
375
376
377
378
379
380
19 unmodified lines

400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
27 unmodified lines

489
490
491
403
492
493
494
495
496
497
498
499
4 unmodified lines

504
505
506
414
415
507
508
509
510
511
512
513
514
515
420
516
517
518
519
28 unmodified lines

548
549
550
455
551
552
553
554
555
556
557

65 unmodified lines

AllRefs            bool
    ExcludeRefPrefixes []string

ProtocolMode      gitsync.ProtocolMode
    Verbose           bool
    Progress          bool
    Check             bool
    ProtocolMode gitsync.ProtocolMode
    Verbose      bool
    Progress     bool
    Check        bool

// Sign, when true, runs `git tag -s converted/<branch> <tip>` for
    // every converted branch after the conversion completes, attesting
    // the entire reachable history of each branch via its tip's parent
    // chain. SignKey is passed to git as `-u <SignKey>`; leave empty to
    // use the repo's default signing identity.
    Sign    bool
    SignKey string

KeepSourceObjects bool

// MappingFile, when non-empty, is a path to which a TSV of every
    34 unmodified lines

AmbiguousMessageRefs []string `json:"ambiguousMessageRefs,omitempty"`
    OriginNotesRef       string   `json:"originNotesRef,omitempty"`
    MappingFile          string   `json:"mappingFile,omitempty"`
    SignedTags           []string `json:"signedTags,omitempty"`
    Checks               []Check  `json:"checks,omitempty"`
    TempDir              string   `json:"tempDir,omitempty"`
}
43 unmodified lines

if r.MappingFile != "" {
    lines = append(lines, fmt.Sprintf("mapping written to: %s", r.MappingFile))
}
if n := len(r.SignedTags); n > 0 {
    preview := r.SignedTags
    const max = 5
    extra := 0
    if len(preview) > max {
        extra = len(preview) - max
        preview = preview[:max]
    }
    line := fmt.Sprintf("signed %d branch attestation tag(s): %s",
        n, strings.Join(preview, ", "))
    if extra > 0 {
        line += fmt.Sprintf(", ... (%d more; full list in --json)", extra)
    }
    lines = append(lines, line)
}
if r.TempDir != "" {
    lines = append(lines, fmt.Sprintf("kept source objects: %s", r.TempDir))
}
177 unmodified lines

res.MappingFile = req.MappingFile
}

if req.Sign {
    signed, err := signBranchTips(out, req.TargetDir, req.SignKey, req.SourceURL, desired)
    if err != nil {
        return res, fmt.Errorf("sign: %w", err)
    }
    res.SignedTags = signed
}

if req.KeepSourceObjects {
    cleanupTemp = false
    res.TempDir = tempDir
}
19 unmodified lines

return res, nil
}

// signBranchTips runs `git tag -s converted/<branch> <branch>` for every
// branch in the desired set. The converter's signing identity (whatever
// `user.signingkey` / `gpg.format` is set to in the target repo, or the
// caller-supplied signKey) attests each branch's full reachable history
// via the parent chain encoded in the tip commit's bytes.
//
// stdin/stderr are inherited so gpg/ssh-agent prompts work
// interactively. A failure short-circuits the run; tags signed before
// the failure stay in the target repo.
func signBranchTips(out io.Writer, targetDir, signKey, sourceURL string, desired map[plumbing.ReferenceName]planner.DesiredRef) ([]string, error) {
    gitBin, err := exec.LookPath("git")
    if err != nil {
        return nil, fmt.Errorf("git binary required to sign: %w", err)
    }
    // Iterate in a deterministic order so re-runs over the same source
    // produce the same sequence of tags (modulo the signature payload,
    // which carries the signer's timestamp).
    branchNames := make([]string, 0, len(desired))
    for name := range desired {
        if name.IsBranch() {
            branchNames = append(branchNames, string(name))
        }
    }
sort.Strings(branchNames)

var signed []string
    for _, refName := range branchNames {
        shortName := plumbing.ReferenceName(refName).Short()
        tagName := strings.TrimPrefix(attestationTagPrefix, "refs/tags/") + shortName
        fmt.Fprintf(out, "signing %s ...\n", "refs/tags/"+tagName)

msg := fmt.Sprintf(
            "SHA1 → SHA256 conversion attestation for %s.\n\n"+
            "Source: %s\nProduced by git-sync convert-sha256.\n",
            refName, sourceURL)
        args := []string{"-C", targetDir, "tag", "-s", "-m", msg}
        if signKey != "" {
            args = append(args, "-u", signKey)
        }
        args = append(args, tagName, refName)

cmd := exec.Command(gitBin, args...)
        // Inherit stdio so gpg/ssh-agent passphrase prompts work. We
        // intentionally do not capture stdout/stderr — the user needs
        // to see them when authenticating.
        cmd.Stdin = os.Stdin
        cmd.Stdout = os.Stdout // git tag -s is usually quiet on success
        cmd.Stderr = os.Stderr
        if err := cmd.Run(); err != nil {
            return signed, fmt.Errorf("git tag -s %s: %w", tagName, err)
        }
        signed = append(signed, "refs/tags/"+tagName)
    }
    return signed, nil
}

// runChecks performs lightweight verification of the converted repo.
// Returns one Check per step. Callers print and/or fail-on-error based
// on these. No early return so users see the full picture even when an
27 unmodified lines

}
}

// 3. Every written ref resolves to an existing object.
// 3. Every written ref resolves to an existing object. Skip refs we
// add as side outputs (the origin-notes ref and any
// refs/tags/converted/* attestation tags from --sign), since they
// are accounted for in their own Result fields and would otherwise
// make the displayed fraction misleading.
resolved := 0
missing := ""
refs, err := repo.References()
4 unmodified lines

if r.Type() != plumbing.HashReference {
            return nil
        }
        if r.Name() == plumbing.ReferenceName(originNotesRef) {
            // Counted separately below; not in the refsExpected total.
            name := r.Name()
            if name == plumbing.ReferenceName(originNotesRef) {
                return nil
            }
            if strings.HasPrefix(string(name), attestationTagPrefix) {
                return nil
            }
            if _, err := repo.Storer.EncodedObject(plumbing.AnyObject, r.Hash()); err != nil {
                if missing == "" {
                    missing = fmt.Sprintf("%s → %s: %v", r.Name(), r.Hash(), err)
                    missing = fmt.Sprintf("%s → %s: %v", name, r.Hash(), err)
                }
                return nil
            }
28 unmodified lines

return checks
}

const originNotesRef = "refs/notes/sha1-origin"
const (
    originNotesRef       = "refs/notes/sha1-origin"
    attestationTagPrefix = "refs/tags/converted/"
)

// ensureEmptyTarget refuses to init into a non-empty directory so the user
// doesn't quietly accumulate objects into an existing repo.

Mcmd/git-sync/internal/sha256convert/sha256convert.go+108/-9

776 unmodified lines

777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877

776 unmodified lines

}
}

// TestRun_GitHTTPBackend_Sign verifies the --sign path end-to-end. SSH
// signing is used (not GPG) because it can be set up from scratch in the
// test with just ssh-keygen, no agent required.
func TestRun_GitHTTPBackend_Sign(t *testing.T) {
    if os.Getenv(gitHTTPBackendEnv) == "" {
        t.Skipf("set %s=1 to run the convert-sha256 git-http-backend integration test", gitHTTPBackendEnv)
    }
    gitBin, err := exec.LookPath("git")
    if err != nil {
        t.Skipf("git binary not available: %v", err)
    }
    sshKeygenBin, err := exec.LookPath("ssh-keygen")
    if err != nil {
        t.Skipf("ssh-keygen not available: %v", err)
    }

root := t.TempDir()
    srcBare := filepath.Join(root, "source.git")
    worktree := filepath.Join(root, "work")
    dstDir := filepath.Join(root, "target.git")

mustGit(t, root, "init", "--bare", srcBare)
    mustGit(t, root, "init", "-b", "main", worktree)
    mustGit(t, worktree, "config", "user.name", "convert-sha256 test")
    mustGit(t, worktree, "config", "user.email", "test@example.com")
    mustWrite(t, filepath.Join(worktree, "README"), "hello\n")
    mustGit(t, worktree, "add", "README")
    mustGit(t, worktree, "commit", "-m", "initial")
    mustGit(t, worktree, "remote", "add", "origin", srcBare)
    mustGit(t, worktree, "push", "origin", "HEAD:refs/heads/main");

// Generate an ephemeral ed25519 SSH key for signing.
    keyPath := filepath.Join(root, "signkey")
    keygen := exec.Command(sshKeygenBin, "-q", "-t", "ed25519", "-N", "", "-f", keyPath, "-C", "test@example.com")
    if out, err := keygen.CombinedOutput(); err != nil {
        t.Fatalf("ssh-keygen: %v\n%s", err, out)
    }

// Write a global gitconfig that points git at SSH signing using the
    // ephemeral key, and route GIT_CONFIG_GLOBAL at it so signBranchTips'
    // subprocess inherits the config.
    globalCfg := filepath.Join(root, "global.gitconfig")
    if err := os.WriteFile(globalCfg, []byte(fmt.Sprintf(`
[user]
    name = Conversion Test
    email = test@example.com
    signingkey = %s
[gpg]
    format = ssh
`, keyPath)), 0o600); err != nil {
        t.Fatalf("write global gitconfig: %v", err)
    }
    t.Setenv("GIT_CONFIG_GLOBAL", globalCfg)
    // Disable any system gitconfig so the test isn't influenced by host
    // signing config.
    t.Setenv("GIT_CONFIG_SYSTEM", "/dev/null");

srv := newCGIBackend(t, gitBin, root)
    defer srv.Close();

res, err := Run(context.Background(), Request{
        SourceURL: srv.URL + "/source.git",
        TargetDir: dstDir,
        Sign:      true,
        Out:       io.Discard,
    })
    if err != nil {
        t.Fatalf("convert-sha256 run: %v", err)
    }

wantTag := "refs/tags/converted/main"
    if len(res.SignedTags) != 1 || res.SignedTags[0] != wantTag {
        t.Errorf("SignedTags: got %v, want [%s]", res.SignedTags, wantTag)
    }

// The tag exists in the target and is an annotated, signed tag (the
    // body contains a SSH SIGNATURE block; cat-file -p shows the tag
    // object including the signature).
    tagShow := mustGitOutput(t, dstDir, "cat-file", "-p", wantTag)
    if !strings.Contains(tagShow, "BEGIN SSH SIGNATURE") {
        t.Errorf("expected signed tag to contain an SSH SIGNATURE block:\n%s", tagShow)
    }
    if !strings.Contains(tagShow, "SHA1 → SHA256 conversion attestation") {
        t.Errorf("expected signed tag message to contain attestation text:\n%s", tagShow)
    }

// Tag's target should be the branch tip (the SHA256 hash of the
    // converted main).
    mainTip := strings.TrimSpace(mustGitOutput(t, dstDir, "rev-parse", "refs/heads/main"))
    tagTarget := strings.TrimSpace(mustGitOutput(t, dstDir, "rev-list", "-n", "1", wantTag))
    if tagTarget != mainTip {
        t.Errorf("signed tag target: got %s, want %s (main tip)", tagTarget, mainTip)
    }
}

func mustGit(t *testing.T, dir string, args ...string) {
    t.Helper()
    cmd := exec.Command("git", args...)