Documentation
¶
Overview ¶
Package gitproxycreds interposes a git interception proxy between a sandbox and the forge.
It decorates an executor.WorkspaceCredentialSource. The inner source leases the forge credential exactly as before; this one keeps that credential on the hub, mints a pkg/gitproxy session against it, and hands the sandbox a session token plus a rewritten repository URL. The sandbox's git then talks to the proxy, and the proxy decides — per ref, on the push's own command list — whether an update is inside the branch allowlist.
What changes for the sandbox ¶
Nothing it can observe except the URL. The credential is still delivered as an HTTP basic header scoped to the repository's origin by executor.GitCredentialEnv, still never written to disk and never placed in an argv. Because the proxy's URL preserves the "owner/name" path (gitproxy.Minted.RepoURL), executor.Workspace.RepoPath keeps returning the same value, so grant matching and every audit row that names a repository are unaffected.
Why the decorator, and not a flag on the inner source ¶
Interception is a property of the deployment, not of a grant: the same GitHub grant is correct whether or not a hub routes through a proxy. Wrapping keeps pkg/executor/gitcreds solely about "which grant authorises this repository" and leaves "and how does the sandbox reach it" here, where an operator turns it on and off.
What a leaked token is worth ¶
The session token is worth the policy below, for the remaining TTL, against one repository, through one proxy: push to refs/heads/cloop/**, create and update only, and fetch. It is worth nothing against github.com directly. The PAT it stands in for is worth every repository the token is scoped to, in every direction, from anywhere, until someone revokes it.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type HeldSource ¶ added in v0.0.3
type HeldSource interface {
ForProxiedWorkspace(ctx context.Context, projectID string, w executor.Workspace) (executor.WorkspaceAccess, func(), error)
}
HeldSource is implemented by an inner source that can lease a credential knowing a git proxy, not the executor, will hold it. gitcreds.BrokerSource does; see its ForProxiedWorkspace for what that changes.
Discovered by type assertion rather than added to executor.WorkspaceCredentialSource, because only this decorator has anything to say through it and every other implementation — the fakes in driver tests included — would otherwise have to grow a method that means nothing to them.
type Source ¶
type Source struct {
// Inner leases the real forge credential. Required.
Inner executor.WorkspaceCredentialSource
// Registry mints the sessions. Required, and must be the same registry the
// running proxy authenticates against — sessions live in its memory, so a
// registry in another process could not authenticate what this one mints.
Registry *gitproxy.Registry
// Policy is applied to every session. The zero value means
// WriteBackPolicy plus fetch; see New.
Policy gitproxy.Policy
// TTL bounds a session. Zero means gitproxy.DefaultSessionTTL.
TTL time.Duration
// ExecutorID is the executor sessions are minted for, recorded on the
// audit row so a proxy event can be joined to a dispatch.
ExecutorID string
// Actor is the audit identity recorded on the mint.
Actor string
}
Source is an executor.WorkspaceCredentialSource that routes through a proxy.
func New ¶
func New(inner executor.WorkspaceCredentialSource, reg *gitproxy.Registry, policy gitproxy.Policy, ttl time.Duration, executorID, actor string) (*Source, error)
New returns a source that routes w through reg, or an error when it would be unusable.
The default policy is WriteBackPolicy with fetch added: create and update under refs/heads/cloop/**, no deletes, and the read half a provisioning fetch needs. Fetch is on because with a proxy interposed the *clone* also goes through it — that is the point, since it is what keeps the forge credential off the sandbox for both halves of the round trip.
func (*Source) ForWorkspace ¶
func (s *Source) ForWorkspace(ctx context.Context, projectID string, w executor.Workspace) (executor.WorkspaceAccess, func(), error)
ForWorkspace implements executor.WorkspaceCredentialSource.
The release function is always non-nil and gives back the *inner* lease — the forge credential the hub holds — exactly as the undecorated source does. It does not close the session: the sandbox fetches at the start of a run and pushes at the end, so a session closed when the credential was delivered would refuse the write-back it exists to authorise. A session's life is its TTL, and Registry.Close is how an operator ends one early.
Source Files