Re: [PATCH] http: check CURLE_SSL_PINNEDPUBKEYNOTMATCH when emitting errors

From: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
Date: Oct 11, 2021, 13:23 UTC
Message-ID: <87k0ijlmon.fsf@evledraar.gmail.com>
In-Reply-To: <20211011044730.GF571180@szeder.dev>

On Mon, Oct 11 2021, SZEDER Gábor wrote:

Show 21 quoted lines

> On Mon, Oct 11, 2021 at 03:49:39AM +0200, Ævar Arnfjörð Bjarmason wrote:
>> 
>> On Sun, Oct 10 2021, SZEDER Gábor wrote:
>> 
>> > On Fri, Sep 24, 2021 at 12:08:20PM +0200, Ævar Arnfjörð Bjarmason wrote:
>> >> Change the error shown when a http.pinnedPubKey doesn't match to point
>> >> the http.pinnedPubKey variable 
>> >
>> > I'm not sure what this means.  Between the repeated
>> > 'http.pinnedPubKey' config variable name and the "doesn't match to
>> > point the ..." part I can't decipher it.
>> 
>> It should be "point to the" (but this grammar error is already in
>> "next").
>
> So it's supposed to be
>
>   ... a http.pinnedPubKey doesn't point to the http.pinnedPubKey
>   variable ...
>
> ?  I still have no idea because of the repeated config variable name.

We emit this currently:

    $ git -c http.pinnedPubKey=sha256/someNonMatchingKey ls-remote https://github.com/git/git.git
    fatal: unable to access 'https://github.com/git/git.git/': SSL: public key does not match pinned public key!

And with this change, this:

    $ git -c http.pinnedPubKey=sha256/someNonMatchingKey ls-remote https://github.com/git/git.git
    fatal: unable to access 'https://github.com/git/git.git/' with http.pinnedPubkey configuration: SSL: public key does not match pinned public key!

I.e. this replaces a generic error message from curl with something that points the user at the config variable in question.