Re: [PATCH +warn] Implement https public key pinning

From

Junio C Hamano <gitster@pobox.com>

Date

Feb 17, 2016, 21:05 UTC

Message-ID

<xmqqlh6jhwu0.fsf@gitster.mtv.corp.google.com>

In-Reply-To

<20160215140422.GA1747@mitoraj.siccegge.de>

Christoph Egger <christoph@christoph-egger.org> writes:

> Add the http.pinnedpubkey configuration option for public key
> pinning. It allows any string supported by libcurl --
> base64(sha256(pubkey)) or filename of the full public key.
>
> If cURL does not support pinning (is too old) output a warning to the
> user.
>
> Signed-off-by: Christoph Egger <christoph@christoph-egger.org>
> ---

 http.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/http.c b/http.c
index a6b8076..3475040 100644
--- a/http.c
+++ b/http.c
@@ -219,13 +219,6 @@ static int http_options(const char *var, const char *value, void *cb)
 	if (!strcmp("http.sslcapath", var))
 		return git_config_pathname(&ssl_capath, var, value);
 #endif
-	if (!strcmp("http.pinnedpubkey", var))
-#if LIBCURL_VERSION_NUM >= 0x072c00
-		return git_config_pathname(&ssl_pinnedkey, var, value);
-#else
-		warning(_("Public key pinning not supported with cURL < 7.44.0"));
-		return 0;
-#endif
 	if (!strcmp("http.sslcainfo", var))
 		return git_config_pathname(&ssl_cainfo, var, value);
 	if (!strcmp("http.sslcertpasswordprotected", var)) {
@@ -283,6 +276,14 @@ static int http_options(const char *var, const char *value, void *cb)
 	if (!strcmp("http.useragent", var))
 		return git_config_string(&user_agent, var, value);
 
+	if (!strcmp("http.pinnedpubkey", var)) {
+#if LIBCURL_VERSION_NUM >= 0x072c00
+		return git_config_pathname(&ssl_pinnedkey, var, value);
+#else
+		warning(_("Public key pinning not supported with cURL < 7.44.0"));
+		return 0;
+#endif
+	}
 	/* Fall back on the default ones */
 	return git_default_config(var, value, cb);
 }