Skip to content

Commit 0693289

Browse files
hiddecohiddeco
authored
Merge pull request #338 from SomtochiAma/private-keyy-passwd
2 parents 47492c4 + d3d1917 commit 0693289

File tree

4 files changed

+60
-3
lines changed

4 files changed

+60
-3
lines changed

‎pkg/git/gogit/transport.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,8 @@ func (s *PublicKeyAuth) Method(secret corev1.Secret) (*git.Auth, error) {
8888
user = git.DefaultPublicKeyAuthUser
8989
}
9090

91-
pk, err := ssh.NewPublicKeys(user, identity, "")
91+
password := secret.Data["password"]
92+
pk, err := ssh.NewPublicKeys(user, identity, string(password))
9293
if err != nil {
9394
return nil, err
9495
}

‎pkg/git/gogit/transport_test.go‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,21 @@ v2MYnxRjc9INpi/Dyzz2MMvOnOW+aDuOh/If2AtVCmeJUx1pf4CFk3viQwJBAKyC
4343
t824+evjv+NQBlme3AOF6PgxtV4D4wWoJ5Uk/dTejER0j/Hbl6sqPxuiILRRV9qJ
4444
Ngkgu4mLjc3RfenEhJECQAx8zjWUE6kHHPGAd9DfiAIQ4bChqnyS0Nwb9+Gd4hSE
4545
P0Ah10mHiK/M0o3T8Eanwum0gbQHPnOwqZgsPkwXRqQ=
46+
-----END RSA PRIVATE KEY-----`
47+
48+
// secretKeyFixture is a randomly generated
49+
// 512bit RSA private key with password foobar.
50+
secretPassphraseFixture = `-----BEGIN RSA PRIVATE KEY-----
51+
Proc-Type: 4,ENCRYPTED
52+
DEK-Info: AES-256-CBC,0B016973B2A761D31E6B388D0F327C35
53+
54+
X9GET/qAyZkAJBl/RK+1XX75NxONgdUfZDw7PIYi/g+Efh3Z5zH5kh/dx9lxH5ZG
55+
HGCqPAeMO/ofGDGtDULWW6iqDUFRu5gPgEVSCnnbqoHNU325WHhXdhejVAItwObC
56+
IpL/zYfs2+gDHXct/n9FJ/9D/EGXZihwPqYaK8GQSfZAxz0QjLuh0wU1qpbm3y3N
57+
q+o9FLv3b2Ys/tCJOUsYVQOYLSrZEI77y1ii3nWgQ8lXiTJbBUKzuq4f1YWeO8Ah
58+
RZbdhTa57AF5lUaRtL7Nrm3HJUrK1alBbU7HHyjeW4Q4n/D3fiRDC1Mh2Bi4EOOn
59+
wGctSx4kHsZGhJv5qwKqqPEFPhUzph8D2tm2TABk8HJa5KJFDbGrcfvk2uODAoZr
60+
MbcpIxCfl8oB09bWfY6tDQjyvwSYYo2Phdwm7kT92xc=
4661
-----END RSA PRIVATE KEY-----`
4762

4863
// knownHostsFixture is known_hosts fixture in the expected
@@ -63,6 +78,13 @@ var (
6378
"known_hosts": []byte(knownHostsFixture),
6479
},
6580
}
81+
privateKeySecretWithPassphraseFixture = corev1.Secret{
82+
Data: map[string][]byte{
83+
"identity": []byte(secretPassphraseFixture),
84+
"known_hosts": []byte(knownHostsFixture),
85+
"password": []byte("foobar"),
86+
},
87+
}
6688
)
6789

6890
func TestAuthSecretStrategyForURL(t *testing.T) {
@@ -131,10 +153,13 @@ func TestPublicKeyStrategy_Method(t *testing.T) {
131153
wantErr bool
132154
}{
133155
{"private key and known_hosts", privateKeySecretFixture, nil, false},
156+
{"private key with passphrase and known_hosts", privateKeySecretWithPassphraseFixture, nil, false},
134157
{"missing private key", privateKeySecretFixture, func(s *corev1.Secret) { delete(s.Data, "identity") }, true},
135158
{"invalid private key", privateKeySecretFixture, func(s *corev1.Secret) { s.Data["identity"] = []byte(`-----BEGIN RSA PRIVATE KEY-----`) }, true},
136159
{"missing known_hosts", privateKeySecretFixture, func(s *corev1.Secret) { delete(s.Data, "known_hosts") }, true},
137160
{"invalid known_hosts", privateKeySecretFixture, func(s *corev1.Secret) { s.Data["known_hosts"] = []byte(`invalid`) }, true},
161+
{"missing password", privateKeySecretWithPassphraseFixture, func(s *corev1.Secret) { delete(s.Data, "password") }, true},
162+
{"wrong password", privateKeySecretWithPassphraseFixture, func(s *corev1.Secret) { s.Data["password"] = []byte("pass") }, true},
138163
{"empty", corev1.Secret{}, nil, true},
139164
}
140165
for _, tt := range tests {

‎pkg/git/libgit2/transport.go‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,13 @@ func (s *PublicKeyAuth) Method(secret corev1.Secret) (*git.Auth, error) {
121121

122122
// Need to validate private key as it is not
123123
// done by git2go when loading the key
124-
_, err = ssh.ParsePrivateKey(identity)
124+
password, ok := secret.Data["password"]
125+
if ok {
126+
_, err = ssh.ParsePrivateKeyWithPassphrase(identity, password)
127+
} else {
128+
_, err = ssh.ParsePrivateKey(identity)
129+
}
130+
125131
if err != nil {
126132
return nil, err
127133
}
@@ -132,7 +138,7 @@ func (s *PublicKeyAuth) Method(secret corev1.Secret) (*git.Auth, error) {
132138
}
133139

134140
credCallback := func(url string, usernameFromURL string, allowedTypes git2go.CredType) (*git2go.Cred, error) {
135-
cred, err := git2go.NewCredSshKeyFromMemory(user, "", string(identity), "")
141+
cred, err := git2go.NewCredSshKeyFromMemory(user, "", string(identity), string(password))
136142
if err != nil {
137143
return nil, err
138144
}

‎pkg/git/libgit2/transport_test.go‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,21 @@ v2MYnxRjc9INpi/Dyzz2MMvOnOW+aDuOh/If2AtVCmeJUx1pf4CFk3viQwJBAKyC
4444
t824+evjv+NQBlme3AOF6PgxtV4D4wWoJ5Uk/dTejER0j/Hbl6sqPxuiILRRV9qJ
4545
Ngkgu4mLjc3RfenEhJECQAx8zjWUE6kHHPGAd9DfiAIQ4bChqnyS0Nwb9+Gd4hSE
4646
P0Ah10mHiK/M0o3T8Eanwum0gbQHPnOwqZgsPkwXRqQ=
47+
-----END RSA PRIVATE KEY-----`
48+
49+
// secretKeyFixture is a randomly generated
50+
// 512bit RSA private key with password foobar.
51+
secretPassphraseFixture = `-----BEGIN RSA PRIVATE KEY-----
52+
Proc-Type: 4,ENCRYPTED
53+
DEK-Info: AES-256-CBC,0B016973B2A761D31E6B388D0F327C35
54+
55+
X9GET/qAyZkAJBl/RK+1XX75NxONgdUfZDw7PIYi/g+Efh3Z5zH5kh/dx9lxH5ZG
56+
HGCqPAeMO/ofGDGtDULWW6iqDUFRu5gPgEVSCnnbqoHNU325WHhXdhejVAItwObC
57+
IpL/zYfs2+gDHXct/n9FJ/9D/EGXZihwPqYaK8GQSfZAxz0QjLuh0wU1qpbm3y3N
58+
q+o9FLv3b2Ys/tCJOUsYVQOYLSrZEI77y1ii3nWgQ8lXiTJbBUKzuq4f1YWeO8Ah
59+
RZbdhTa57AF5lUaRtL7Nrm3HJUrK1alBbU7HHyjeW4Q4n/D3fiRDC1Mh2Bi4EOOn
60+
wGctSx4kHsZGhJv5qwKqqPEFPhUzph8D2tm2TABk8HJa5KJFDbGrcfvk2uODAoZr
61+
MbcpIxCfl8oB09bWfY6tDQjyvwSYYo2Phdwm7kT92xc=
4762
-----END RSA PRIVATE KEY-----`
4863

4964
// knownHostsFixture is known_hosts fixture in the expected
@@ -64,6 +79,13 @@ var (
6479
"known_hosts": []byte(knownHostsFixture),
6580
},
6681
}
82+
privateKeySecretWithPassphraseFixture = corev1.Secret{
83+
Data: map[string][]byte{
84+
"identity": []byte(secretPassphraseFixture),
85+
"known_hosts": []byte(knownHostsFixture),
86+
"password": []byte("foobar"),
87+
},
88+
}
6789
)
6890

6991
func TestAuthSecretStrategyForURL(t *testing.T) {
@@ -126,10 +148,13 @@ func TestPublicKeyStrategy_Method(t *testing.T) {
126148
wantErr bool
127149
}{
128150
{"private key and known_hosts", privateKeySecretFixture, nil, false},
151+
{"private key with passphrase and known_hosts", privateKeySecretWithPassphraseFixture, nil, false},
129152
{"missing private key", privateKeySecretFixture, func(s *corev1.Secret) { delete(s.Data, "identity") }, true},
130153
{"invalid private key", privateKeySecretFixture, func(s *corev1.Secret) { s.Data["identity"] = []byte(`-----BEGIN RSA PRIVATE KEY-----`) }, true},
131154
{"missing known_hosts", privateKeySecretFixture, func(s *corev1.Secret) { delete(s.Data, "known_hosts") }, true},
132155
{"invalid known_hosts", privateKeySecretFixture, func(s *corev1.Secret) { s.Data["known_hosts"] = []byte(`invalid`) }, true},
156+
{"missing password", privateKeySecretWithPassphraseFixture, func(s *corev1.Secret) { delete(s.Data, "password") }, true},
157+
{"invalid password", privateKeySecretWithPassphraseFixture, func(s *corev1.Secret) { s.Data["password"] = []byte("foo") }, true},
133158
{"empty", corev1.Secret{}, nil, true},
134159
}
135160
for _, tt := range tests {

0 commit comments

Comments
 (0)