Browse Source
gitolite: Drop openssh dependency
Current dropbear is sufficient for gitolite purposes, so don't require openssh (we don't do a dependency on either dropbear or openssh as they are not yet drop-in replacements in terms of packaging for the functions shared between them). To achieve tihs we also eliminate the dependency on ssh-keygen. Previously gitolite used ssh-keygen to generate fingerprints from OpenSSH keys to ensure non-duplication of keys when processing them to create / manage user ssh access to the git repositories. Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com>lilik-openwrt-22.03
Daniel F. Dickinson
6 years ago
2 changed files with 153 additions and 6 deletions
Unified View
Diff Options
+ 21
- 6
net/gitolite/Makefile
View File
+ 132
- 0
net/gitolite/patches/0100-avoid-ssh-keygen.patch
View File
| @ -0,0 +1,132 @@ | |||||
| Author: Daniel F. Dickinson <cshored@thecshore.com> | |||||
| Date: Sun Jan 27 01:04:25 2019 -0500 | |||||
| gitolite: Eliminate the need for ssh-keygen dependency | |||||
| Previously gitolite used ssh-keygen to generate fingerprints | |||||
| from OpenSSH keys to ensure non-duplication of keys when | |||||
| processing them to create / manage user ssh access to the | |||||
| git repositories. This ends up depending on openssl, | |||||
| which is large and unnecessary when we are running on an | |||||
| embedded distro such as OpenWrt. | |||||
| Signed-off-by: Daniel F. Dickinson <cshored@thecshore.com> | |||||
| Index: gitolite-3.6.11/src/lib/Gitolite/Common.pm | |||||
| =================================================================== | |||||
| --- gitolite-3.6.11.orig/src/lib/Gitolite/Common.pm | |||||
| +++ gitolite-3.6.11/src/lib/Gitolite/Common.pm | |||||
| @@ -26,6 +26,8 @@ package Gitolite::Common; | |||||
| use Exporter 'import'; | |||||
| use File::Path qw(mkpath); | |||||
| use File::Temp qw(tempfile); | |||||
| +use MIME::Base64 qw(decode_base64); | |||||
| +use Digest::SHA qw(sha256_base64); | |||||
| use Carp qw(carp cluck croak confess); | |||||
| use strict; | |||||
| @@ -352,43 +352,82 @@ sub logger_plus_stderr { | |||||
| } | |||||
| # ---------------------------------------------------------------------- | |||||
| +# Decode OpenSSH key | |||||
| +# If the key cannot be parsed it will be undef | |||||
| +# Returns (algorithm_name, algo_data1, algo_data2, ...) | |||||
| +sub ssh_decode_key($) { | |||||
| + my $key = shift; | |||||
| + my $keydata = decode_base64($key); | |||||
| + my @keyparts = (); | |||||
| + my $partlen; | |||||
| + my $algorithm; | |||||
| + my $data; | |||||
| + my $pos = 0; | |||||
| + $partlen = unpack('N', substr $keydata, $pos, 4) or return undef; | |||||
| + $algorithm = substr $keydata, $pos + 4, $partlen or return undef; | |||||
| + $pos = $pos + 4 + $partlen; | |||||
| + while ( $pos <= length($keydata) ) { | |||||
| + $partlen = unpack('N', substr $keydata, $pos, 4) or last; | |||||
| + $data = unpack('s>*', substr $keydata, $pos + 4, 4) or last; | |||||
| + $pos = $pos + 4 + $partlen; | |||||
| + push @keyparts, $data; | |||||
| + } | |||||
| + return ( $algorithm, @keyparts ); | |||||
| +} | |||||
| + | |||||
| +# ---------------------------------------------------------------------- | |||||
| +# Parse OpenSSH line | |||||
| +# If the file cannot be parsed it will be undef | |||||
| +# Returns (restrictions, algorithm, PEMkey, comment) | |||||
| +sub ssh_parse_line($) { | |||||
| + my $ssh_line = shift; | |||||
| + my @ssh_parts = split / /, $ssh_line, 5; | |||||
| + if (scalar @ssh_parts < 4) { | |||||
| + @ssh_parts = ('', @ssh_parts); | |||||
| + } | |||||
| + if (scalar @ssh_parts > 4) { | |||||
| + @ssh_parts = @ssh_parts[0,3] | |||||
| + } | |||||
| + if (scalar @ssh_parts < 4) { | |||||
| + @ssh_parts = undef; | |||||
| + } | |||||
| + return ( @ssh_parts ); | |||||
| +} | |||||
| + | |||||
| +# ---------------------------------------------------------------------- | |||||
| +# Get the SSH fingerprint of a line of text | |||||
| +# If the fingerprint cannot be parsed, it will be undef | |||||
| +# In a scalar context, returns the fingerprint | |||||
| +# In a list context, returns (fingerprint, output) where output | |||||
| +# is the parsed input line (less algorithm) | |||||
| +sub ssh_fingerprint_line($) { | |||||
| + my $ssh_line = shift; | |||||
| + my @parsed_line = ssh_parse_line($ssh_line) or return undef; | |||||
| + my @ssh_parts = ssh_decode_key($parsed_line[2]) or return undef; | |||||
| + ( $parsed_line[1] eq $ssh_parts[0] ) or die "algorithm mismatch: $parsed_line[1] vs. $ssh_parts[0]"; | |||||
| + my $fp = sha256_base64(join(' ', @ssh_parts[1,-1])); | |||||
| + return wantarray ? ($fp, join(' ', @ssh_parts[1,-1])) : $fp; | |||||
| +} | |||||
| + | |||||
| +# ---------------------------------------------------------------------- | |||||
| # Get the SSH fingerprint of a file | |||||
| # If the fingerprint cannot be parsed, it will be undef | |||||
| # In a scalar context, returns the fingerprint | |||||
| # In a list context, returns (fingerprint, output) where output | |||||
| -# is the raw output of the ssh-keygen command | |||||
| -sub ssh_fingerprint_file { | |||||
| +# is the raw input line | |||||
| +sub ssh_fingerprint_file($) { | |||||
| my $in = shift; | |||||
| -f $in or die "file not found: $in\n"; | |||||
| my $fh; | |||||
| - open( $fh, "ssh-keygen -l -f $in |" ) or die "could not fork: $!\n"; | |||||
| + open( $fh, $in ) or die "could not open $in: $!\n"; | |||||
| my $output = <$fh>; | |||||
| chomp $output; | |||||
| - # dbg("fp = $fp"); | |||||
| close $fh; | |||||
| # Return a valid fingerprint or undef | |||||
| - my $fp = undef; | |||||
| - if($output =~ /((?:MD5:)?(?:[0-9a-f]{2}:){15}[0-9a-f]{2})/i or | |||||
| - $output =~ m{((?:RIPEMD|SHA)\d+:[A-Za-z0-9+/=]+)}i) { | |||||
| - $fp = $1; | |||||
| - } | |||||
| + my $fp = ssh_fingerprint_line($output); | |||||
| return wantarray ? ($fp, $output) : $fp; | |||||
| } | |||||
| -# Get the SSH fingerprint of a line of text | |||||
| -# If the fingerprint cannot be parsed, it will be undef | |||||
| -# In a scalar context, returns the fingerprint | |||||
| -# In a list context, returns (fingerprint, output) where output | |||||
| -# is the raw output of the ssh-keygen command | |||||
| -sub ssh_fingerprint_line { | |||||
| - my ( $fh, $fn ) = tempfile(); | |||||
| - print $fh shift() . "\n"; | |||||
| - close $fh; | |||||
| - my ($fp,$output) = ssh_fingerprint_file($fn); | |||||
| - unlink $fn; | |||||
| - return wantarray ? ($fp,$output) : $fp; | |||||
| -} | |||||
| - | |||||
| # ---------------------------------------------------------------------- | |||||
| # bare-minimum subset of 'Tsh' (see github.com/sitaramc/tsh) | |||||