vole
Clone
Read only, no credentials:
https://rodent.software/git/vole.git
Write over SSH with a registered key:
git clone ssh://git@0.0.0.0:2222/vole.git
A free and open-source forge that lives in your Git repo.
refactor
c5902451905acdaa478f8476844ccd4a510d9ca9 · Keenan Nemetz · 16d ago · parent ec2aba4b
internal/sshserver/sshserver_test.go → server/ssh/sshserver_test.go +22−25
| @@ -1,4 +1,4 @@ | |||
| 1 | package sshserver | ||
| 1 | package ssh | ||
| 2 | 2 | ||
| 3 | 3 | import ( | |
| 4 | 4 | "crypto/ed25519" | |
| @@ -15,14 +15,13 @@ import ( | |||
| 15 | 15 | "testing" | |
| 16 | 16 | "time" | |
| 17 | 17 | ||
| 18 | "golang.org/x/crypto/ssh" | ||
| 18 | xssh "golang.org/x/crypto/ssh" | ||
| 19 | 19 | ||
| 20 | "github.com/rodent-software/vole/internal/access" | ||
| 21 | "github.com/rodent-software/vole/internal/acl" | ||
| 22 | "github.com/rodent-software/vole/internal/identity" | ||
| 23 | "github.com/rodent-software/vole/internal/lfs" | ||
| 24 | "github.com/rodent-software/vole/internal/repo" | ||
| 25 | "github.com/rodent-software/vole/internal/runs" | ||
| 20 | "github.com/rodent-software/vole/ci/runs" | ||
| 21 | "github.com/rodent-software/vole/core/lfs" | ||
| 22 | "github.com/rodent-software/vole/forge/access" | ||
| 23 | "github.com/rodent-software/vole/forge/identity" | ||
| 24 | "github.com/rodent-software/vole/forge/repo" | ||
| 26 | 25 | ) | |
| 27 | 26 | ||
| 28 | 27 | var binPath string | |
| @@ -160,18 +159,18 @@ func keypair(t *testing.T, path string) (string, string) { | |||
| 160 | 159 | if err != nil { | |
| 161 | 160 | t.Fatal(err) | |
| 162 | 161 | } | |
| 163 | blk, err := ssh.MarshalPrivateKey(priv, "test") | ||
| 162 | blk, err := xssh.MarshalPrivateKey(priv, "test") | ||
| 164 | 163 | if err != nil { | |
| 165 | 164 | t.Fatal(err) | |
| 166 | 165 | } | |
| 167 | 166 | if err := os.WriteFile(path, pem.EncodeToMemory(blk), 0o600); err != nil { | |
| 168 | 167 | t.Fatal(err) | |
| 169 | 168 | } | |
| 170 | sshPub, err := ssh.NewPublicKey(pub) | ||
| 169 | sshPub, err := xssh.NewPublicKey(pub) | ||
| 171 | 170 | if err != nil { | |
| 172 | 171 | t.Fatal(err) | |
| 173 | 172 | } | |
| 174 | line := strings.TrimSpace(string(ssh.MarshalAuthorizedKey(sshPub))) + " test@vole\n" | ||
| 173 | line := strings.TrimSpace(string(xssh.MarshalAuthorizedKey(sshPub))) + " test@vole\n" | ||
| 175 | 174 | if err := os.WriteFile(path+".pub", []byte(line), 0o644); err != nil { | |
| 176 | 175 | t.Fatal(err) | |
| 177 | 176 | } | |
| @@ -294,7 +293,7 @@ func TestReadOnlyUserCannotPush(t *testing.T) { | |||
| 294 | 293 | } | |
| 295 | 294 | } | |
| 296 | 295 | ||
| 297 | // TestExecWhitelistRefusesShell is the security test for this transport. A | ||
| 296 | // TestExecWhitelistRefusesShell is the security test for this githttp. A | ||
| 298 | 297 | // session that can exec arbitrary commands is a remote shell. | |
| 299 | 298 | func TestExecWhitelistRefusesShell(t *testing.T) { | |
| 300 | 299 | t.Parallel() | |
| @@ -342,10 +341,10 @@ func TestUnknownKeyRejected(t *testing.T) { | |||
| 342 | 341 | t.Parallel() | |
| 343 | 342 | h := newHarness(t) | |
| 344 | 343 | stranger, _ := keypair(t, filepath.Join(h.dir, "stranger")) | |
| 345 | if _, err := ssh.Dial("tcp", h.addr, &ssh.ClientConfig{ | ||
| 344 | if _, err := xssh.Dial("tcp", h.addr, &xssh.ClientConfig{ | ||
| 346 | 345 | User: "git", | |
| 347 | Auth: []ssh.AuthMethod{publicKey(t, stranger)}, | ||
| 348 | HostKeyCallback: ssh.InsecureIgnoreHostKey(), | ||
| 346 | Auth: []xssh.AuthMethod{publicKey(t, stranger)}, | ||
| 347 | HostKeyCallback: xssh.InsecureIgnoreHostKey(), | ||
| 349 | 348 | Timeout: 5 * time.Second, | |
| 350 | 349 | }); err == nil { | |
| 351 | 350 | t.Fatal("a key that is not registered was accepted") | |
| @@ -373,12 +372,12 @@ func TestRepoOutsideTheStoreIsRefused(t *testing.T) { | |||
| 373 | 372 | } | |
| 374 | 373 | } | |
| 375 | 374 | ||
| 376 | func (h *harness) dial(t *testing.T, keyPath string) *ssh.Client { | ||
| 375 | func (h *harness) dial(t *testing.T, keyPath string) *xssh.Client { | ||
| 377 | 376 | t.Helper() | |
| 378 | c, err := ssh.Dial("tcp", h.addr, &ssh.ClientConfig{ | ||
| 377 | c, err := xssh.Dial("tcp", h.addr, &xssh.ClientConfig{ | ||
| 379 | 378 | User: "git", | |
| 380 | Auth: []ssh.AuthMethod{publicKey(t, keyPath)}, | ||
| 381 | HostKeyCallback: ssh.InsecureIgnoreHostKey(), | ||
| 379 | Auth: []xssh.AuthMethod{publicKey(t, keyPath)}, | ||
| 380 | HostKeyCallback: xssh.InsecureIgnoreHostKey(), | ||
| 382 | 381 | Timeout: 5 * time.Second, | |
| 383 | 382 | }) | |
| 384 | 383 | if err != nil { | |
| @@ -388,7 +387,7 @@ func (h *harness) dial(t *testing.T, keyPath string) *ssh.Client { | |||
| 388 | 387 | return c | |
| 389 | 388 | } | |
| 390 | 389 | ||
| 391 | func publicKey(t *testing.T, path string) ssh.AuthMethod { | ||
| 390 | func publicKey(t *testing.T, path string) xssh.AuthMethod { | ||
| 392 | 391 | t.Helper() | |
| 393 | 392 | raw, err := os.ReadFile(path) | |
| 394 | 393 | if err != nil { | |
| @@ -398,15 +397,15 @@ func publicKey(t *testing.T, path string) ssh.AuthMethod { | |||
| 398 | 397 | if blk == nil { | |
| 399 | 398 | t.Fatal("bad private key") | |
| 400 | 399 | } | |
| 401 | key, err := ssh.ParseRawPrivateKey(pem.EncodeToMemory(blk)) | ||
| 400 | key, err := xssh.ParseRawPrivateKey(pem.EncodeToMemory(blk)) | ||
| 402 | 401 | if err != nil { | |
| 403 | 402 | t.Fatal(err) | |
| 404 | 403 | } | |
| 405 | signer, err := ssh.NewSignerFromKey(key) | ||
| 404 | signer, err := xssh.NewSignerFromKey(key) | ||
| 406 | 405 | if err != nil { | |
| 407 | 406 | t.Fatal(err) | |
| 408 | 407 | } | |
| 409 | return ssh.PublicKeys(signer) | ||
| 408 | return xssh.PublicKeys(signer) | ||
| 410 | 409 | } | |
| 411 | 410 | ||
| 412 | 411 | func TestSplitCommand(t *testing.T) { | |
| @@ -458,5 +457,3 @@ func TestRepoNameValidation(t *testing.T) { | |||
| 458 | 457 | } | |
| 459 | 458 | } | |
| 460 | 459 | } | |
| 461 | |||
| 462 | var _ = acl.Read | ||