Skip to content

Inherit extended agent so we get modern sign hashes#1270

Merged
tonistiigi merged 2 commits into
moby:masterfrom
tlbdk:ssh2-support
Nov 22, 2019
Merged

Inherit extended agent so we get modern sign hashes#1270
tonistiigi merged 2 commits into
moby:masterfrom
tlbdk:ssh2-support

Conversation

@tlbdk
Copy link
Copy Markdown
Contributor

@tlbdk tlbdk commented Nov 19, 2019

Signed-off-by: Troels Liebe Bentsen <tlb@nversion.dk>
@tonistiigi
Copy link
Copy Markdown
Member

@tlbdk We should probably disable calling ExtendedAgent.Extension() by masking it in readOnlyAgent, right?

@tlbdk
Copy link
Copy Markdown
Contributor Author

tlbdk commented Nov 20, 2019

@tlbdk We should probably disable calling ExtendedAgent.Extension() by masking it in readOnlyAgent, right?

Hmm, it's a way to extend the protocol so it's not really clear that if it can be used to modify the state of the "host" ssh-agent as it can be used for anything. I guess this is the point of readOnlyAgent. I would leave it in as we don't know if this will be used in the future.

@tonistiigi
Copy link
Copy Markdown
Member

I think it is safer to block it. Don't want this to become a possible security issue. If there is a legitimate case (similar to #1265 for example) we could make a specific exception for that based on the input parameters.

@GordonTheTurtle
Copy link
Copy Markdown
Collaborator

Please sign your commits following these rules:
https://github.com/moby/moby/blob/master/CONTRIBUTING.md#sign-your-work
The easiest way to do this is to amend the last commit:

$ git clone -b "ssh2-support" git@github.com:tlbdk/buildkit.git somewhere
$ cd somewhere
$ git rebase -i HEAD~842354500256
editor opens
change each 'pick' to 'edit'
save the file and quit
$ git commit --amend -s --no-edit
$ git rebase --continue # and repeat the amend for each commit
$ git push -f

Amending updates the existing PR. You DO NOT need to open a new one.

Signed-off-by: Troels Liebe Bentsen <tlb@nversion.dk>
@tonistiigi tonistiigi merged commit adfc3dd into moby:master Nov 22, 2019
@tlbdk tlbdk deleted the ssh2-support branch November 22, 2019 21:55
@tonistiigi tonistiigi added this to the v0.6.4 milestone Jan 17, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

SSH agent forward downgrades signing algorithm to sha-rsa (from rsa-sha2-512)

4 participants