mirror of
https://code.forgejo.org/forgejo/runner.git
synced 2025-09-30 19:22:09 +00:00
a3aedba3f1
It was raised during embargo review of #925 that there are two implementations of `computeMac`; this PR fixes that. As all the tests for `computeMac` were in the `artifactcache` package, it made more sense to keep the method there. That required reversing the dependency `artifactcache->cacheproxy` package dependency -- it makes more sense to me for the proxy to depend on the cache, rather than vice-versa. <!--start release-notes-assistant--> <!--URL:https://code.forgejo.org/forgejo/runner--> - other - [PR](https://code.forgejo.org/forgejo/runner/pulls/936): <!--number 936 --><!--line 0 --><!--description cmVmYWN0b3I6IHJlbW92ZSBkdXBsaWNhdGUgY29tcHV0ZU1hYyBmdW5jdGlvbg==-->refactor: remove duplicate computeMac function<!--description--> <!--end release-notes-assistant--> Reviewed-on: https://code.forgejo.org/forgejo/runner/pulls/936 Reviewed-by: Michael Kriese <michael.kriese@gmx.de> Co-authored-by: Mathieu Fenniak <mathieu@fenniak.net> Co-committed-by: Mathieu Fenniak <mathieu@fenniak.net>
51 lines
1.2 KiB
Go
51 lines
1.2 KiB
Go
// Copyright 2024 The Forgejo Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package artifactcache
|
|
|
|
import (
|
|
"crypto/hmac"
|
|
"crypto/sha256"
|
|
"encoding/hex"
|
|
"errors"
|
|
"strconv"
|
|
"time"
|
|
)
|
|
|
|
var ErrValidation = errors.New("validation error")
|
|
|
|
func (h *handler) validateMac(rundata RunData) (string, error) {
|
|
// TODO: allow configurable max age
|
|
if !validateAge(rundata.Timestamp) {
|
|
return "", ErrValidation
|
|
}
|
|
|
|
expectedMAC := ComputeMac(h.secret, rundata.RepositoryFullName, rundata.RunNumber, rundata.Timestamp, rundata.WriteIsolationKey)
|
|
if hmac.Equal([]byte(expectedMAC), []byte(rundata.RepositoryMAC)) {
|
|
return rundata.RepositoryFullName, nil
|
|
}
|
|
return "", ErrValidation
|
|
}
|
|
|
|
func validateAge(ts string) bool {
|
|
tsInt, err := strconv.ParseInt(ts, 10, 64)
|
|
if err != nil {
|
|
return false
|
|
}
|
|
if tsInt > time.Now().Unix() {
|
|
return false
|
|
}
|
|
return true
|
|
}
|
|
|
|
func ComputeMac(secret, repo, run, ts, writeIsolationKey string) string {
|
|
mac := hmac.New(sha256.New, []byte(secret))
|
|
mac.Write([]byte(repo))
|
|
mac.Write([]byte(">"))
|
|
mac.Write([]byte(run))
|
|
mac.Write([]byte(">"))
|
|
mac.Write([]byte(ts))
|
|
mac.Write([]byte(">"))
|
|
mac.Write([]byte(writeIsolationKey))
|
|
return hex.EncodeToString(mac.Sum(nil))
|
|
}
|