Commit `fc755889ba`

fc755889baf27e51072434797bb4de2076d3f7eb

parent: c2e04ef116

Verified · cmc

cmc <hello@cleberg.net> · 2026-09-29 02:26 UTC

lfs: tokens carry the key's fingerprint pin beside its id

Closes #303

Layout: unified · split

CHANGELOG.org +6

   of a public repository made private, loses the token's use with the
   access, and an upload token stops working once its repository is
   archived (#285).
+- LFS transfer tokens carry a hash of their key's fingerprint beside
+  its id, and a token whose key id now belongs to another key is
+  refused, since SQLite gives a new key the id of the last deleted one.
+  The token format changed: tokens minted before the upgrade are
+  refused, and a transfer running across the restart needs running
+  again (#303).
 * v1.36.0 — 2026-09-23

internal/httpd/lfs.go +17 −6

 // for none). A token is bound to the SSH key that obtained it and
 // works only while that key is registered, unexpired and on an enabled
 // account, and while the key still has the access its operation needs
-// on the repo (#285). Without one, public repos allow anonymous
+// on the repo (#285). A key that took over a deleted key's id does not
+// match the token's fingerprint pin (#303). Without one, public repos allow anonymous
 // download only.
 func (s *Server) lfsAuth(r *http.Request, repo store.Repo) (string, int64) {
 	auth := r.Header.Get("Authorization")
 			return "", 0
 		}
 		live, err := s.st.LiveSSHKeys([]int64{g.KeyID})
-		if err != nil || !live[g.KeyID] || !s.lfsKeyAllows(g.KeyID, repo, g.Op == "upload") {
+		if err != nil || !live[g.KeyID] || !s.lfsKeyAllows(g.KeyID, g.KeyPin, repo, g.Op == "upload") {
 			return "", 0
 		}
 		return g.Op, g.KeyID
 // lfsKeyAllows repeats git-lfs-authenticate's access check for the key
 // now: a deploy key by its binding, any other key by its account's
-// access narrowed by the key's scope. An archived repo takes no uploads.
+// access narrowed by the key's scope. The key must be the one the token
-func (s *Server) lfsKeyAllows(keyID int64, repo store.Repo, write bool) bool {
+// was minted for, by fingerprint pin. An archived repo takes no uploads.
+func (s *Server) lfsKeyAllows(keyID int64, pin string, repo store.Repo, write bool) bool {
 	if write && repo.Settings.Archived {
 		return false
 	}
 	key, err := s.st.SSHKeyByID(keyID)
-	if err != nil {
+	if err != nil || lfs.KeyPin(key.Fingerprint) != pin {
 		return false
 	}
 	if policy.IsDeployScope(key.Scope) {
 		lfsError(w, http.StatusInternalServerError, "lfs secret unavailable")
 		return
 	}
-	transferToken := lfs.Sign(secret, repo.ID, keyID, req.Operation, time.Now())
+	fingerprint := ""
+	if keyID != 0 {
+		key, err := s.st.SSHKeyByID(keyID)
+		if err != nil {
+			lfsError(w, http.StatusNotFound, "repository not found")
+			return
+		}
+		fingerprint = key.Fingerprint
+	}
+	transferToken := lfs.Sign(secret, repo.ID, keyID, fingerprint, req.Operation, time.Now())
 	base := fmt.Sprintf("%s/%s/%s.git/info/lfs/objects",
 		strings.TrimSuffix(s.cfg.Server.SiteURL, "/"), repo.OwnerName, repo.Name)
 	authHeader := map[string]string{"Authorization": "Bearer " + transferToken}

internal/httpd/lfsauth_test.go +44 −16

 	}
 	live := addKey("SHA256:live", nil)
-	tok := lfs.Sign(secret, repo.ID, live, "upload", time.Now())
+	tok := lfs.Sign(secret, repo.ID, live, "SHA256:live", "upload", time.Now())
 	if op, key := s.lfsAuth(lfsRequest(tok), repo); op != "upload" || key != live {
 		t.Fatalf("live key: %q, %d", op, key)
 	}
 	past := time.Now().Add(-time.Minute)
 	expired := addKey("SHA256:expired", &past)
-	if op, _ := s.lfsAuth(lfsRequest(lfs.Sign(secret, repo.ID, expired, "upload", time.Now())), repo); op != "" {
+	if op, _ := s.lfsAuth(lfsRequest(lfs.Sign(secret, repo.ID, expired, "SHA256:expired", "upload", time.Now())), repo); op != "" {
 		t.Errorf("expired key: %q", op)
 	}
 	}
 	other := addKey("SHA256:other", nil)
-	otherTok := lfs.Sign(secret, repo.ID, other, "download", time.Now())
+	otherTok := lfs.Sign(secret, repo.ID, other, "SHA256:other", "download", time.Now())
 	if op, _ := s.lfsAuth(lfsRequest(otherTok), repo); op != "download" {
 		t.Fatalf("second key before disable: %q", op)
 	}
 		t.Fatal(err)
 	}
 	now := time.Now()
-	if op, _ := s.lfsAuth(lfsRequest(lfs.Sign(secret, pub.ID, 0, "download", now)), pub); op != "download" {
+	if op, _ := s.lfsAuth(lfsRequest(lfs.Sign(secret, pub.ID, 0, "", "download", now)), pub); op != "download" {
 		t.Errorf("public download: %q", op)
 	}
-	if op, _ := s.lfsAuth(lfsRequest(lfs.Sign(secret, pub.ID, 0, "upload", now)), pub); op != "" {
+	if op, _ := s.lfsAuth(lfsRequest(lfs.Sign(secret, pub.ID, 0, "", "upload", now)), pub); op != "" {
 		t.Errorf("anonymous upload: %q", op)
 	}
-	if op, _ := s.lfsAuth(lfsRequest(lfs.Sign(secret, priv.ID, 0, "download", now)), priv); op != "" {
+	if op, _ := s.lfsAuth(lfsRequest(lfs.Sign(secret, priv.ID, 0, "", "download", now)), priv); op != "" {
 		t.Errorf("private download: %q", op)
 	}
 }
 		t.Fatal(err)
 	}
 	bobKey := lfsTestKey(t, st, bob, "SHA256:bob", "full")
-	up := lfs.Sign(secret, repo.ID, bobKey, "upload", now)
+	up := lfs.Sign(secret, repo.ID, bobKey, "SHA256:bob", "upload", now)
 	if op, _ := s.lfsAuth(lfsRequest(up), repo); op != "upload" {
 		t.Fatalf("collaborator upload: %q", op)
 	}
 	if err := st.RevokeAccess(repo.ID, bob); err != nil {
 		t.Fatal(err)
 	}
-	if op, _ := s.lfsAuth(lfsRequest(lfs.Sign(secret, repo.ID, bobKey, "download", now)), repo); op != "" {
+	if op, _ := s.lfsAuth(lfsRequest(lfs.Sign(secret, repo.ID, bobKey, "SHA256:bob", "download", now)), repo); op != "" {
 		t.Errorf("download after access was revoked: %q", op)
 	}
 		t.Fatal(err)
 	}
 	carolKey := lfsTestKey(t, st, carol, "SHA256:carol", "full")
-	down := lfs.Sign(secret, pub.ID, carolKey, "download", now)
+	down := lfs.Sign(secret, pub.ID, carolKey, "SHA256:carol", "download", now)
 	if op, _ := s.lfsAuth(lfsRequest(down), pub); op != "download" {
 		t.Fatalf("public download: %q", op)
 	}
 	ro := fmt.Sprintf("deploy:%d:ro", repo.ID)
 	live := lfsTestKey(t, st, u.ID, "SHA256:deploy-live", rw)
-	if op, key := s.lfsAuth(lfsRequest(lfs.Sign(secret, repo.ID, live, "upload", now)), repo); op != "upload" || key != live {
+	if op, key := s.lfsAuth(lfsRequest(lfs.Sign(secret, repo.ID, live, "SHA256:deploy-live", "upload", now)), repo); op != "upload" || key != live {
 		t.Fatalf("live deploy key: %q, %d", op, key)
 	}
 	removed := lfsTestKey(t, st, u.ID, "SHA256:deploy-removed", rw)
-	tok := lfs.Sign(secret, repo.ID, removed, "download", now)
+	tok := lfs.Sign(secret, repo.ID, removed, "SHA256:deploy-removed", "download", now)
 	if err := st.RemoveDeployKey(repo.ID, "SHA256:deploy-removed"); err != nil {
 		t.Fatal(err)
 	}
 	}
 	readOnly := lfsTestKey(t, st, u.ID, "SHA256:deploy-ro", ro)
-	if op, _ := s.lfsAuth(lfsRequest(lfs.Sign(secret, repo.ID, readOnly, "download", now)), repo); op != "download" {
+	if op, _ := s.lfsAuth(lfsRequest(lfs.Sign(secret, repo.ID, readOnly, "SHA256:deploy-ro", "download", now)), repo); op != "download" {
 		t.Errorf("read-only deploy key download: %q", op)
 	}
-	if op, _ := s.lfsAuth(lfsRequest(lfs.Sign(secret, repo.ID, readOnly, "upload", now)), repo); op != "" {
+	if op, _ := s.lfsAuth(lfsRequest(lfs.Sign(secret, repo.ID, readOnly, "SHA256:deploy-ro", "upload", now)), repo); op != "" {
 		t.Errorf("read-only deploy key upload: %q", op)
 	}
 	if err := st.SetUserDisabled(u.ID, true); err != nil {
 		t.Fatal(err)
 	}
-	if op, _ := s.lfsAuth(lfsRequest(lfs.Sign(secret, repo.ID, live, "download", now)), repo); op != "" {
+	if op, _ := s.lfsAuth(lfsRequest(lfs.Sign(secret, repo.ID, live, "SHA256:deploy-live", "download", now)), repo); op != "" {
 		t.Errorf("deploy key of a disabled account: %q", op)
 	}
 }
 	}
 	key := lfsTestKey(t, st, u.ID, "SHA256:owner", "full")
 	now := time.Now()
-	up := lfs.Sign(secret, repo.ID, key, "upload", now)
+	up := lfs.Sign(secret, repo.ID, key, "SHA256:owner", "upload", now)
 	if op, _ := s.lfsAuth(lfsRequest(up), repo); op != "upload" {
 		t.Fatalf("upload before archiving: %q", op)
 	}
 	if op, _ := s.lfsAuth(lfsRequest(up), repo); op != "" {
 		t.Errorf("upload after archiving: %q", op)
 	}
-	if op, _ := s.lfsAuth(lfsRequest(lfs.Sign(secret, repo.ID, key, "download", now)), repo); op != "download" {
+	if op, _ := s.lfsAuth(lfsRequest(lfs.Sign(secret, repo.ID, key, "SHA256:owner", "download", now)), repo); op != "download" {
 		t.Errorf("download after archiving: %q", op)
 	}
 }
+// SQLite gives a new key the id of the highest deleted one. A token
+// minted for the deleted key is refused when presented against the new
+// key; the new key's own token works (#303).
+func TestLFSTokenRefusedOnReusedKeyID(t *testing.T) {
+	s, st, u := newTokenTestServer(t)
+	repo := lfsTestRepo(t, st, u.ID, "app", "private")
+	secret, err := s.lfsSecret()
+	if err != nil {
+		t.Fatal(err)
+	}
+	now := time.Now()
+	oldID := lfsTestKey(t, st, u.ID, "SHA256:old", "full")
+	old := lfs.Sign(secret, repo.ID, oldID, "SHA256:old", "upload", now)
+	if err := st.RemoveSSHKey(u.ID, "SHA256:old"); err != nil {
+		t.Fatal(err)
+	}
+	newID := lfsTestKey(t, st, u.ID, "SHA256:new", "full")
+	if newID != oldID {
+		t.Fatalf("new key got id %d, want the reused %d", newID, oldID)
+	}
+	if op, _ := s.lfsAuth(lfsRequest(old), repo); op != "" {
+		t.Errorf("old key's token on the reused id: %q", op)
+	}
+	if op, _ := s.lfsAuth(lfsRequest(lfs.Sign(secret, repo.ID, newID, "SHA256:new", "upload", now)), repo); op != "upload" {
+		t.Errorf("new key's own token: %q", op)
+	}
+}

internal/lfs/lfs.go +27 −9

 // Sign mints a token for op ("download" or "upload") on repoID, bound
 // to keyID: the SSH key, user or deploy, that asked for it, or 0 for an
-// anonymous download of a public repository.
+// anonymous download of a public repository. fingerprint is that key's
-func Sign(secret []byte, repoID, keyID int64, op string, now time.Time) string {
+// fingerprint, "" for key 0. SQLite reuses the id of a deleted key, so
-	payload := fmt.Sprintf("%d:%d:%s:%d", repoID, keyID, op, now.Add(TokenTTL).Unix())
+// the token carries a hash of the fingerprint as well and a new key
+// given the old id does not inherit the old key's tokens (#303).
+func Sign(secret []byte, repoID, keyID int64, fingerprint, op string, now time.Time) string {
+	payload := fmt.Sprintf("%d:%d:%s:%s:%d", repoID, keyID, KeyPin(fingerprint), op, now.Add(TokenTTL).Unix())
 	mac := hmac.New(sha256.New, secret)
 	mac.Write([]byte(payload))
 	return base64.RawURLEncoding.EncodeToString([]byte(payload)) + "." +
 		base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
 }
+// KeyPin is the fingerprint's form in a token: the first 16 hex
+// characters of its SHA-256, or "" for no key.
+func KeyPin(fingerprint string) string {
+	if fingerprint == "" {
+		return ""
+	}
+	sum := sha256.Sum256([]byte(fingerprint))
+	return hex.EncodeToString(sum[:8])
+}
 // Grant is what a verified token authorizes.
 type Grant struct {
 	RepoID int64
-	KeyID  int64 // 0: an anonymous download of a public repository
+	KeyID  int64  // 0: an anonymous download of a public repository
+	KeyPin string // KeyPin of the key's fingerprint; "" when KeyID is 0
 	Op     string
 }
 // Verify checks a token's MAC, shape and expiry. A token from before
-// tokens named their key does not verify.
+// tokens named their key, or before they carried its fingerprint, does
+// not verify.
 func Verify(secret []byte, token string, now time.Time) (Grant, bool) {
 	payloadB64, macB64, found := strings.Cut(token, ".")
 	if !found {
 		return Grant{}, false
 	}
 	parts := strings.Split(string(payload), ":")
-	if len(parts) != 4 {
+	if len(parts) != 5 {
 		return Grant{}, false
 	}
 	repoID, err1 := strconv.ParseInt(parts[0], 10, 64)
 	keyID, err2 := strconv.ParseInt(parts[1], 10, 64)
-	exp, err3 := strconv.ParseInt(parts[3], 10, 64)
+	exp, err3 := strconv.ParseInt(parts[4], 10, 64)
 	if err1 != nil || err2 != nil || err3 != nil || keyID < 0 || now.Unix() > exp {
 		return Grant{}, false
 	}
-	if parts[2] != "download" && parts[2] != "upload" {
+	if (keyID == 0) != (parts[2] == "") {
+		return Grant{}, false
+	}
+	if parts[3] != "download" && parts[3] != "upload" {
 		return Grant{}, false
 	}
-	return Grant{RepoID: repoID, KeyID: keyID, Op: parts[2]}, true
+	return Grant{RepoID: repoID, KeyID: keyID, KeyPin: parts[2], Op: parts[3]}, true
 }
 // NewSecret returns 32 random bytes, hex-encoded for the settings table.

internal/lfs/lfs_test.go +17 −3

 func TestTokenCarriesTheKey(t *testing.T) {
 	secret := []byte("secret")
 	now := time.Now()
-	tok := Sign(secret, 7, 42, "upload", now)
+	tok := Sign(secret, 7, 42, "SHA256:k", "upload", now)
 	g, ok := Verify(secret, tok, now)
-	if !ok || g != (Grant{RepoID: 7, KeyID: 42, Op: "upload"}) {
+	if !ok || g != (Grant{RepoID: 7, KeyID: 42, KeyPin: KeyPin("SHA256:k"), Op: "upload"}) {
 		t.Fatalf("Verify = %+v, %v", g, ok)
 	}
 	if _, ok := Verify(secret, tok, now.Add(TokenTTL+time.Second)); ok {
 	if _, ok := Verify([]byte("other"), tok, now); ok {
 		t.Error("a token verified under another secret")
 	}
-	if g, ok := Verify(secret, Sign(secret, 7, 0, "download", now), now); !ok || g.KeyID != 0 {
+	if g, ok := Verify(secret, Sign(secret, 7, 0, "", "download", now), now); !ok || g.KeyID != 0 || g.KeyPin != "" {
 		t.Errorf("anonymous grant = %+v, %v", g, ok)
 	}
 }
 		t.Fatalf("a pre-upgrade token verified: %+v", g)
 	}
 }
+// A token minted before tokens carried the key's fingerprint has four
+// fields. It is refused (#303).
+func TestUnpinnedTokenRefused(t *testing.T) {
+	secret := []byte("secret")
+	payload := fmt.Sprintf("%d:%d:%s:%d", 7, 42, "upload", time.Now().Add(TokenTTL).Unix())
+	mac := hmac.New(sha256.New, secret)
+	mac.Write([]byte(payload))
+	tok := base64.RawURLEncoding.EncodeToString([]byte(payload)) + "." +
+		base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
+	if g, ok := Verify(secret, tok, time.Now()); ok {
+		t.Fatalf("an unpinned token verified: %+v", g)
+	}
+}

internal/sshd/lfs.go +1 −1

	@@ -69,7 +69,7 @@ func runLFSAuthenticate(cfg config.Config, st *store.Store, user store.User, key
69	fmt.Fprintln(stderr, "internal error")	69	fmt.Fprintln(stderr, "internal error")
70	return protocol.ExitFailure	70	return protocol.ExitFailure
71	}	71	}
72	token := lfs.Sign([]byte(secret), repo.ID, key.ID, op, time.Now())	72	token := lfs.Sign([]byte(secret), repo.ID, key.ID, key.Fingerprint, op, time.Now())
73	json.NewEncoder(stdout).Encode(map[string]any{	73	json.NewEncoder(stdout).Encode(map[string]any{
74	"href": fmt.Sprintf("%s/%s/%s.git/info/lfs",	74	"href": fmt.Sprintf("%s/%s/%s.git/info/lfs",
75	cfg.Server.SiteURL, repo.OwnerName, repo.Name),	75	cfg.Server.SiteURL, repo.OwnerName, repo.Name),

Commit fc755889ba

Commit `fc755889ba`