From 8629fa3f18d89b55bdae4538afb5ae81e7706af9 Mon Sep 17 00:00:00 2001 From: Dirk Hohndel Date: Fri, 17 Apr 2020 14:39:50 -0700 Subject: core: bring back libgit2 certificate callback Turns out that at least on Android libgit2 sometimes rejects valid certificates. And I cannot quite figure out when and why. But since we actually already checked the validity of the certificate when we called canReachCloudServer() (and the Qt code handles certificates correctly), we'll simply ignore this here and override the check to always return true for our cloud server. Signed-off-by: Dirk Hohndel --- core/git-access.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/core/git-access.c b/core/git-access.c index 2fb55a016..e636b04ca 100644 --- a/core/git-access.c +++ b/core/git-access.c @@ -286,6 +286,20 @@ int credential_https_cb(git_cred **out, return git_cred_userpass_plaintext_new(out, username, password); } +int certificate_check_cb(git_cert *cert, int valid, const char *host, void *payload) +{ + UNUSED(payload); + if (same_string(host, "cloud.subsurface-divelog.org") && cert->cert_type == GIT_CERT_X509) { + // for some reason the LetsEncrypt certificate makes libgit2 throw up on some + // platforms but not on others + // if we are connecting to the cloud server we alrady called 'canReachCloudServer()' + // which will fail if the SSL certificate isn't valid, so let's simply always + // tell the caller that this certificate is valid + return 1; + } + return valid; +} + static int update_remote(git_repository *repo, git_remote *origin, git_reference *local, git_reference *remote, enum remote_transport rt) { UNUSED(repo); @@ -307,6 +321,7 @@ static int update_remote(git_repository *repo, git_remote *origin, git_reference opts.callbacks.credentials = credential_ssh_cb; else if (rt == RT_HTTPS) opts.callbacks.credentials = credential_https_cb; + opts.callbacks.certificate_check = certificate_check_cb; if (git_remote_push(origin, &refspec, &opts)) { if (is_subsurface_cloud) @@ -562,6 +577,7 @@ static int check_remote_status(git_repository *repo, git_remote *origin, const c opts.callbacks.credentials = credential_ssh_cb; else if (rt == RT_HTTPS) opts.callbacks.credentials = credential_https_cb; + opts.callbacks.certificate_check = certificate_check_cb; git_storage_update_progress(translate("gettextFromC", "Store data into cloud storage")); error = git_remote_push(origin, &refspec, &opts); } else { @@ -676,6 +692,7 @@ int sync_with_remote(git_repository *repo, const char *remote, const char *branc opts.callbacks.credentials = credential_ssh_cb; else if (rt == RT_HTTPS) opts.callbacks.credentials = credential_https_cb; + opts.callbacks.certificate_check = certificate_check_cb; git_storage_update_progress(translate("gettextFromC", "Successful cloud connection, fetch remote")); error = git_remote_fetch(origin, NULL, &opts, NULL); // NOTE! A fetch error is not fatal, we just report it @@ -821,6 +838,7 @@ static git_repository *create_local_repo(const char *localdir, const char *remot else if (rt == RT_HTTPS) opts.fetch_opts.callbacks.credentials = credential_https_cb; opts.repository_cb = repository_create_cb; + opts.fetch_opts.callbacks.certificate_check = certificate_check_cb; opts.checkout_branch = branch; if (is_subsurface_cloud && !canReachCloudServer()) -- cgit v1.2.3-70-g09d2