Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

osxkeychain: lock for exclusive execution #1729

Closed
wants to merge 2 commits into from
Closed

osxkeychain: lock for exclusive execution #1729

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3341346
osxkeychain: exclusive lock to serialize execution of operations
KojiNakamaru May 15, 2024
146b0ae
osxkeychain: state to skip unnecessary store operations
KojiNakamaru May 15, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions contrib/credential/osxkeychain/git-credential-osxkeychain.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ static CFStringRef username;
static CFDataRef password;
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

On the Git mailing list, Junio C Hamano wrote (reply to this):

"Koji Nakamaru via GitGitGadget" <gitgitgadget@gmail.com> writes:

> From: Koji Nakamaru <koji.nakamaru@gree.net>
>
> Records whether credentials come from get operations and skips
> unnecessary store operations by utilizing the state[] feature, as
> suggested by brian m. carlson.

This step has a problem description that is even sketchier than the
previous one.  Anticipate questions by the other developers who read
this commit 6 months after it is accepted in the mainline (e.g.,
What problem is there in the current system, why it is bad and worth
solving, and how is the patch trying to solve it?) and let your
proposed log message answer the questions, as you won't be always
sitting next to these developers.

Thanks.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

On the Git mailing list, Koji Nakamaru wrote (reply to this):

Thank you. I'll clean up the whole patch and its description after
getting a final reply about exlock.

Koji Nakamaru

static CFDataRef password_expiry_utc;
static CFDataRef oauth_refresh_token;
static int state_seen;

static void clear_credential(void)
{
Expand Down Expand Up @@ -171,6 +172,9 @@ static OSStatus find_internet_password(void)

CFRelease(item);

write_item("capability[]", "state", strlen("state"));
write_item("state[]", "osxkeychain:seen=1", strlen("osxkeychain:seen=1"));

out:
CFRelease(attrs);

Expand Down Expand Up @@ -284,6 +288,9 @@ static OSStatus add_internet_password(void)
CFDictionaryRef attrs;
OSStatus result;

if (state_seen)
return errSecSuccess;

/* Only store complete credentials */
if (!protocol || !host || !username || !password)
return -1;
Expand Down Expand Up @@ -395,6 +402,10 @@ static void read_credential(void)
oauth_refresh_token = CFDataCreate(kCFAllocatorDefault,
(UInt8 *)v,
strlen(v));
else if (!strcmp(buf, "state[]")) {
if (!strcmp(v, "osxkeychain:seen=1"))
state_seen = 1;
}
/*
* Ignore other lines; we don't know what they mean, but
* this future-proofs us when later versions of git do
Expand All @@ -414,6 +425,9 @@ int main(int argc, const char **argv)
if (!argv[1])
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

On the Git mailing list, Junio C Hamano wrote (reply to this):

"Koji Nakamaru via GitGitGadget" <gitgitgadget@gmail.com> writes:

> From: Koji Nakamaru <koji.nakamaru@gree.net>
>
> Resolves "failed to store: -25299" when "fetch.parallel 0" is configured
> and there are many submodules.

Use of third-person singular without subject for the "observation"
part is highly unusual the log messages in our codebase.

The usual way to compose a log message of this project is to

 - Give an observation on how the current system work in the present
   tense (so no need to say "Currently X is Y", just "X is Y"), and
   discuss what you perceive as a problem in it.

 - Propose a solution (optional---often, problem description
   trivially leads to an obvious solution in reader's minds).

 - Give commands to the codebase to "become like so".

in this order.

> The error code -25299 (errSecDuplicateItem) may be returned by
> SecItemUpdate() in add_internet_password() if multiple instances of
> git-credential-osxkeychain run in parallel. This patch introduces an
> exclusive lock to serialize execution for avoiding this and other
> potential issues.

"This patch introduces" -> "Introduce"

Is this step still needed, though?

> Signed-off-by: Koji Nakamaru <koji.nakamaru@gree.net>
> ---
>  contrib/credential/osxkeychain/git-credential-osxkeychain.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/contrib/credential/osxkeychain/git-credential-osxkeychain.c b/contrib/credential/osxkeychain/git-credential-osxkeychain.c
> index 6a40917b1ef..0884db48d0a 100644
> --- a/contrib/credential/osxkeychain/git-credential-osxkeychain.c
> +++ b/contrib/credential/osxkeychain/git-credential-osxkeychain.c
> @@ -414,6 +414,9 @@ int main(int argc, const char **argv)
>  	if (!argv[1])
>  		die("%s", usage);
>  
> +	if (open(argv[0], O_RDONLY | O_EXLOCK) == -1)
> +		die("failed to lock %s", argv[0]);
> +
>  	read_credential();
>  
>  	if (!strcmp(argv[1], "get"))

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

On the Git mailing list, Koji Nakamaru wrote (reply to this):

Thank you for the instruction about a log message. I'll follow it.

> Is this step still needed, though?

For solving the issue I originally had, just utilizing state[] to skip
"store" operations is enough.

Since the osxkeychain implementation doesn't seem to be aware that it
can run in parallel, I thought it would be better to leave this step in
case a similar problem occurs. If this reason is weak, I'll remove this
step.

Koji Nakamaru

die("%s", usage);

if (open(argv[0], O_RDONLY | O_EXLOCK) == -1)
die("failed to lock %s", argv[0]);

read_credential();

if (!strcmp(argv[1], "get"))
Expand Down
Loading