Skip to main content

REPO_FORBIDDEN_KEYS

mkit_cli::config

Constant REPO_FORBIDDEN_KEYS 

Source 
pub const REPO_FORBIDDEN_KEYS: &[&str];
Expand description

Keys that MUST NOT be settable via the per-repo <repo>/.mkit/config because a hostile clone could otherwise:

  • redirect signing_key to overwrite arbitrary files on disk or to sign attacker-chosen content with the user’s real key,
  • spoof the commit author by pinning user.identity to attacker- chosen bytes while the victim’s real signing key still signs the object,
  • point attest.external_signer_path / _args at any binary on the host (RCE under the user’s UID),
  • select a user-scoped external signer or non-Ed25519 algorithm to confused-deputy through it: even though the path is user-scoped, the selector (attest.signer, attest.default_algorithm) is enough to weaponize an existing user-trusted binary or key against attacker-chosen content,
  • mark a repo-controlled HTTP/S3 remote as trusted for ambient environment credentials,
  • disable SSH host-key verification on mkit push (MITM),
  • disable post-fetch commit/remix/tag signature verification (pull.require_signed, issue #692) — a hostile repo must not be able to switch off the one check that would otherwise reject its own unsigned/forged history on the next clone/pull/fetch.

They are accepted from the user-scoped config only.