mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-01-29 21:08:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

bitbake: fetch2/wget: add redirectauth parameter

Browse Source 
Add a parameter that limits sending Basic authentication in the
Authorization header to only the first host and not any that we're
redirected to.  Ignoring potential security concerns, temporary AWS URLs
will reject any request that includes authentication details in both the
query parameters (from the redirect) and in the Authorization header.

Temporary AWS URLs are now being used for release assets from private
Github repositories.  According to the previous discussion linked below,
they're also in use by bitbucket.

See also:
https://lore.kernel.org/bitbake-devel/CAC9ffDEuZL-k8199bUyN+8frjw6bg-g=vrumxxtvt+RVParQ8Q@mail.gmail.com/

(Bitbake rev: a6ab32013a4381a1b694ed46caf2c9da932644d0)

Signed-off-by: Justin Bronder <jsbronder@cold-front.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Justin Bronder
2021-12-06 16:24:37 -05:00
committed by Richard Purdie
parent 35f1345290
commit acd77c3ac9
2 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
bitbake/doc/bitbake-user-manual/bitbake-user-manual-fetching.rst
View File

@@ -229,6 +229,11 @@ downloaded file is useful for avoiding collisions in
:term:`DL_DIR` when dealing with multiple files that
have the same name.
If a username and password are specified in the ``SRC_URI``, a Basic
Authorization header will be added to each request, including across redirects.
To instead limit the Authorization header to the first request, add
"redirectauth=0" to the list of parameters.
Some example URLs are as follows::
SRC_URI = "http://oe.handhelds.org/not_there.aac"

12
bitbake/lib/bb/fetch2/wget.py
View File

@@ -112,7 +112,17 @@ class Wget(FetchMethod):
fetchcmd += " -O %s" % shlex.quote(localpath)
if ud.user and ud.pswd:
fetchcmd += " --user=%s --password=%s --auth-no-challenge" % (ud.user, ud.pswd)
fetchcmd += " --auth-no-challenge"
if ud.parm.get("redirectauth", "1") == "1":
# An undocumented feature of wget is that if the
# username/password are specified on the URI, wget will only
# send the Authorization header to the first host and not to
# any hosts that it is redirected to. With the increasing
# usage of temporary AWS URLs, this difference now matters as
# AWS will reject any request that has authentication both in
# the query parameters (from the redirect) and in the
# Authorization header.
fetchcmd += " --user=%s --password=%s" % (ud.user, ud.pswd)
uri = ud.url.split(";")[0]
if os.path.exists(ud.localpath):