mirror of
https://seed.radicle.dev/rad:z3gqcJUoA1n9HaHKufZs5FCSGazv5.git
synced 2026-11-11 14:10:35 +08:00
cloudhead
989edacd56
We ensure that a `rad/root` ref is included in the signed refs file under `rad/sigrefs` for all remotes. This prevents a certain kind of "grafting" attack where signed refs can be copied between repositories, by having the peer sign over the identity root together with the data refs. When verifying signed refs, we ensure that the ref is present and points to an identity branch root that matches the repository identity containing the signed refs. Alternatives: lots of alternatives were considered, but this one doesn't introduce any changes to the signing. The `rad/id/root` name was considered but is invalid due to `rad/id`.
56 lines
1.6 KiB
Markdown
56 lines
1.6 KiB
Markdown
If we have fetched a project, then we do not have a fork of the
|
||
repository in the storage, i.e. there is no ref hierarchy for our
|
||
NID. This is demonstrated below where our NID is
|
||
`z6Mkt67GdsW7715MEfRuP4pSZxJRJh6kj6Y48WRqVv4N1tRk`:
|
||
|
||
```
|
||
$ rad inspect rad:z42hL2jL4XNk6K8oHQaSWfMgCL7ji --refs
|
||
z6MknSLrJoTcukLrE435hVNQT4JUhbvWLX4kUzqkEStBU8Vi
|
||
└── refs
|
||
├── cobs
|
||
│ └── xyz.radicle.id
|
||
│ └── [...]
|
||
├── heads
|
||
│ └── master
|
||
└── rad
|
||
├── id
|
||
├── root
|
||
└── sigrefs
|
||
```
|
||
|
||
To remedy this, we can use the `rad fork` command for the project we
|
||
wish to fork:
|
||
|
||
```
|
||
$ rad fork rad:z42hL2jL4XNk6K8oHQaSWfMgCL7ji
|
||
✓ Forked repository rad:z42hL2jL4XNk6K8oHQaSWfMgCL7ji for z6Mkt67GdsW7715MEfRuP4pSZxJRJh6kj6Y48WRqVv4N1tRk
|
||
```
|
||
|
||
Now, if we `rad inspect` the project's refs again we will see that we
|
||
have a copy of the main set of refs:
|
||
|
||
```
|
||
$ rad inspect rad:z42hL2jL4XNk6K8oHQaSWfMgCL7ji --refs
|
||
z6MknSLrJoTcukLrE435hVNQT4JUhbvWLX4kUzqkEStBU8Vi
|
||
└── refs
|
||
├── cobs
|
||
│ └── xyz.radicle.id
|
||
│ └── [...]
|
||
├── heads
|
||
│ └── master
|
||
└── rad
|
||
├── id
|
||
├── root
|
||
└── sigrefs
|
||
z6Mkt67GdsW7715MEfRuP4pSZxJRJh6kj6Y48WRqVv4N1tRk
|
||
└── refs
|
||
├── heads
|
||
│ └── master
|
||
└── rad
|
||
├── root
|
||
└── sigrefs
|
||
```
|
||
|
||
We are now able to setup a remote in our own working copy of the
|
||
project and push to our own fork.
|