fix: accept signed pushes over smart-HTTP by allowing nonce slop
commit
01897abfix: accept signed pushes over smart-HTTP by allowing nonce slop
Smart-HTTP issues the signed-push nonce and verifies it in two separate
receive-pack processes, so the certificate’s stamp never matches the
verifier’s "now". With git’s default receive.certNonceSlop of 0 this
yields NONCE_SLOP for every push, which pre-receive rejects as a
stale nonce. Inject a 60s slop window alongside the seed.
fix: inject receive.certNonceSlop whenever the nonce seed is set
Assisted-by: Claude:claude-opus-4-8
Reviews
No reviews of this commit yet — record a verdict below.
Start a review
crates/git-ents-server/src/http.rs
@@ -159,6 +159,11 @@
let mut overrides = Vec::new();
if let Some(seed) = state.cert_nonce_seed.as_deref() {
overrides.push(("receive.certNonceSeed", seed));
+ // Smart-HTTP issues the nonce and verifies it in two separate
+ // `receive-pack` processes, so the cert's stamp never matches the
+ // verifier's "now"; without a slop window git's default of 0 returns
+ // SLOP for every signed push. Allow a small drift for the round-trip.
+ overrides.push(("receive.certNonceSlop", "60"));
}
if let Some(hooks) = state.hooks_dir.as_deref().and_then(Path::to_str) {
overrides.push(("core.hooksPath", hooks));
@@ -519,6 +524,7 @@
backend_config(&state(Some("seed"), Some("/app/hooks"))),
vec![
("receive.certNonceSeed", "seed"),
+ ("receive.certNonceSlop", "60"),
("core.hooksPath", "/app/hooks"),
]
);