anti
f2b3393669
Replaces LICENSE (GPLv3 -> AGPLv3) and prepends `SPDX-License-Identifier: AGPL-3.0-or-later` to every source file across decnet/, decnet_web/, tests/, scripts/, and tools/. Rationale: closes the GPLv3 ASP loophole so any party operating a modified DECNET as a network service must offer their modified source. Personal copyright (Samuel Paschuan) + inbound=outbound contributions make a future unilateral relicense infeasible. - LICENSE: full AGPL-3.0 text (gnu.org/licenses/agpl-3.0.txt) - COPYRIGHT: project copyright notice - tools/add_spdx_headers.py: idempotent header injector (shebang- and PEP 263-aware) Touches 1565 source files (.py, .ts, .tsx, .js, .jsx, .css, .sh). No behavior change; comments only.
55 lines
2.0 KiB
Python
55 lines
2.0 KiB
Python
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
"""Fake ``.git/config`` with an attacker-bait remote URL.
|
|
|
|
The ``[remote "origin"]`` ``url`` field is the natural place to embed
|
|
an HTTP-callback URL: it's normal for git remotes to be HTTPS, the
|
|
URL is read by every git command an attacker runs (``git pull``,
|
|
``git fetch``, ``git remote -v``), and the slug fits naturally as
|
|
part of a path.
|
|
|
|
The generator emits a plausible private-mirror remote (``git.<org>``
|
|
or the canary host's hostname) so an attacker doesn't immediately
|
|
recognise it as a honeypot. The slug ends up in the URL path:
|
|
|
|
[remote "origin"]
|
|
url = https://canary.example.test/c/<slug>/repo.git
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
from decnet.canary.base import CanaryArtifact, CanaryContext, CanaryGenerator
|
|
|
|
|
|
class GitConfigGenerator(CanaryGenerator):
|
|
name = "git_config"
|
|
|
|
def generate(self, ctx: CanaryContext) -> CanaryArtifact:
|
|
# Strip trailing slash defensively — operator may have
|
|
# configured DECNET_CANARY_HTTP_BASE either way.
|
|
base = ctx.http_base.rstrip("/")
|
|
slug = ctx.callback_token
|
|
# The /c/<slug>/repo.git suffix gives us a realistic-looking
|
|
# path the worker can route on a single ``startswith("/c/")``
|
|
# check, while still surviving a quick grep for the slug.
|
|
url = f"{base}/c/{slug}/repo.git"
|
|
body = (
|
|
"[core]\n"
|
|
"\trepositoryformatversion = 0\n"
|
|
"\tfilemode = true\n"
|
|
"\tbare = false\n"
|
|
"\tlogallrefupdates = true\n"
|
|
"[remote \"origin\"]\n"
|
|
f"\turl = {url}\n"
|
|
"\tfetch = +refs/heads/*:refs/remotes/origin/*\n"
|
|
"[branch \"main\"]\n"
|
|
"\tremote = origin\n"
|
|
"\tmerge = refs/heads/main\n"
|
|
)
|
|
return CanaryArtifact(
|
|
path="",
|
|
content=body.encode("utf-8"),
|
|
mode=0o644,
|
|
mtime_offset=-86400 * 30, # checked out a month ago
|
|
generator=self.name,
|
|
notes=[f"git remote 'origin' embeds {url}"],
|
|
)
|