mirrors/git-annex
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

devblog

Browse source
This commit is contained in:
Joey Hess 2014-09-18 18:24:20 -04:00
parent 0ed33c8b74
commit 417087d532
1 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
doc/devblog/day_221__another_fine_day_of_bugfixing.mdwn Normal file
View file

@ -0,0 +1,10 @@
Working through the forum posts and bugs. Backlog is down to 95.
Discovered the first known security hole in git-annex!
Turns out that S3 and Glacier remotes that were configured with embedcreds=yes and encryption=pubkey or encryption=hybrid
didn't actually encrypt the AWS credentials that get embedded into the git
repo. This doesn't affect any repos set up by the assistant.
I've fixed the problem and am going to make a release soon.
If your repo is affected, see
[[upgrades/insecure_embedded_creds]] for what to do about it.