Explicitly avoid committing SSH key to gh-pages

[mortenpi]

Rather than writing the key to the repository, let's write it to homedir(). I think ideally we would avoid writing a temporary file altogether, but I think the only way to do it then is with ssh-agent?

cc @simeonschaub

[fredrikekre]

Better with temp?

Suggested change

	keyfile = abspath(joinpath(homedir(), ".documenter-identity-file.tmp"))
	keyfile = abspath(joinpath(mktempdir(), ".documenter-identity-file.tmp"))

[simeonschaub]

Yeah, I think it's not inconceivable someone might try to upload the entire home directory, e.g. on a CI service where there's nothing much there anyways. If we really wanted to be on the safe side, maybe even check if tempdir is a subdirectory of the target and error loudly if it is?

[mortenpi]

tempdir would indeed be the most convenient, but what I was concerned about is that, if somehow it doesn't get cleaned up, it's better to leave the file into /home (where hopefully only the current user can read it), rather than /tmp.

Checking for the subdirectory seems reasonable though.

[fredrikekre]

Could the file not be created as read-write only for current user, then after the key is written, change to read-only for current user?

[mortenpi]

I guess the permissions are fine already (user-only rw protects as much). I guess my main concern is some shared system where you might have the keyfile sitting around in the /tmp of some random node. In your home directory you might be more likely to notice it.

[fredrikekre]

Good idea to add the file to $GIT_DIR/info/exclude (or perhaps use git add -A -- :!.documenter-identity-file.tmp)

diff --git a/src/deploydocs.jl b/src/deploydocs.jl
index 02d572c4f..140d0e09e 100644
--- a/src/deploydocs.jl
+++ b/src/deploydocs.jl
@@ -357,6 +357,9 @@ function git_push(
         end

         # Add, commit, and push the docs to the remote.
+        open(".git/info/exclude", "a") do io
+            println(io, ".documenter-identity.file.tmp")
+        end
         run(`$(git()) add -A .`)
         if !success(`$(git()) diff --cached --exit-code`)
             if !isnothing(archive)

[simeonschaub]

Thanks for the quick fix! Not very familiar with Documenter internals, but this seems like the right approach to me

[mortenpi]

@fredrikekre Does this look right to you? :!.documenter-identity-file.tmp' seemed to only exclude the top-level file.

[fredrikekre]

Looks like that works, but I wonder why the first isn't sufficient. In a standard .gitignore file a line with .documenter-identity-file.tmp would exclude all files with that name.

[mortenpi]

Okay, I kinda changed my mind now. I think checking that tmpdir/homedir is a subdirectory of target is not too useful, since it doesn't catch most bad cases. What we might want to do is to check that target is a subdirectory of root though.

On the other hand, the git solution seems to nicely avoid pushing the key file, so I changed back to writing it into root (i.e. docs/ in most cases). I think between homedir() and root, the latter is preferred.