(GH-399) client certificate support #481

et1975 · 2015-11-17T21:18:30Z

Please consider this merge for #399.

It requires chocolatey/nuget-chocolatey/pull/3/ to be pre-built and included as well.

Closes #399

ferventcoder · 2015-11-19T00:38:26Z

src/chocolatey/infrastructure.app/configuration/ChocolateyConfiguration.cs

@@ -384,6 +384,8 @@ public sealed class SourcesCommandConfiguration
        public string Username { get; set; }
        public string Password { get; set; }
        public int Priority { get; set; }
+        public string Certificate { get; set; }
+        public string CertificatePassword { get; set; }


Will you have both a user name / password and a certificate / password?

In cases like this maybe it makes sense that EncryptedPassword is used for both.

I see the two authentication methods as complimentary so it's quite possible for the passwords to be different.

Are you saying sometimes you would authenticate to the _same_ source with user name / password and sometimes you would authenticate with the certificate / password? Because I'm having a really hard time seeing that.

I'd also see the above as a bug if it didn't authenticate the same way every time.

No, like with proxy authentication, you can have different credentials for for different nodes along the way (btw, the certificate password is not and should not be sent along - it's just to open local certificate file). My use case - reverse proxy configured to do TLS and authenticate with certificates - server & client certificates exchange establishes HTTPS, NuGet server behind it - authorizes. Given that HTTPS termination is commonly done with the proxy, the HTTP server behind it won't even get a say in the negotiations.
Hope that makes sense.

Shouldn't the certificate be validated with the remote server or am I missing something?

So what you are stating is that it is likely in a single call for a source it will use both the certificate AND the username/password?

Yes, the public key from the certificate will be validated, by whatever is doing HTTPS termination, which may or may not be the NuGet server. The certificate validation does not however use password, but the chain of trust and revocation lists.
Yes, you could have the need for either/both, depending on how the server is implemented.

ferventcoder · 2015-11-19T00:56:47Z

@et1975 have you had a chance to read over CONTRIBUTING? Please do and update your git commit with (GH-399) instead of GH-399 and include a nice git message body about what this change is and why it is necessary, etc. Thanks for your work so far!

ferventcoder · 2015-11-19T18:42:28Z

The commit message is much better. It didn't really do line breaks at 72 characters though. We are a bit of a stickler for those.

ferventcoder · 2015-11-19T18:43:29Z

I think you also need to compile and replace nuget-chocolatey so that builds here will pass.

et1975 · 2015-11-19T20:21:13Z

Are you reviewing disassembled binaries submitted this way? Cause otherwise there's nothing stopping me from packing it full of trojans, is there?

ferventcoder · 2015-11-19T23:23:09Z

@et1975 I won't accept the binary changes. I just want them here to validate that in theory builds will work. :)

ferventcoder · 2015-11-19T23:24:05Z

Speaking of which, there is a signer there that will use the default strong name key - you'll need to use it or things won't build. Which you probably already have seen.

et1975 · 2015-11-23T16:02:07Z

I think the outstanding failures are due to some environmental factors, no?

ferventcoder · 2015-11-23T22:06:55Z

Looks like it:

Errors and Failures:
1) Test Error : chocolatey.tests.integration.infrastructure.filesystem.DotNetFileSystemSpecs+when_finding_paths_to_executables_with_dotNetFileSystem.GetExecutablePath_should_find_existing_executable
   Should.Core.Exceptions.EqualException : Assert.Equal() Failure
Position: First difference is at position 3
Expected: C:\Windows\system32\cmd.exe
Actual:   C:\windows\system32\cmd.exe
   at chocolatey.tests.integration.infrastructure.filesystem.DotNetFileSystemSpecs.when_finding_paths_to_executables_with_dotNetFileSystem.GetExecutablePath_should_find_existing_executable() in c:\projects\choco\src\chocolatey.tests.integration\infrastructure\filesystem\DotNetFileSystemSpecs.cs:line 67

2) Test Error : chocolatey.tests.integration.infrastructure.filesystem.DotNetFileSystemSpecs+when_finding_paths_to_executables_with_dotNetFileSystem.GetExecutablePath_should_find_existing_executable_with_extension
   Should.Core.Exceptions.EqualException : Assert.Equal() Failure
Position: First difference is at position 3
Expected: C:\Windows\system32\cmd.exe
Actual:   C:\windows\system32\cmd.exe
   at chocolatey.tests.integration.infrastructure.filesystem.DotNetFileSystemSpecs.when_finding_paths_to_executables_with_dotNetFileSystem.GetExecutablePath_should_find_existing_executable_with_extension() in c:\projects\choco\src\chocolatey.tests.integration\infrastructure\filesystem\DotNetFileSystemSpecs.cs:line 77

ferventcoder · 2015-11-26T18:52:23Z

Remove your second commit please. I fixed those test issues.

ferventcoder · 2015-12-23T18:51:16Z

Ping @et1975 - can you remove your second commit here?

et1975 · 2015-12-23T20:08:48Z

@ferventcoder I believe I did, the pull request shows only one commit.
Where do you see a problem?

ferventcoder · 2015-12-23T20:19:31Z

Ah right on. The issues lie in rebase - any chance you can rebase your commits against current? If not I can do it.

ferventcoder · 2016-01-05T19:24:03Z

src/chocolatey.tests/infrastructure/filesystem/DotNetFileSystemSpecs.cs

@@ -164,7 +164,7 @@ public void GetExecutablePath_should_find_existing_executable()
            [Fact]
            public void GetExecutablePath_should_find_existing_executable_with_extension()
            {
-                FileSystem.get_executable_path("cmd.exe").ShouldEqual(
+                FileSystem.get_executable_path("cmd.exe").ToLower().ShouldEqual(


I've seen \Windows and \windows returned, I guess it depends on how OS was installed...

It's more weird in that you are shifting it to lower and asking if it is equal to a string with upppercase.

Ah, appologies, copy-paste strikes again, although I thought I reverted my
unit-test touches...
Hm, there are two copies of those tests and I guess
chocolatey.tests.infrastructure.filesystem aren't being executed?

Both get executed.

That's why it's a bit weird to me. :)

... pushed the update

Extends authentication by adding options to sources and commands to specify client certificate and its password, as well as implementing new IClientCertificateProvider from choco/nuget-chocolatey to lookup those options based on the Uri requested. These options are complimentary and can be used in addition to username/password assuming the server implements it. + unit tests fix to use lowercased %ComSpec% when looking for cmd.exe

ferventcoder · 2016-05-29T06:28:48Z

Merged into stable at 026df76

coveralls · 2017-09-27T15:40:09Z

Coverage remained the same at 50.127% when pulling 25066f1 on Prolucid:stable into dbf0d22 on chocolatey:stable.

ferventcoder reviewed Nov 19, 2015
View reviewed changes

ferventcoder changed the title ~~GH-399 client certificate support~~ (GH-399) client certificate support Nov 19, 2015

ferventcoder added the 0 - Waiting on User label Nov 30, 2015

ferventcoder reviewed Jan 5, 2016
View reviewed changes

ferventcoder removed the 0 - Waiting on User label Jan 5, 2016

ferventcoder closed this May 29, 2016

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

(GH-399) client certificate support #481

(GH-399) client certificate support #481

et1975 commented Nov 17, 2015

ferventcoder Nov 19, 2015

et1975 Nov 19, 2015

ferventcoder Nov 19, 2015

ferventcoder Nov 19, 2015

et1975 Nov 19, 2015

ferventcoder Nov 19, 2015

et1975 Nov 20, 2015

ferventcoder commented Nov 19, 2015

ferventcoder commented Nov 19, 2015

ferventcoder commented Nov 19, 2015

et1975 commented Nov 19, 2015

ferventcoder commented Nov 19, 2015

ferventcoder commented Nov 19, 2015

et1975 commented Nov 23, 2015

ferventcoder commented Nov 23, 2015

ferventcoder commented Nov 26, 2015

ferventcoder commented Dec 23, 2015

et1975 commented Dec 23, 2015

ferventcoder commented Dec 23, 2015

ferventcoder Jan 5, 2016

et1975 Jan 5, 2016

ferventcoder Jan 5, 2016

et1975 Jan 5, 2016

ferventcoder Jan 5, 2016

ferventcoder Jan 5, 2016

et1975 Jan 5, 2016

ferventcoder commented May 29, 2016

coveralls commented Sep 27, 2017

(GH-399) client certificate support #481

(GH-399) client certificate support #481

Conversation

et1975 commented Nov 17, 2015

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ferventcoder commented Nov 19, 2015

ferventcoder commented Nov 19, 2015

ferventcoder commented Nov 19, 2015

et1975 commented Nov 19, 2015

ferventcoder commented Nov 19, 2015

ferventcoder commented Nov 19, 2015

et1975 commented Nov 23, 2015

ferventcoder commented Nov 23, 2015

ferventcoder commented Nov 26, 2015

ferventcoder commented Dec 23, 2015

et1975 commented Dec 23, 2015

ferventcoder commented Dec 23, 2015

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ferventcoder commented May 29, 2016

coveralls commented Sep 27, 2017