pub fn authorize_ref_updates(&self) -> Result<(), Error> {
        // This is the fingerprint of the key used to sign the push certificate.
        let key_fingerprint = self
            .env
            .cert_key
            .as_ref()
            .ok_or(Error::Unauthorized("push certificate is not available"))?;
        let key_fingerprint = key_fingerprint
            .strip_prefix("SHA256:")
            .ok_or(Error::Unauthorized("key fingerprint is not a SHA-256 hash"))?;
        let key_fingerprint = base64::decode(key_fingerprint)
            .map_err(|_| Error::Unauthorized("key fingerprint is not valid"))?;

        // We iterate over each ref update and make sure they are all authorized. We need
        // to check that updates are only done to refs under `<project>/refs/remotes/<peer>`
        // for any give `<project>`, where `<peer>` is the identity of the signer.
        for (refname, _, _) in self.updates.iter() {
            // Get the peer/remote we are attempting to push to, and convert it to an SSH
            // key fingerpint.
            let suffix = refname
                .strip_prefix("refs/remotes/")
                .ok_or(Error::Unauthorized("ref name is not valid"))?;
            let (remote, _) = suffix
                .split_once('/')
                .ok_or(Error::Unauthorized("ref name is not valid"))?;
            let peer_id = PeerId::from_default_encoding(remote)
                .map_err(|_| Error::Unauthorized("ref must include a valid peer-id"))?;
            let peer_fingerprint = crate::to_ssh_fingerprint(&peer_id)?;

            if key_fingerprint[..] != peer_fingerprint[..] {
                return Err(Error::Unauthorized("signer does not match remote ref"));
            }
        }
        Ok(())
    }
/// Authorizes each ref update, making sure the push certificate is signed by the same
/// key as the owner/parent of the ref.
Authorizes each ref update, making sure the push certificate is signed by the same
key as the owner/parent of the ref.
Authorizes each ref update making sure the push certificate is signed by the same key as the owner / parent of the ref .
pub fn authorize_ref_updates(&self) -> Result<(), Error> {
        // This is the fingerprint of the key used to sign the push certificate.
        let key_fingerprint = self
            .env
            .cert_key
            .as_ref()
            .ok_or(Error::Unauthorized("push certificate is not available"))?;
        let key_fingerprint = key_fingerprint
            .strip_prefix("SHA256:")
            .ok_or(Error::Unauthorized("key fingerprint is not a SHA-256 hash"))?;
        let key_fingerprint = base64::decode(key_fingerprint)
            .map_err(|_| Error::Unauthorized("key fingerprint is not valid"))?;
        // We iterate over each ref update and make sure they are all authorized. We need
        // to check that updates are only done to refs under `<project>/refs/remotes/<peer>`
        // for any give `<project>`, where `<peer>` is the identity of the signer.
        for (refname, _, _) in self.updates.iter() {
            // Get the peer/remote we are attempting to push to, and convert it to an SSH
            // key fingerpint.
            let suffix = refname
                .strip_prefix("refs/remotes/")
                .ok_or(Error::Unauthorized("ref name is not valid"))?;
            let (remote, _) = suffix
                .split_once('/')
                .ok_or(Error::Unauthorized("ref name is not valid"))?;
            let peer_id = PeerId::from_default_encoding(remote)
                .map_err(|_| Error::Unauthorized("ref must include a valid peer-id"))?;
            let peer_fingerprint = crate::to_ssh_fingerprint(&peer_id)?;
            if key_fingerprint[..] != peer_fingerprint[..] {
                return Err(Error::Unauthorized("signer does not match remote ref"));
            }
        }
        Ok(())
    }
pub fn authorize_ref_updates ( & self ) -> Result < ( ) , Error > { // This is the fingerprint of the key used to sign the push certificate. let key_fingerprint = self . env . cert_key . as_ref ( ) . ok_or ( Error :: Unauthorized ( " " ) ) ? ; let key_fingerprint = key_fingerprint . strip_prefix ( " " ) . ok_or ( Error :: Unauthorized ( " " ) ) ? ; let key_fingerprint = base64 :: decode ( key_fingerprint ) . map_err ( | _ | Error :: Unauthorized ( " " ) ) ? ; // We iterate over each ref update and make sure they are all authorized. We need // to check that updates are only done to refs under `<project>/refs/remotes/<peer>` // for any give `<project>`, where `<peer>` is the identity of the signer. for ( refname , _ , _ ) in self . updates . iter ( ) { // Get the peer/remote we are attempting to push to, and convert it to an SSH // key fingerpint. let suffix = refname . strip_prefix ( " " ) . ok_or ( Error :: Unauthorized ( " " ) ) ? ; let ( remote , _ ) = suffix . split_once ( '/' ) . ok_or ( Error :: Unauthorized ( " " ) ) ? ; let peer_id = PeerId :: from_default_encoding ( remote ) . map_err ( | _ | Error :: Unauthorized ( " " ) ) ? ; let peer_fingerprint = crate :: to_ssh_fingerprint ( & peer_id ) ? ; if key_fingerprint [ .. ] != peer_fingerprint [ .. ] { return Err ( Error :: Unauthorized ( " " ) ) ; } } Ok ( ( ) ) }
Authorizes each ref update, making sure the push certificate is signed by the same
key as the owner/parent of the ref.
Authorizes each ref update making sure the push certificate is signed by the same key as the owner / parent of the ref .
&self
&self