diff options
author | Colin Walters <walters@verbum.org> | 2017-07-25 10:11:57 -0400 |
---|---|---|
committer | Atomic Bot <atomic-devel@projectatomic.io> | 2017-07-26 18:52:04 +0000 |
commit | e09fc83ab3f4b84685eff427acc29642d7d09104 (patch) | |
tree | d59f0a92ec7fa9dbe9bbe7639da1e3c673da8838 /src/libostree/ostree-core.h | |
parent | 0985158be7cf1529ddb349f0a1e3153600f187ad (diff) | |
download | ostree-e09fc83ab3f4b84685eff427acc29642d7d09104.tar.gz |
lib/core: Add #defines for ref/collection binding
These were previously private, but since we expect people to use them, let's add
`#define`s like we did for some of the other commit metadata.
Closes: #1028
Approved by: jlebon
Diffstat (limited to 'src/libostree/ostree-core.h')
-rw-r--r-- | src/libostree/ostree-core.h | 27 |
1 files changed, 27 insertions, 0 deletions
diff --git a/src/libostree/ostree-core.h b/src/libostree/ostree-core.h index 1fef003a..92b56bb7 100644 --- a/src/libostree/ostree-core.h +++ b/src/libostree/ostree-core.h @@ -226,6 +226,33 @@ typedef enum { * Since: 2017.7 */ #define OSTREE_COMMIT_META_KEY_ENDOFLIFE "ostree.endoflife" +/** + * OSTREE_COMMIT_META_KEY_REF_BINDING: + * + * GVariant type `as`; each element is a branch name. If this is added to a + * commit, `ostree_repo_pull()` will enforce that the commit was retrieved from + * one of the branch names in this array. This prevents "sidegrade" attacks. + * The rationale for having this support multiple branch names is that it helps + * support a "promotion" model of taking a commit and moving it between development + * and production branches. + * + * Since: 2017.9 + */ +#define OSTREE_COMMIT_META_KEY_REF_BINDING "ostree.ref-binding" +/** + * OSTREE_COMMIT_META_KEY_COLLECTION_BINDING: + * + * GVariant type `s`. If this is added to a commit, `ostree_repo_pull()` + * will enforce that the commit was retrieved from a repository which has + * the same collection ID. See `ostree_repo_set_collection_id()`. + * This is most useful in concert with `OSTREE_COMMIT_META_KEY_REF_BINDING`, + * as it more strongly binds the commit to the repository and branch. + * + * Since: 2017.9 + */ +#ifdef OSTREE_ENABLE_EXPERIMENTAL_API +#define OSTREE_COMMIT_META_KEY_COLLECTION_BINDING "ostree.collection-binding" +#endif _OSTREE_PUBLIC const GVariantType *ostree_metadata_variant_type (OstreeObjectType objtype); |