fix!: restore action-selected Git authentication

.pre-commit-config.yaml

@@ -33,7 +33,7 @@ repos:
         args: [ "--fix", "--unsafe-fixes"] # Allow unsafe fixes (ruff pretty strict about what it can fix)
       - id: ruff-format
   - repo: https://github.com/djlint/djLint
-    rev: v1.46.1
+    rev: v1.46.2
     hooks:
       - id: djlint-reformat-django
       - id: djlint-django
@@ -61,7 +61,7 @@ repos:
         exclude: "README.md"
   # Central hooks
   - repo: https://github.com/phantomcyber/dev-cicd-tools
-    rev: v2.2.10
+    rev: v2.2.12
     hooks:
       - id: build-docs
         language: python

README.md

@@ -109,7 +109,6 @@ VARIABLE | REQUIRED | TYPE | DESCRIPTION
 **password** | optional | password | Password |
 **repo_name** | optional | string | Repo Name |
 **access_token** | optional | password | Access token for the repository |
-**ssh_host_key** | optional | string | Trusted SSH server host key in known_hosts format. SSH connections fail closed when this value is not configured. |
 
 ### Supported Actions
 

git.json

@@ -66,11 +66,6 @@
             "description": "Access token for the repository",
             "data_type": "password",
             "order": 5
-        },
-        "ssh_host_key": {
-            "description": "Trusted SSH server host key in known_hosts format. SSH connections fail closed when this value is not configured.",
-            "data_type": "string",
-            "order": 6
         }
     },
     "actions": [

git_connector.py

@@ -18,7 +18,6 @@
 import ast
 import json
 import os
-import shlex
 import urllib.parse
 from pathlib import Path
 from shutil import rmtree
@@ -52,7 +51,6 @@ def __init__(self):
         self.app_state_dir = None
         self.modified_repo_uri = None
         self.ssh = False
-        self.ssh_host_key = None
         return
 
     def initialize(self):
@@ -75,7 +73,6 @@ def initialize(self):
         self.repo_name = self.config.get(consts.GIT_CONFIG_REPO_NAME)
         self.repo_uri = self.config.get(consts.GIT_CONFIG_REPO_URI)
         self.access_token = self.config.get("access_token")
-        self.ssh_host_key = self.config.get(consts.GIT_CONFIG_SSH_HOST_KEY)
 
         http_proxy = os.environ.get("HTTP_PROXY")
         https_proxy = os.environ.get("HTTPS_PROXY")
@@ -91,14 +88,10 @@ def _set_repo_attributes(self, param={}):
         Get some repo-specific attributes out of initialize for use in cloning without a configured asset
         """
 
-        configured_repo_uri = self.config.get(consts.GIT_CONFIG_REPO_URI)
-        requested_repo_uri = param.get("repo_url")
-        self.repo_uri = requested_repo_uri or self.repo_uri
+        self.repo_uri = param.get("repo_url") or self.repo_uri
         self.branch_name = param.get("branch") or self.branch_name
         self.modified_repo_uri = self.repo_uri
-        supplied_access_token = param.get("access_token")
-        use_asset_credentials = not requested_repo_uri or self._same_remote(configured_repo_uri, requested_repo_uri)
-        self.access_token = supplied_access_token or (self.access_token if use_asset_credentials else None)
+        self.access_token = param.get("access_token") or self.access_token
 
         # create another copy so that URL with password is not displayed during test_connectivity action
         try:
@@ -111,7 +104,7 @@ def _set_repo_attributes(self, param={}):
                 # Prefer access_token over password
                 if self.access_token:
                     auth_part = f"x-token-auth:{urllib.parse.quote_plus(self.access_token)}"
-                elif use_asset_credentials and self.username and self.password:
+                elif self.username and self.password:
                     auth_part = f"{self.username}:{urllib.parse.quote_plus(self.password)}"
                 else:
                     auth_part = None
@@ -123,20 +116,8 @@ def _set_repo_attributes(self, param={}):
             else:
                 self.save_progress("Connecting with SSH")
                 self.ssh = True
-                ssh_dir = self.app_state_dir / f".ssh-{self.get_asset_id()}"
-                ssh_dir.mkdir(mode=0o700, parents=True, exist_ok=True)
-                rsa_key_path = ssh_dir / "id_rsa"
-                known_hosts_path = ssh_dir / "known_hosts"
-                host_key = (self.ssh_host_key or "").strip()
-                if "\n" in host_key or "\r" in host_key:
-                    host_key = ""
-                known_hosts_path.write_text(f"{host_key}\n" if host_key else "")
-                known_hosts_path.chmod(0o600)
-                git_ssh_cmd = (
-                    "ssh -oStrictHostKeyChecking=yes "
-                    f"-oUserKnownHostsFile={shlex.quote(str(known_hosts_path))} "
-                    f"-i {shlex.quote(str(rsa_key_path))}"
-                )
+                rsa_key_path = self.app_state_dir / f".ssh-{self.get_asset_id()}" / "id_rsa"
+                git_ssh_cmd = f"ssh -oStrictHostKeyChecking=no -i {rsa_key_path}"
                 os.environ["GIT_SSH_COMMAND"] = git_ssh_cmd
         except AttributeError:
             return phantom.APP_ERROR
@@ -155,26 +136,6 @@ def _set_repo_attributes(self, param={}):
 
         return phantom.APP_SUCCESS
 
-    @staticmethod
-    def _same_remote(configured_uri, requested_uri):
-        """Return whether two HTTP(S) repository URLs use the same endpoint."""
-        if not configured_uri or not requested_uri:
-            return False
-        try:
-            configured = urllib.parse.urlparse(configured_uri)
-            requested = urllib.parse.urlparse(requested_uri)
-            return (
-                configured.scheme.casefold(),
-                configured.hostname,
-                configured.port,
-            ) == (
-                requested.scheme.casefold(),
-                requested.hostname,
-                requested.port,
-            )
-        except ValueError:
-            return False
-
     def _list_repos(self, param):
         """Function lists the git repos configured/pulled.
 

git_consts.py

@@ -17,7 +17,6 @@
 GIT_CONFIG_BRANCH_NAME = "branch_name"
 GIT_CONFIG_USERNAME = "username"
 GIT_CONFIG_PASSWORD = "password"  # pragma: allowlist secret
-GIT_CONFIG_SSH_HOST_KEY = "ssh_host_key"
 GIT_CONNECTION_TEST_MSG = "Querying to verify the repo URI"
 GIT_TEST_CONNECTIVITY_FAIL = "Connectivity test failed"
 GIT_TEST_CONNECTIVITY_SUCCESS = "Connectivity test succeeded"

release_notes/unreleased.md

@@ -1 +1,4 @@
 **Unreleased**
+
+* Restore asset authentication for action-selected Git remotes.
+* Restore noninteractive SSH connections without mandatory host-key verification.