Load auth libraries only when a request needs one

Required at the top, a missing luaossl or luaposix failed every request
to the site, public pages included, and each public page paid to load
both.

2 files changed, 20 insertions, 12 deletions

diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.luaindex 18a80fd..0573549 100644--- a/custom/extensions/auth-file.lua+++ b/custom/extensions/auth-file.lua@@ -20,7 +20,9 @@ -- posix.sys.stat and posix.unistd and lives at -- <https://github.com/luaposix/luaposix>. The reliable cross-platform way to -- install them is LuaRocks matched to your Lua version, and luaossl also needs--- the OpenSSL development headers present.+-- the OpenSSL development headers present. Each is loaded only once a request+-- needs it, so a public repository is served without them while a protected+-- one is refused. -- --     # Debian and Ubuntu --     sudo apt install luarocks libssl-dev@@ -45,11 +47,6 @@ -- secret file accept each other's cookies. That is acceptable for gating -- read access to a git browser, so weigh it before guarding anything more. -local sysstat = require("posix.sys.stat")-local unistd = require("posix.unistd")-local rand = require("openssl.rand")-local hmac = require("openssl.hmac")- -- The values that follow are the configuration and are meant to be edited.  -- Accounts live one per line as username:hash, where the hash is any kind this@@ -272,6 +269,9 @@ function get_secret() 	end 	local secret_file = io.open(secret_filename, "r") 	if secret_file == nil then+		local sysstat = require("posix.sys.stat")+		local unistd = require("posix.unistd")+		local rand = require("openssl.rand") 		-- The secret is written under a tightened mask so it is not 		-- created readable by anyone but the user cgit runs as, and 		-- the old mask goes back on every way out.@@ -365,6 +365,7 @@ function validate_value(expected_field, cookie) 	end  	local payload = field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt+	local hmac = require("openssl.hmac") 	local expected_signature = tohex(hmac.new(get_secret(), "sha256"):final(payload)) 	if not constant_equals(signature, expected_signature) then 		return nil@@ -395,6 +396,8 @@ function secure_value(field, value, expiration) 		return "" 	end +	local rand = require("openssl.rand")+	local hmac = require("openssl.hmac") 	local salt = tohex(rand.bytes(16)) 	value = url_encode(value) 	field = url_encode(field)@@ -469,6 +472,7 @@ function authenticate_post() 	local password = post["password"] 	local ok = false 	if username ~= nil and password ~= nil and #password <= max_password_bytes then+		local unistd = require("posix.unistd") 		local hash, stand_in = account_hash(username) 		if hash == nil then 			-- Spend the work anyway, see account_hash.
diff --git a/custom/extensions/auth-file.lua b/custom/extensions/auth-file.lua
index 18a80fd..0573549 100644
--- a/custom/extensions/auth-file.lua
+++ b/custom/extensions/auth-file.lua
@@ -20,7 +20,9 @@
 -- posix.sys.stat and posix.unistd and lives at
 -- <https://github.com/luaposix/luaposix>. The reliable cross-platform way to
 -- install them is LuaRocks matched to your Lua version, and luaossl also needs
--- the OpenSSL development headers present.
+-- the OpenSSL development headers present. Each is loaded only once a request
+-- needs it, so a public repository is served without them while a protected
+-- one is refused.
 --
 --     # Debian and Ubuntu
 --     sudo apt install luarocks libssl-dev
@@ -45,11 +47,6 @@
 -- secret file accept each other's cookies. That is acceptable for gating
 -- read access to a git browser, so weigh it before guarding anything more.
 
-local sysstat = require("posix.sys.stat")
-local unistd = require("posix.unistd")
-local rand = require("openssl.rand")
-local hmac = require("openssl.hmac")
-
 -- The values that follow are the configuration and are meant to be edited.
 
 -- Accounts live one per line as username:hash, where the hash is any kind this
@@ -272,6 +269,9 @@ function get_secret()
 	end
 	local secret_file = io.open(secret_filename, "r")
 	if secret_file == nil then
+		local sysstat = require("posix.sys.stat")
+		local unistd = require("posix.unistd")
+		local rand = require("openssl.rand")
 		-- The secret is written under a tightened mask so it is not
 		-- created readable by anyone but the user cgit runs as, and
 		-- the old mask goes back on every way out.
@@ -365,6 +365,7 @@ function validate_value(expected_field, cookie)
 	end
 
 	local payload = field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt
+	local hmac = require("openssl.hmac")
 	local expected_signature = tohex(hmac.new(get_secret(), "sha256"):final(payload))
 	if not constant_equals(signature, expected_signature) then
 		return nil
@@ -395,6 +396,8 @@ function secure_value(field, value, expiration)
 		return ""
 	end
 
+	local rand = require("openssl.rand")
+	local hmac = require("openssl.hmac")
 	local salt = tohex(rand.bytes(16))
 	value = url_encode(value)
 	field = url_encode(field)
@@ -469,6 +472,7 @@ function authenticate_post()
 	local password = post["password"]
 	local ok = false
 	if username ~= nil and password ~= nil and #password <= max_password_bytes then
+		local unistd = require("posix.unistd")
 		local hash, stand_in = account_hash(username)
 		if hash == nil then
 			-- Spend the work anyway, see account_hash.
diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.luaindex f6a0521..1b46fba 100644--- a/custom/extensions/auth-inline.lua+++ b/custom/extensions/auth-inline.lua@@ -20,7 +20,9 @@ -- posix.sys.stat and posix.unistd and lives at -- <https://github.com/luaposix/luaposix>. The reliable cross-platform way to -- install them is LuaRocks matched to your Lua version, and luaossl also needs--- the OpenSSL development headers present.+-- the OpenSSL development headers present. Each is loaded only once a request+-- needs it, so a public repository is served without them while a protected+-- one is refused. -- --     # Debian and Ubuntu --     sudo apt install luarocks libssl-dev@@ -45,11 +47,6 @@ -- secret file accept each other's cookies. That is acceptable for gating -- read access to a git browser, so weigh it before guarding anything more. -local sysstat = require("posix.sys.stat")-local unistd = require("posix.unistd")-local rand = require("openssl.rand")-local hmac = require("openssl.hmac")- -- The values that follow are the configuration and are meant to be edited.  -- Protected repositories and the users allowed into each. A repository named@@ -233,6 +230,9 @@ function get_secret() 	end 	local secret_file = io.open(secret_filename, "r") 	if secret_file == nil then+		local sysstat = require("posix.sys.stat")+		local unistd = require("posix.unistd")+		local rand = require("openssl.rand") 		-- The secret is written under a tightened mask so it is not 		-- created readable by anyone but the user cgit runs as, and 		-- the old mask goes back on every way out.@@ -326,6 +326,7 @@ function validate_value(expected_field, cookie) 	end  	local payload = field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt+	local hmac = require("openssl.hmac") 	local expected_signature = tohex(hmac.new(get_secret(), "sha256"):final(payload)) 	if not constant_equals(signature, expected_signature) then 		return nil@@ -356,6 +357,8 @@ function secure_value(field, value, expiration) 		return "" 	end +	local rand = require("openssl.rand")+	local hmac = require("openssl.hmac") 	local salt = tohex(rand.bytes(16)) 	value = url_encode(value) 	field = url_encode(field)@@ -430,6 +433,7 @@ function authenticate_post() 	local password = post["password"] 	local ok = false 	if username ~= nil and password ~= nil and #password <= max_password_bytes then+		local unistd = require("posix.unistd") 		local hash, stand_in = account_hash(username) 		if hash == nil then 			-- Spend the work anyway, see account_hash.
diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua
index f6a0521..1b46fba 100644
--- a/custom/extensions/auth-inline.lua
+++ b/custom/extensions/auth-inline.lua
@@ -20,7 +20,9 @@
 -- posix.sys.stat and posix.unistd and lives at
 -- <https://github.com/luaposix/luaposix>. The reliable cross-platform way to
 -- install them is LuaRocks matched to your Lua version, and luaossl also needs
--- the OpenSSL development headers present.
+-- the OpenSSL development headers present. Each is loaded only once a request
+-- needs it, so a public repository is served without them while a protected
+-- one is refused.
 --
 --     # Debian and Ubuntu
 --     sudo apt install luarocks libssl-dev
@@ -45,11 +47,6 @@
 -- secret file accept each other's cookies. That is acceptable for gating
 -- read access to a git browser, so weigh it before guarding anything more.
 
-local sysstat = require("posix.sys.stat")
-local unistd = require("posix.unistd")
-local rand = require("openssl.rand")
-local hmac = require("openssl.hmac")
-
 -- The values that follow are the configuration and are meant to be edited.
 
 -- Protected repositories and the users allowed into each. A repository named
@@ -233,6 +230,9 @@ function get_secret()
 	end
 	local secret_file = io.open(secret_filename, "r")
 	if secret_file == nil then
+		local sysstat = require("posix.sys.stat")
+		local unistd = require("posix.unistd")
+		local rand = require("openssl.rand")
 		-- The secret is written under a tightened mask so it is not
 		-- created readable by anyone but the user cgit runs as, and
 		-- the old mask goes back on every way out.
@@ -326,6 +326,7 @@ function validate_value(expected_field, cookie)
 	end
 
 	local payload = field .. "|" .. value .. "|" .. tostring(expiration) .. "|" .. salt
+	local hmac = require("openssl.hmac")
 	local expected_signature = tohex(hmac.new(get_secret(), "sha256"):final(payload))
 	if not constant_equals(signature, expected_signature) then
 		return nil
@@ -356,6 +357,8 @@ function secure_value(field, value, expiration)
 		return ""
 	end
 
+	local rand = require("openssl.rand")
+	local hmac = require("openssl.hmac")
 	local salt = tohex(rand.bytes(16))
 	value = url_encode(value)
 	field = url_encode(field)
@@ -430,6 +433,7 @@ function authenticate_post()
 	local password = post["password"]
 	local ok = false
 	if username ~= nil and password ~= nil and #password <= max_password_bytes then
+		local unistd = require("posix.unistd")
 		local hash, stand_in = account_hash(username)
 		if hash == nil then
 			-- Spend the work anyway, see account_hash.