Compare commits

..

13 commits

Author SHA1 Message Date
Tiziano Zito 02beb4359f add reference to tarot cards meaning 2024-08-29 10:14:45 +03:00
Tiziano Zito a0d4fa9c86 my solution 2024-08-26 16:17:24 +03:00
Tiziano Zito 3bead9f7b6 add full lecture notes 2024-08-26 16:16:49 +03:00
Tiziano Zito 0113bf68b9 Merge pull request 'hide user password on user creation' (#18) from giovannife/2024-heraklion-git:secure-add-user into main
Reviewed-on: #18

Thanks!
2024-08-26 14:47:36 +02:00
ASPP Student f54993e5de hide user password on user creation 2024-08-26 15:44:37 +03:00
Tiziano Zito 4f77cc464f Merge pull request 'implement sha256 hashing of password for security reason' (#7) from romaingu/2024-heraklion-git:hash_pwd into main
Reviewed-on: #7
2024-08-26 14:40:12 +02:00
ASPP Student de4dc255ac implement hashing password where needed 2024-08-26 15:31:17 +03:00
ASPP Student 487f0f9597 fix hashing password 2024-08-26 15:31:04 +03:00
Tiziano Zito 9843b4e994 Merge pull request 'Add a cheatsheet for git commands' (#4) from matthias/2024-heraklion-git:cheatsheet into main
Reviewed-on: #4
2024-08-26 13:55:37 +02:00
ASPP Student 028fb6bf93 implement password hashing function 2024-08-26 14:53:00 +03:00
Matthias Tangemann 92818882f9 add a cheatsheet for git commands 2024-08-26 14:50:17 +03:00
Tiziano Zito b42ef06d91 Merge pull request 'Hide password and capitalize global variables' (#2) from aitor/2024-heraklion-git:safe-psw into main
Reviewed-on: #2
2024-08-26 12:04:22 +02:00
morales-gregorio 54201439cb capitalize global variable 2024-08-26 12:00:16 +02:00
3 changed files with 267 additions and 25 deletions

View file

@ -4,6 +4,8 @@
- Login with your username found on your name badge and set the initial password for your account: https://git.aspp.school/user/login
- You'll have to type that password many many times this week: choose wisely!
- We will use the [exercise](exercise.md) in the repo for the rest of the lecture
- find a partner to do pair-programming for this lecture by finding someone with the same tarot card as you
- before starting, make yourself acquainted with the meanining and the power of the tarot cards: carefully read [this booklet](https://aspp.school/wiki/_media/tarot-runic.pdf)
## A cautionary quote
@ -13,9 +15,33 @@
— Lars Wirzenius (Linux kernel developer)
## Lecture notes
## Warm-Up
- how to start a repo from scratch?
- `git init` local method
- on an online forge (GitHub, GitLab, …): `git clone`
- how to revert mistakes?
- before commit:
- `git restore <file>` [discard changes in the working directory] __changes files__
- `git restore --staged <file>` [unstage changes ➔ opposite of `git add <file>`, does not modify the working directory]
- after commit:
- `git revert <commit>` [creates a new commit, modifies the working directory]
- `git reset <commit>` [only reset the HEAD pointer, does not modify the working directory] __rewrites history__ ➔ can not be used if you have already pushed to some remote
- `git reset --hard <commit>` [reset HEAD and modify working directory] __rewrites history__ and __changes files__ ➔ can not be used if you have already pushed to some remote
- how to *move* the whole working directory to a specific point in history?
- `git checkout <commit>``DETACHED HEAD` problem, __changes__ __files__
- interaction with branches: `git branch <branch_name>` + `git switch <branch_name>`
- how to copy a file from a different branch:
- `git checkout <branch> <file>` ➔ the file is staged automatically
- `git restore --source=<branch> <file` ➔ the file is not staged
- `git gui`: building commits along the way interactively (for the *mess around* type of workflows)
- check out these [sketches](git-commands-visualizations.pdf) for a graphical visualization of git commands!
… will follow after the lecture …
## The Open Source model
- remotes: `git pull <from_where> <what>`, `git push <where> <what>`, `git fetch <from_where> <what>`, `git merge <another_branch>`
- GitHub: forks, branches and PRs: important ➔ explain fork vs. clone!!!
- strategies for keeping your fork up-to-date: your `main`, origin's and upstream's `main`, short-lived and long-lived topic branches
- a more thorough and detailed explanation can be found on the [SciPy Contributor's Guide](https://docs.scipy.org/doc/scipy/dev/gitwash/gitwash.html). This guide can be adapted to your own needs, see [gitwash](https://github.com/matthew-brett/gitwash).
- make it clear that GitHub and GitLab are just options (git≠GitHub)
## Scenarios
1. [lone scientist](scenarios/scenario1.png) working alone in the cellar without Internet (local git)

84
auth.py
View file

@ -1,48 +1,88 @@
import getpass
import json
import pathlib
import random
import string
import sys
from getpass import getpass
pwdb_path = 'pwdb.json'
# name of the file where we store the pw database
PWDB_FLNAME = pathlib.Path('pwdb.json')
# list of valid characters for salt (only ASCII letters + digits + punctuation)
CHARS = string.ascii_letters + string.digits + string.punctuation
# length of salt
SALT_LENGTH = 5
def get_credentials():
# get input from terminal
username = input('Enter your username: ')
password = getpass('Enter your password: ')
# get password using the appropriate module, so that typed characters are not
# echoed to the terminal
password = getpass.getpass('Enter your password: ')
return (username, password)
def authenticate(username, password, pwdb):
return password == pwdb[username]
def authenticate(username, pass_text, pwdb):
# get the salt from the database
salt = pwdb[username][1]
# calculate hash and compare with stored hash
return pwhash(pass_text, salt) == pwdb[username][0]
def add_user(username, pwdb):
pwdb[username] = input(f'Enter password for {username}: ')
# do not try to add a username twice
if username in pwdb:
raise Exception(f'Username already exists [{username}]!')
else:
password = getpass.getpass(f'Enter password for {username}: ')
salt = get_salt()
pwdb[username] = (pwhash(password,salt), salt)
return pwdb
def read_pwdb(pwdb_path):
try:
pwdb_file = open(pwdb_path, 'rt')
pwdb = json.load(pwdb_file)
except Exception:
if not pwdb_path.exists():
pwdb = {}
else:
with open(pwdb_path, 'rt') as pwdb_file:
pwdb = json.load(pwdb_file)
return pwdb
def write_pwdb(pwdb, pwdb_path):
pwdb_file = open(pwdb_path, 'wt')
with open(pwdb_path, 'wt') as pwdb_file:
json.dump(pwdb, pwdb_file)
def pwhash(pass_text, salt):
# simple additive hash -> very insecure!
hash_ = 0
full_pass_text = pass_text + salt
for idx, char in enumerate(full_pass_text):
# use idx as a multiplier, so that shuffling the characters returns a
# different hash
hash_ += (idx+1)*ord(char)
return hash_
if __name__ == "__main__":
pwdb_path = 'pwdb.json'
def get_salt():
salt_chars = random.choices(CHARS, k=SALT_LENGTH)
return ''.join(salt_chars)
def main(pwdb_path):
# load the password database from file
pwdb = read_pwdb(pwdb_path)
# if we are passed an argument, we want to add a new user
if len(sys.argv) > 1:
pwdb = add_user(sys.argv[1], pwdb)
write_pwdb(pwdb, pwdb_path)
else:
username, password = get_credentials()
if username not in pwdb:
print('Wrong username!')
else:
if authenticate(username, password, pwdb):
print('Successfully authenticated!')
else:
print('Wrong password!')
return
# ask for credentials
username, password = get_credentials()
if username not in pwdb or not authenticate(username, password, pwdb):
print('Wrong username or password!')
else:
print('Successfully authenticated!')
return
if __name__ == '__main__':
main(PWDB_FLNAME)

176
cheatsheet.md Normal file
View file

@ -0,0 +1,176 @@
# Git cheatsheet
## Creating a repository
```bash
git init
```
Creates new git repository in current directory.
```bash
git clone <url> (<path>)
```
Clones the repository at the specified url. If no path is specified, the repository will
be cloned into a directory with the same name as the remote repository.
## Branches
```bash
git branch
```
Lists all branches in the repository.
```bash
git branch <branch-name>
```
Creates a new branch with the given name.
```bash
git switch <branch-name>
```
Switches to the specified branch.
```bash
git merge <branch-name>
```
Merges the specified branch into the current branch.
## Making changes
```bash
git status
```
Shows the status of the repository. This includes the current branch and files that have been modified.
```bash
git diff (--staged)
```
Shows the changes that have been made to the files in the repository. Use `--staged` to see changes that have been added to the staging area.
```bash
git add <file>
```
Adds the specified file to the staging area.
```bash
git add .
```
Adds all files in the current directory to the staging area.
```bash
git reset (<file>)
```
Removes the specified file from the staging area. If no file is specified, all files are removed.
```bash
git commit (-m "<message>")
```
Commits all changes in the staging area to the current branch. If the `-m` flag is omitted, a text editor will open to write a commit message.
```bash
git commit --amend
```
Adds the staged changes to the last commit. This can be used for fixing typos in the commit message.
## Undoing changes
```bash
git restore <file>
```
Restores the specified file to the state of the last commit. This undoes uncommitted changes.
```bash
git revert <commit>
```
Creates a new commit that undoes the changes of the specified commit. Use `git log` to find the hash of the commit.
```bash
git reset --hard <commit>
```
Resets the current branch to the specified commit. DANGER: This will remove all changes after the specified commit. Prefer `git revert`.
## Looking at the history
```bash
git log (--oneline)
```
Shows all past commits on the current branch. Use `--oneline` to show a more compact view.
```bash
git show <commit>
```
Shows the changes of the specified commit. Use `git log` to find the has of the commit.
## Remote repositories
```bash
git remote add <remote> <url>
```
Adds a new remote repository with the specified name (e.g. `origin` or `upstream`) and url. Origin is automatically created when cloning a repository.
```bash
git push <remote> <branch>
```
Pushes the specified branch to the remote repository.
```bash
git fetch <remote>
```
Fetches changes from the remote repository.
```bash
git pull <remote> <branch>
```
Fetches changes from the remote repository and merges them into the current branch.
## Typical workflow
```bash
# 1. Fork the repository on GitHub / git.aspp.school
# 2. Clone the repository
git clone <fork-url>
git remote add upstream <upstream-url>
# 3. Create a new branch
git branch <topic-branch>
git switch <topic-branch>
# 4. Make changes to the code
# 5. Add and commit changes
git add .
git commit -m "<message>"
# 6. Push changes to your fork
git push origin <topic-branch>
# 7. Create a pull request on GitHub / git.aspp.school
# 8. Wait for the pull request to be reviewed and merged
# 9. Pull changes from the remote repository
git switch main
git pull upstream main
# 10. Delete the topic branch
git branch -d <topic-branch>
```
Whenever the remote repository is updated (i.e. when a pull request is merged), you need to pull the changes into your local repository.
```bash
git switch main
git pull upstream main
# If you have an active topic branch, you need to rebase it on top of the updated main branch
git switch <topic-branch>
git rebase main
```
## Getting help
```bash
git help <command>
```
Shows the manual page for the specified command (`add`, `commit`, `push`, etc.).
Official Git documentation: https://git-scm.com/docs