Subject: Re: [PATCH 18/18] signed push: final protocol update

From: Junio C Hamano <[email-masked]>
Date: Mon, 25 Aug 2014 10:59:05 -0700

Shawn Pearce <[email-masked]> writes:

> A stateless nonce could look like:
>
>   nonce = HMAC_SHA1( SHA1(site+path) + '.' + now, site_key )
>
> where site_key is a private key known to the server. It doesn't have
> to be per-repo.
>
> receive-pack would then be willing to accept any nonce whose timestamp
> is within a window, e.g. 10 minutes of the current time, and whose
> signature verifies in the HMAC. The 10 minute window is important to
> allow clients time to generate the object list, perform delta
> compression, and begin transmitting to the server.

Hmph, don't you send the "finally tell the other end" the sequence
of "update this ref from old to new" and the packdata separately?  I
think we have a FLUSH in between, and the push certificate is given
before the FLUSH, which you do not have to wait for 10 minutes.