CHE-5169: Add Git configuration agent #5285

vinokurig · 2017-06-07T06:48:57Z

What does this PR do?

Added Git configuration agent that fetches SSH keys and Git username and email from CHE user preferences, and injects to console Git preferences

What issues does this PR fix or reference?

fixes #5169
fixes #4969

Changelog

Added a Git configuration agent that fetches Git SSH keys, username / email from Che preferences, and injects them into the console Git preferences.

Release Notes

N/A

Docs PR

N/A

codenvy-ci · 2017-06-07T07:44:36Z

Build # 2744 - FAILED

Please check console output at https://ci.codenvycorp.com/job/che-pullrequests-build/2744/ to view the results.

gorkem · 2017-06-07T07:45:16Z

@ibuziuk Take a look at this PR and can you comment if this will work with the GH token work that you have just done for OSIO?

tolusha · 2017-06-07T09:55:12Z

@vinokurig
Git agent name misused. Git agent means that git will be installed and ready to use.
Your PR brings new capability.

vinokurig · 2017-06-07T10:18:41Z

@tolusha How about 'Git injector agent'?

codenvy-ci · 2017-06-07T11:37:25Z

Build success. https://ci.codenvycorp.com/job/che-pullrequests-build/2746/

bmicklea · 2017-06-07T11:47:55Z

Updated title and description to clarify the agent's purpose. @vinokurig - does this inject preferences into the Git console only? In other words is it ensuring that the preferences match in console and menu?

ibuziuk · 2017-06-07T12:34:03Z

@gorkem No, it is not related to setting access token during workspace creation (moving @sunix PRs #4444 #4438 to rh-che) This is more related to what was raised up on the mailing list recently by Pete / Burr - not possible to push via terminal OOTB

slemeur · 2017-06-07T12:40:53Z

@vinokurig : Could you explain why you built this capability by using an agent?

ghost · 2017-06-07T14:28:12Z

@slemeur I can explain - We need to make sure that this feature works in any environment. We had an idea to embed it into our base images and start in an entrypoint. However, it won't work with non Eclipse certified images.

@bmicklea what this agent does is that when git performs ssh operations, it gets keys and git prefs (committer name and email) from user prefs, if any.

tolusha · 2017-06-07T14:29:10Z

How about 'Git injector agent'?

I don't like either

vinokurig · 2017-06-07T14:35:30Z

@tolusha may be 'Git synchroniser agent' ?

ghost · 2017-06-08T05:13:39Z

Git sync agent is cleaner I think.

bmicklea · 2017-06-08T11:00:12Z

But it's inaccurate isn't it? If I change a git setting in the terminal it doesn't sync it back to the Che preferences panel does it?

vinokurig · 2017-06-08T11:14:18Z

@bmicklea It doesn't change back CHE preferences, may be Git fetcher agent ?

bmicklea · 2017-06-08T11:28:52Z

I think Git Config agent is clearest since it's configuring Git preferences.

ghost · 2017-06-08T11:30:41Z

agents/git/src/main/resources/org.eclipse.che.git.script.sh

+
+if [ -z "$(cat /home/user/.bashrc | grep GIT_SSH)" ]
+then
+    printf '\n export GIT_SSH='"$SCRIPT_FILE" >> /home/user/.bashrc


Shouldn't it be ~ since /home/user is home directory only in Eclipse images?

reworked to relative path

vinokurig · 2017-06-08T12:17:48Z

@bmicklea The problem is that the agent doesn't fetch only configs, it also fetches SSH keys

bmicklea · 2017-06-08T12:56:24Z

if it's really just authentication then what about the git auth agent?

vinokurig · 2017-06-08T13:40:42Z

Not just authentication, SSH keys injection + config injection

codenvy-ci · 2017-06-09T14:44:51Z

Build success. https://ci.codenvycorp.com/job/che-pullrequests-build/2774/

vinokurig · 2017-06-12T08:15:55Z

I think Git sync agent is the most suitable name for this agent @bmicklea @tolusha WDYT?

mmorhun · 2017-06-12T08:22:51Z

@vinokurig what about Git credentials agent? WDYT?

bmicklea · 2017-06-12T13:34:32Z

I'm +1 for git credentials agent. I don't like git sync agent because sync implies something that is bi-directional and responsive but this just goes in one direction.

vinokurig · 2017-06-13T08:37:52Z

Renamed to Git Credentials agent @bmicklea @tolusha @skabashnyuk @eivantsov please review

tolusha · 2017-06-13T08:51:47Z

agents/git/pom.xml

+        <version>5.12.0-SNAPSHOT</version>
+    </parent>
+    <artifactId>git-credentials-agent</artifactId>
+    <name>Git Agent</name>


Fix name accordingly

tolusha · 2017-06-13T08:56:28Z

agents/git/src/main/resources/org.eclipse.che.git.json

@@ -0,0 +1,5 @@
+{
+  "id": "org.eclipse.che.git",


"id": "org.eclipse.che.git-credentials",

tolusha · 2017-06-13T08:57:26Z

agents/pom.xml

@@ -32,6 +32,7 @@
        <module>che-core-api-agent-shared</module>
        <module>che-core-api-agent</module>
        <module>ls-json</module>
+        <module>git</module>


git-credentials

codenvy-ci · 2017-06-13T09:34:19Z

Build success. https://ci.codenvycorp.com/job/che-pullrequests-build/2798/

codenvy-ci · 2017-06-13T12:13:10Z

Build # 2801 - FAILED

Please check console output at https://ci.codenvycorp.com/job/che-pullrequests-build/2801/ to view the results.

skabashnyuk · 2017-06-14T07:46:14Z

agents/git-credentials/src/main/resources/org.eclipse.che.git.script.sh

+
+user_name="$(${request} "$api_url/preferences$(if [ -n "$token" ]; then echo "?token=$token"; fi)" | grep -Po '"git.committer.name":.*?[^\\]",' | sed -e "s/\"git.committer.name\":\"//" | sed -e "s/\",//")"
+user_email="$(${request} "$api_url/preferences$(if [ -n "$token" ]; then echo "?token=$token"; fi)" | grep -Po '"git.committer.email":.*?[^\\]",' | sed -e "s/\"git.committer.email\":\"//" | sed -e "s/\",//")"
+git config --global user.name \""$user_name"\"


that means that any commit from console git will be made from the name of workspace owner. Not sure it's good collaboration experience.

Right, but it was discussed before, I mean security implications and commit authorship.

codenvy-ci · 2017-06-14T14:07:05Z

Build success. https://ci.codenvycorp.com/job/che-pullrequests-build/2817/

sunix · 2017-06-26T08:51:56Z

how would this agent behave with multitenant ? (multiple users accessing to the same workspace running the terminal)
It would be bad if I give access to someone to my workspace and he got access to my git credentials

tolusha · 2017-06-26T11:06:56Z

It is the same if you allowed someone to use your laptop. It is bad (
It is supposed that user injects this agent thoughtfully.

sunix · 2017-06-28T12:27:42Z

Sorry, No it is not the same, che is a cloud workspace. Sharing the workspace is not bad but something users expect to have. When you share your laptop to someone else, you don't give access to your user account, nor your Chome saved passwords. To me, all these git users related injection shouldn't go through a shared agent. This is a major security issue and should be reverted IMO. Moreover generated ssh keys are not protected with a passphrase.

gorkem · 2017-06-28T12:53:45Z

I agree with @sunix . We should at least have password protection enabled or remove the SSH key on shared workspaces.

Git credentials agent fetches SSH keys and Git username and email from CHE user preferences, and injects to console Git preferences

vinokurig requested review from skabashnyuk, tolusha, a user and bmicklea June 7, 2017 06:48

CHE-5169: Add Git agent

fb587a7

vinokurig force-pushed the CHE-5169 branch from 14de759 to fb587a7 Compare June 7, 2017 09:48

Merge branch 'master' of github.com:eclipse/che into CHE-5169

2539b5c

bmicklea changed the title ~~CHE-5169: Add Git agent~~ CHE-5169: Add Git configuration agent Jun 7, 2017

Merge branch 'master' of github.com:eclipse/che into CHE-5169

c0344fd

ghost reviewed Jun 8, 2017

View reviewed changes

Igor Vinokur added 2 commits June 8, 2017 16:43

Merge branch 'master' of github.com:eclipse/che into CHE-5169

2b9383c

Merge branch 'master' of github.com:eclipse/che into CHE-5169

2569b5a

slemeur mentioned this pull request Jun 13, 2017

Command line git client in workspace not linked to GUI git codenvy/codenvy#1505

Closed

Igor Vinokur added 2 commits June 13, 2017 11:10

Merge branch 'master' of github.com:eclipse/che into CHE-5169

6a9c3df

fixup! CHE-5169: Add Git agent

7b6cdeb

ghost approved these changes Jun 13, 2017

View reviewed changes

tolusha approved these changes Jun 13, 2017

View reviewed changes

Igor Vinokur added 2 commits June 13, 2017 12:41

fixup! CHE-5169: Add Git agent

9163567

fixup! CHE-5169: Add Git agent

3d5cb2d

bmicklea approved these changes Jun 13, 2017

View reviewed changes

skabashnyuk reviewed Jun 14, 2017

View reviewed changes

Igor Vinokur added 2 commits June 14, 2017 14:09

Merge branch 'master' of github.com:eclipse/che into CHE-5169

a615011

Fix maven version

ecb3e86

vinokurig mentioned this pull request Jun 14, 2017

CHE-5169: Add Git credentials agent codenvy/codenvy#2265

Merged

fixup! CHE-5169: Add Git agent

6f4767c

vinokurig merged commit c5e7a34 into master Jun 14, 2017

vinokurig added this to the 5.13.0 milestone Jun 14, 2017

vinokurig deleted the CHE-5169 branch June 14, 2017 14:44

slemeur added the kind/enhancement A feature request - must adhere to the feature request template. label Jul 6, 2017

JPinkney pushed a commit to JPinkney/che that referenced this pull request Aug 17, 2017

CHE-5169: Add Git credentials agent (eclipse-che#5285)

238d254

Git credentials agent fetches SSH keys and Git username and email from CHE user preferences, and injects to console Git preferences

CHE-5169: Add Git configuration agent #5285

CHE-5169: Add Git configuration agent #5285

Conversation

vinokurig commented Jun 7, 2017 • edited by bmicklea

What does this PR do?

What issues does this PR fix or reference?

Changelog

Release Notes

Docs PR

codenvy-ci commented Jun 7, 2017

gorkem commented Jun 7, 2017

tolusha commented Jun 7, 2017

vinokurig commented Jun 7, 2017

codenvy-ci commented Jun 7, 2017

bmicklea commented Jun 7, 2017

ibuziuk commented Jun 7, 2017

slemeur commented Jun 7, 2017

ghost commented Jun 7, 2017

tolusha commented Jun 7, 2017 • edited

vinokurig commented Jun 7, 2017

ghost commented Jun 8, 2017

bmicklea commented Jun 8, 2017

vinokurig commented Jun 8, 2017

bmicklea commented Jun 8, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

vinokurig commented Jun 8, 2017

bmicklea commented Jun 8, 2017

vinokurig commented Jun 8, 2017

codenvy-ci commented Jun 9, 2017

vinokurig commented Jun 12, 2017

mmorhun commented Jun 12, 2017

bmicklea commented Jun 12, 2017

vinokurig commented Jun 13, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codenvy-ci commented Jun 13, 2017

codenvy-ci commented Jun 13, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codenvy-ci commented Jun 14, 2017

sunix commented Jun 26, 2017 • edited

tolusha commented Jun 26, 2017 • edited

sunix commented Jun 28, 2017

gorkem commented Jun 28, 2017

vinokurig commented Jun 7, 2017 •

edited by bmicklea

tolusha commented Jun 7, 2017 •

edited

sunix commented Jun 26, 2017 •

edited

tolusha commented Jun 26, 2017 •

edited