git: switch to golang implementation #1048
Open
+50,854
−123
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
tiborvass
reviewed
Jun 13, 2019
| doFetch = false | ||
| } | ||
| } | ||
|
|
||
| if doFetch { | ||
| // make sure no old lock files have leaked | ||
| os.RemoveAll(filepath.Join(gitDir, "shallow.lock")) | ||
| // os.RemoveAll(filepath.Join(gitDir, "shallow.lock")) |
|
There is also a question of what to do with the host check on SSH. Currently, there is no validation. Github does have a page with their fingerprints https://help.github.com/en/articles/githubs-ssh-key-fingerprints so could at least validate that. But I'm concerned about what would happen if they add ecdsa or their keys leak. I don't want to break everyone in that case. |
|
Can we have daemon flag to switch implementation? |
thaJeztah
reviewed
Mar 22, 2022
| @@ -66,7 +65,8 @@ require ( | |||
| golang.org/x/time v0.0.0-20161028155119-f51c12702a4d | |||
| google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8 | |||
| google.golang.org/grpc v1.20.1 | |||
| gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 // indirect | |||
| gopkg.in/src-d/go-billy.v4 v4.2.1 | |||
| gopkg.in/src-d/go-git.v4 v4.11.0 | |||
There was a problem hiding this comment.
Looks like this repository has been archived, and moved to https://github.com/go-git/go-git
3 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This switches git source implementation to use
gopkg.in/src-d/go-gitinstead of executinggitbinary.Executing a binary is a possible security concern. We should at least run it inside container and drop privileges but that adds many more complications.
This implementation (re)enables SSH git repos that now use the same ssh forwarding as the
RUN --mount=type=sshdoes (meaning--sshis required form client side to build). Adding this support while executing a binary would have been another security problem.In the future, I'd also want to add support for local repos using this that would do the fetch through the session endpoint.
Currently I have found two issues:
unshallowfetch after a shallow one. Eg. requesting a SHA after requesting a tag. I have disabled shallow fetches because of it for now. Will look into what it takes to add this support to library.