Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ecosystem: rockspecs should not use insecure git protocol #6587

Closed
76 of 79 tasks
Totktonada opened this issue Nov 2, 2021 · 5 comments
Closed
76 of 79 tasks

ecosystem: rockspecs should not use insecure git protocol #6587

Totktonada opened this issue Nov 2, 2021 · 5 comments
Assignees
@Totktonada
Labels
infrastructure luarocks

Comments

@Totktonada
Copy link
Member

Totktonada commented Nov 2, 2021 •
edited

We recently was hit by the following problem:

$ tarantoolctl rocks install luatest                                                                                                                                                               
Installing http://rocks.tarantool.org/luatest-scm-1.rockspec

Cloning into 'luatest'...
fatal: remote error: 
  The unauthenticated git protocol on port 9418 is no longer supported.
Please see https://github.blog/2021-09-01-improving-git-protocol-security-github/ for more information.

Error: Failed cloning git repository.

The reason is that GitHub is going to disable pulls using insecure git protocol: https://github.blog/2021-09-01-improving-git-protocol-security-github/.

Generally it means that we should replace url = 'git://github.com/<...>'.git rockspec directive with url = 'git+https://github.com/<...>.git'. (Caution: just url = 'https://<...>' means a tarball, not a git repository.)

I resolved the problem manually: updated all problematic rockspecs on rocks.tarantool.org (it is the server, which is used by default by tarantoolctl rocks [subcommand]).

However we should update rockspecs in repositories, because it is quite usual to deploy a rockspec from a project repository to rocks.tarantool.org automatically from CI (or manually, but the rockspec is anyway based on one from the repository).

We should also restrict rocks.tarantool.org server to decline rockspecs with insecure github.com repository URLs:

The list of rocks.tarantool.org rocks with status against this problem is the following (will be updated).

Removed the 'modulekit' rockspec from rocks.tarantool.org, because it is too old (corresponds to the old repository layout) and could not be installed anymore. The repository is splitted now to luakit and ckit branches. Since there is no much sense to deploy the template repository, I will not deploy 'luakit' and 'ckit' rocks instead of the 'modulekit' one.

luafun will be updated here:
@Totktonada Totktonada self-assigned this Nov 2, 2021
Totktonada added a commit to tarantool/modulekit that referenced this issue Nov 2, 2021
@Totktonada
rockspec: use git+https:// for git repository URL
0aa4c4c 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
@Totktonada Totktonada mentioned this issue Nov 2, 2021
Merged
Totktonada added a commit to tarantool/modulekit that referenced this issue Nov 2, 2021
@Totktonada
rockspec: use git+https:// for git repository URL
11cb27e 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
@Totktonada Totktonada mentioned this issue Nov 2, 2021
Merged
Totktonada added a commit to tarantool/http that referenced this issue Nov 2, 2021
@Totktonada
rockspec: use git+https:// for git repository URL
b91c51a 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
@Totktonada Totktonada mentioned this issue Nov 2, 2021
Merged
Totktonada added a commit to tarantool/http that referenced this issue Nov 2, 2021
@Totktonada
rockspec: use git+https:// for git repository URL
3e1726b 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
@Totktonada Totktonada mentioned this issue Nov 2, 2021
Merged
Totktonada added a commit to tarantool/argon2 that referenced this issue Nov 2, 2021
@Totktonada
rockspec: use git+https:// for git repository URL
ddbf33b 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
@Totktonada Totktonada mentioned this issue Nov 2, 2021
Merged
Totktonada added a commit to tarantool/avro-schema that referenced this issue Nov 2, 2021
@Totktonada
rockspec: use git+https:// for git repository URL
a617b18 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
@Totktonada Totktonada mentioned this issue Nov 2, 2021
Merged
Totktonada added a commit to tarantool/cbench that referenced this issue Nov 2, 2021
@Totktonada
rockspec: use git+https:// for git repository URL
ee63ef9 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
@Totktonada Totktonada mentioned this issue Nov 2, 2021
Merged
Totktonada added a commit to tarantool/checks that referenced this issue Nov 2, 2021
@Totktonada
rockspec: use git+https:// for git repository URL
45b74f8 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
@Totktonada Totktonada mentioned this issue Nov 2, 2021
Merged
Totktonada added a commit to tarantool/config that referenced this issue Nov 2, 2021
@Totktonada
rockspec: use git+https:// for git repository URL
05c9c71 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
@Totktonada Totktonada mentioned this issue Nov 2, 2021
Merged
Totktonada added a commit to tarantool/connpool that referenced this issue Nov 2, 2021
@Totktonada
rockspec: use git+https:// for git repository URL
47d2469 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
@Totktonada Totktonada mentioned this issue Nov 2, 2021
Merged
Totktonada added a commit to tarantool/document that referenced this issue Nov 2, 2021
@Totktonada
rockspec: use git+https:// for git repository URL
8137f91 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
@Totktonada Totktonada mentioned this issue Nov 2, 2021
Merged
Totktonada added a commit to tarantool/dump that referenced this issue Nov 2, 2021
@Totktonada
rockspec: use git+https:// for git repository URL
29a349d 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
@Totktonada Totktonada mentioned this issue Nov 2, 2021
Merged
Totktonada added a commit to tarantool/expirationd that referenced this issue Nov 2, 2021
@Totktonada
rockspec: use git+https:// for git repository URL
9ca9ba7 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
@Totktonada Totktonada mentioned this issue Nov 2, 2021
Merged
Totktonada added a commit to tarantool/pg that referenced this issue Nov 9, 2021
@Totktonada
rockspec: use git+https:// for git repository URL
4043e43 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
Totktonada added a commit to tarantool/ldecnumber that referenced this issue Nov 9, 2021
@Totktonada
rockspec: use git+https:// for git repository URL
b9400ad 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
Totktonada added a commit to tarantool/kafka that referenced this issue Nov 9, 2021
@Totktonada
rockspec: use git+https:// for git repository URL
12ce56f 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
Totktonada added a commit to tarantool/tradeparser that referenced this issue Nov 9, 2021
@Totktonada
rockspec: use git+https:// for git repository URL
3a0b046 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
Totktonada added a commit to tarantool/tuple-keydef that referenced this issue Nov 9, 2021
@Totktonada
rockspec: use git+https:// for git repository URL
946466d 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
Totktonada added a commit to tarantool/tuple-merger that referenced this issue Nov 9, 2021
@Totktonada
rockspec: use git+https:// for git repository URL
f5ce4b9 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
Totktonada added a commit to tarantool/websocket that referenced this issue Nov 9, 2021
@Totktonada
rockspec: use git+https:// for git repository URL
4e2a399 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
Totktonada added a commit to tarantool/zookeeper that referenced this issue Nov 9, 2021
@Totktonada
rockspec: use git+https:// for git repository URL
3c3e213 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
@tst2005
Copy link

tst2005 commented Nov 9, 2021

Hello,
An alternative solution to patch each repository is to change the tool that using them.
Luarocks did it with luarocks/luarocks@9ff512e .
Maybe tarantool can also consider this way.

Regards,

@Totktonada Totktonada mentioned this issue Nov 9, 2021
Closed
@Totktonada
Copy link
Member Author

@tst2005 Wow, I didn't aware of that. Filed #6597.

ligurio pushed a commit to tarantool/http that referenced this issue Nov 9, 2021
@Totktonada @ligurio
rockspec: use git+https:// for git repository URL
e7524e6 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
ligurio pushed a commit to tarantool/http that referenced this issue Nov 9, 2021
@Totktonada @ligurio
rockspec: use git+https:// for git repository URL
44d4685 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
ligurio pushed a commit to tarantool/checks that referenced this issue Nov 17, 2021
@Totktonada @ligurio
rockspec: use git+https:// for git repository URL (#29)
6d107bf 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
ligurio pushed a commit to tarantool/checks that referenced this issue Nov 17, 2021
@Totktonada @ligurio
rockspec: use git+https:// for git repository URL (#29)
a9ecc32 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
ligurio pushed a commit to tarantool/checks that referenced this issue Nov 17, 2021
@Totktonada @ligurio
rockspec: use git+https:// for git repository URL (#29)
e61b32b 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
ligurio pushed a commit to tarantool/checks that referenced this issue Dec 29, 2021
@Totktonada @ligurio
rockspec: use git+https:// for git repository URL (#29)
2e417d3 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
ligurio pushed a commit to tarantool/checks that referenced this issue Dec 29, 2021
@Totktonada @ligurio
rockspec: use git+https:// for git repository URL (#29)
9e3d38b 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
ligurio pushed a commit to tarantool/pg that referenced this issue Mar 25, 2022
@Totktonada @ligurio
rockspec: use git+https:// for git repository URL
43dddc8 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
ligurio pushed a commit to tarantool/pg that referenced this issue Mar 25, 2022
@Totktonada @ligurio
rockspec: use git+https:// for git repository URL
8d1f8f4 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
ligurio pushed a commit to tarantool/pg that referenced this issue Mar 25, 2022
@Totktonada @ligurio
rockspec: use git+https:// for git repository URL
56ce93c 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
ligurio pushed a commit to tarantool/pg that referenced this issue Mar 25, 2022
@Totktonada @ligurio
rockspec: use git+https:// for git repository URL
6c5b7c2 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
ligurio pushed a commit to tarantool/pg that referenced this issue Mar 25, 2022
@Totktonada @ligurio
rockspec: use git+https:// for git repository URL
1818aba 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
@Totktonada
Copy link
Member Author

It is not in the list, but I also proposed the same change to luacov-coveralls: moteus/luacov-coveralls#30.

@Totktonada Totktonada mentioned this issue Apr 12, 2022
Closed
ArtDu pushed a commit to ArtDu/expirationd that referenced this issue May 10, 2022
@Totktonada @ArtDu
rockspec: use git+https:// for git repository URL
af0f377 
GitHub is going to disable unencrypted Git protocol, so `git://` URLs
will stop working soon (see [1]).

[1]: https://github.blog/2021-09-01-improving-git-protocol-security-github/

Part of tarantool/tarantool#6587
@Totktonada
Copy link
Member Author

Remaining task:

@LeonidVas LeonidVas removed the teamE label Oct 4, 2022
@Totktonada
Copy link
Member Author

Current status:

I think there is nothing to track here. Closing then.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@Totktonada Totktonada

Labels
infrastructure luarocks
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@Totktonada @tst2005 @LeonidVas