Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

cmd/go: support git remote helpers when running go get? #20865

Closed
keks opened this issue Jun 30, 2017 · 10 comments
Closed

cmd/go: support git remote helpers when running go get? #20865

keks opened this issue Jun 30, 2017 · 10 comments
Labels
FrozenDueToAge NeedsDecision Feedback is required from experts, contributors, and/or the community before a change can be made.
Milestone
Go1.11

Comments

@keks
Copy link

keks commented Jun 30, 2017 •
edited

What version of Go are you using (go version)?

go version go1.8 linux/amd64

What operating system and processor architecture are you using (go env)?

GOARCH="amd64"
GOBIN=""
GOEXE=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/home/keks/go"
GORACE=""
GOROOT="/home/keks/local/go"
GOTOOLDIR="/home/keks/local/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
CC="gcc"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build385569118=/tmp/go-build -gno-record-gcc-switches"
CXX="g++"
CGO_ENABLED="1"
PKG_CONFIG="pkg-config"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"

What did you do?

go get example.com/go/mypkg

Where example.com/go/mypkg is a vanity url that points to a git repo with an ssb:// url.

What did you expect to see?

go should use locally installed git remote helpers (i.e. look for git-remote-ssb in $PATH). It should fetch the source using that helper and (hopefully) build.

What did you see instead?

An error that transport "ssb" is not supported.

Note:
I initially petitioned for accepting git http clones from localhost without -insecure, so early comments reply to this idea.
@OneOfOne
Copy link
Contributor

Why not just use go get -insecure example.com/go/mypkg?

@keks
Copy link
Author

keks commented Jun 30, 2017

Because under the assumption that if an attacker can man-in-the-middle your connection to localhost, they are on your computer and can modify other (presumably safe) connections as well, leaving it no more insecure than HTTPS connections.

Also, it is really annoying having to type -insecure if you know that it isn't.

@bradfitz
Copy link
Contributor

Sorry, this doesn't seem worth the effort.

If you're pointing at localhost, you have the code already and there's no need to go get it.

I'm going to close this, but maybe you're not telling us the whole story (http://xyproblem.info/) and we can reopen if we hear more.

@bradfitz bradfitz changed the title fetch: accept unencrypted HTTP connections when requesting localhost cmd/go: accept unencrypted HTTP connections when requesting localhost Jun 30, 2017
@keks
Copy link
Author

keks commented Jun 30, 2017

Alright.

Personally, I'm using ssb, which is a decentralized database running both a social network and something like github (might be down atm). Someone pushes to a repository in the decentralized database by publishing a signed message containing the new HEAD and the git packfile of all new git objects (or something along the lines).
Then, my local client reads this data and opens a web server that interprets all the messages and exposes the currently seen state as a http git repo. A git repo's local address looks something like http://localhost:7718/%25HGAxKZtUdirY68e79EUDpxPYUb4nSxI6cIyVVYZ3FQM%3D.sha256, so you want to hide that behind a vanity url as a package author.

As an alternative, it would be great if go get could use git remote helpers installed on the system. There exist ssb:// helpers for git, but go get doesn't use them if the ssb protocol is specified in the html headers of the document at the vanity url. Actually that would be much better, but seemed like the harder path.

@bradfitz bradfitz reopened this Jun 30, 2017
@bradfitz
Copy link
Contributor

I'll retitle this bug, then.

@bradfitz bradfitz changed the title cmd/go: accept unencrypted HTTP connections when requesting localhost cmd/go: support git remote helpers when running go get? Jun 30, 2017
@bradfitz bradfitz added the NeedsDecision Feedback is required from experts, contributors, and/or the community before a change can be made. label Jun 30, 2017
@bradfitz bradfitz added this to the Go1.10 milestone Jun 30, 2017
@keks
Copy link
Author

keks commented Jun 30, 2017

thank you!

@OneOfOne OneOfOne mentioned this issue Jun 30, 2017
Closed
@keks
Copy link
Author

keks commented Jun 30, 2017

I'll fix the bug text to reflect the new goal

@bradfitz
Copy link
Contributor

bradfitz commented Jun 30, 2017 via email

@keks
Copy link
Author

keks commented Jul 1, 2017

Oh, uhm, sorry. I thought this is the way to go since you already retitled the issue. Looks like I can't undo it.
I'll know better next time.

@rsc rsc modified the milestones: Go1.10, Go1.11 Dec 1, 2017
@rsc
Copy link
Contributor

rsc commented Apr 18, 2018

I don't think we're going to put a special case for ssb or http://localhost in, sorry. This is too niche and conflicts too much with the main logic.

@rsc rsc closed this as completed Apr 18, 2018
@golang golang locked and limited conversation to collaborators Apr 18, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
FrozenDueToAge NeedsDecision Feedback is required from experts, contributors, and/or the community before a change can be made.
Projects
None yet
Milestone
Go1.11
Development

No branches or pull requests
5 participants
@bradfitz @rsc @keks @OneOfOne @gopherbot