|
| 1 | +package gitcli |
| 2 | + |
| 3 | +import ( |
| 4 | + "bufio" |
| 5 | + "bytes" |
| 6 | + "context" |
| 7 | + "io" |
| 8 | + |
| 9 | + "github.com/sourcegraph/sourcegraph/cmd/gitserver/internal/git" |
| 10 | + "github.com/sourcegraph/sourcegraph/cmd/gitserver/internal/urlredactor" |
| 11 | + "github.com/sourcegraph/sourcegraph/internal/api" |
| 12 | + "github.com/sourcegraph/sourcegraph/lib/errors" |
| 13 | +) |
| 14 | + |
| 15 | +func (g *gitCLIBackend) Fetch(ctx context.Context, opt git.FetchOptions) (git.RefUpdateIterator, io.Reader, error) { |
| 16 | + redactor := urlredactor.New(opt.RemoteURL) |
| 17 | + |
| 18 | + args, env := buildFetchArgs(opt) |
| 19 | + // see issue #7322: skip LFS content in repositories with Git LFS configured. |
| 20 | + env = append(env, "GIT_LFS_SKIP_SMUDGE=1") |
| 21 | + |
| 22 | + stderrR, stderrW := io.Pipe() |
| 23 | + r, err := g.NewCommand(ctx, |
| 24 | + WithArguments(args...), |
| 25 | + WithEnv(env...), |
| 26 | + WithOutputRedactor(redactor.Redact), |
| 27 | + WithStderr(stderrW), |
| 28 | + ) |
| 29 | + if err != nil { |
| 30 | + return nil, nil, err |
| 31 | + } |
| 32 | + |
| 33 | + return &refUpdateIterator{ |
| 34 | + stdout: r, |
| 35 | + onCancel: func() error { |
| 36 | + return errors.Append(stderrR.Close(), stderrW.Close()) |
| 37 | + }, |
| 38 | + sc: bufio.NewScanner(r), |
| 39 | + }, stderrR, nil |
| 40 | +} |
| 41 | + |
| 42 | +type refUpdateIterator struct { |
| 43 | + stdout io.ReadCloser |
| 44 | + sc *bufio.Scanner |
| 45 | + onCancel func() error |
| 46 | +} |
| 47 | + |
| 48 | +func (i *refUpdateIterator) Next() (git.RefUpdate, error) { |
| 49 | + for i.sc.Scan() { |
| 50 | + if len(i.sc.Bytes()) == 0 { |
| 51 | + continue |
| 52 | + } |
| 53 | + return parseRefUpdateLine(i.sc.Bytes()) |
| 54 | + } |
| 55 | + |
| 56 | + if err := i.sc.Err(); err != nil { |
| 57 | + return git.RefUpdate{}, err |
| 58 | + } |
| 59 | + |
| 60 | + return git.RefUpdate{}, io.EOF |
| 61 | +} |
| 62 | + |
| 63 | +func (i *refUpdateIterator) Close() error { |
| 64 | + cancelErr := i.onCancel() |
| 65 | + err := i.stdout.Close() |
| 66 | + if cancelErr != nil { |
| 67 | + err = errors.Append(err, cancelErr) |
| 68 | + } |
| 69 | + return err |
| 70 | +} |
| 71 | + |
| 72 | +func buildFetchArgs(opt git.FetchOptions) (args, env []string) { |
| 73 | + env = []string{ |
| 74 | + // disable password prompt |
| 75 | + "GIT_ASKPASS=true", |
| 76 | + // Suppress asking to add SSH host key to known_hosts (which will hang because |
| 77 | + // the command is non-interactive). |
| 78 | + // |
| 79 | + // And set a timeout to avoid indefinite hangs if the server is unreachable. |
| 80 | + "GIT_SSH_COMMAND=ssh -o BatchMode=yes -o ConnectTimeout=30", |
| 81 | + // Identify HTTP requests with a user agent. Please keep the git/ prefix because GitHub breaks the protocol v2 |
| 82 | + // negotiation of clone URLs without a `.git` suffix (which we use) without it. Don't ask. |
| 83 | + "GIT_HTTP_USER_AGENT=git/Sourcegraph-Bot", |
| 84 | + } |
| 85 | + |
| 86 | + if opt.TLSConfig.SSLNoVerify { |
| 87 | + env = append(env, "GIT_SSL_NO_VERIFY=true") |
| 88 | + } |
| 89 | + if opt.TLSConfig.SSLCAInfo != "" { |
| 90 | + env = append(env, "GIT_SSL_CAINFO="+opt.TLSConfig.SSLCAInfo) |
| 91 | + } |
| 92 | + |
| 93 | + // If we have creds in the URL, pass them in via the credHelper instead of |
| 94 | + // as part of the URL, because args are visible in `ps` output, leaking the |
| 95 | + // credentials easily. |
| 96 | + remoteURLArg := opt.RemoteURL.String() |
| 97 | + credentialHelper := []string{} |
| 98 | + password, ok := opt.RemoteURL.User.Password() |
| 99 | + if ok && !opt.RemoteURL.IsSSH() { |
| 100 | + // Remove the user section from the remoteURL so that git consults credential |
| 101 | + // helpers for the username/password. |
| 102 | + ru := *opt.RemoteURL |
| 103 | + ru.User = nil |
| 104 | + remoteURLArg = ru.String() |
| 105 | + |
| 106 | + // Next up, add out credential helper. |
| 107 | + // Note: We add an ADDITIONAL credential helper here, the previous |
| 108 | + // one is just unsetting any existing ones. |
| 109 | + credentialHelper = []string{"-c", "credential.helper=!f() { echo \"username=$GIT_SG_USERNAME\npassword=$GIT_SG_PASSWORD\"; }; f"} |
| 110 | + env = append(env, |
| 111 | + "GIT_SG_USERNAME="+opt.RemoteURL.User.Username(), |
| 112 | + "GIT_SG_PASSWORD="+password, |
| 113 | + ) |
| 114 | + } |
| 115 | + |
| 116 | + args = []string{ |
| 117 | + // Unset credential helper because the command is non-interactive. |
| 118 | + // Even when we pass a second credential helper for HTTP credentials, |
| 119 | + // we will need this. Otherwise, the original credential helper will be used |
| 120 | + // as well. |
| 121 | + "-c", "credential.helper=", |
| 122 | + } |
| 123 | + args = append(args, credentialHelper...) |
| 124 | + args = append(args, |
| 125 | + "-c", "protocol.version=2", |
| 126 | + "fetch", |
| 127 | + "--progress", |
| 128 | + "--prune", |
| 129 | + "--porcelain", |
| 130 | + remoteURLArg, |
| 131 | + ) |
| 132 | + |
| 133 | + return args, env |
| 134 | +} |
| 135 | + |
| 136 | +func parseRefUpdateLine(line []byte) (u git.RefUpdate, _ error) { |
| 137 | + line = bytes.TrimSpace(line) |
| 138 | + // format: |
| 139 | + // <flag> <old-object-id> <new-object-id> <local-reference> |
| 140 | + if len(line) == 0 { |
| 141 | + return git.RefUpdate{}, errors.New("empty git ref update output") |
| 142 | + } |
| 143 | + if line[0] == ' ' { |
| 144 | + u.Type = git.RefUpdateTypeFastForwardUpdate |
| 145 | + line[0] = 'x' |
| 146 | + } |
| 147 | + parts := bytes.Fields(line) |
| 148 | + if len(parts) != 4 { |
| 149 | + return git.RefUpdate{}, errors.Newf("invalid ref update format, expected exactly 4 fields %q", line) |
| 150 | + } |
| 151 | + |
| 152 | + if line[0] != 'x' { |
| 153 | + switch git.RefUpdateType(line[0]) { |
| 154 | + case git.RefUpdateTypeFastForwardUpdate: |
| 155 | + u.Type = git.RefUpdateTypeFastForwardUpdate |
| 156 | + case git.RefUpdateTypeForcedUpdate: |
| 157 | + u.Type = git.RefUpdateTypeForcedUpdate |
| 158 | + case git.RefUpdateTypePruned: |
| 159 | + u.Type = git.RefUpdateTypePruned |
| 160 | + case git.RefUpdateTypeTagUpdate: |
| 161 | + u.Type = git.RefUpdateTypeTagUpdate |
| 162 | + case git.RefUpdateTypeNewRef: |
| 163 | + u.Type = git.RefUpdateTypeNewRef |
| 164 | + case git.RefUpdateTypeFailed: |
| 165 | + u.Type = git.RefUpdateTypeFailed |
| 166 | + case git.RefUpdateTypeUnchanged: |
| 167 | + u.Type = git.RefUpdateTypeUnchanged |
| 168 | + default: |
| 169 | + return git.RefUpdate{}, errors.Newf("invalid ref update type %q", line[0]) |
| 170 | + } |
| 171 | + } |
| 172 | + u.OldSHA = api.CommitID(parts[1]) |
| 173 | + u.NewSHA = api.CommitID(parts[2]) |
| 174 | + u.LocalReference = string(parts[3]) |
| 175 | + |
| 176 | + return u, nil |
| 177 | +} |
0 commit comments