Download ssh deps over http, allow passing in credentials #627
Conversation
There was a problem hiding this comment.
Thanks for the PR. However, a few changes I believe are required to fix issues that are present here:
- Git credentials aren't executables.
- Not all git servers support password-based authentication over HTTPS.
- Storing credentials in
/usr/local/bin, rather than/usr/local/crossor/usr/local/share, seems to be unusual as a result.
| echo url=$GIT_CREDENTIALS | ||
| EOF | ||
|
|
||
| chmod +x /usr/local/bin/git_env_credential |
There was a problem hiding this comment.
The credentials file is a plain-text file format, and shouldn't need to be executable. The file format is:
https://user:[email protected]
| @@ -36,3 +36,13 @@ if_ubuntu install_packages \ | |||
| g++ \ | |||
| libc6-dev \ | |||
| pkg-config | |||
|
|
|||
| # Allow for passing in git credentials via environment variable in the format described here https://git-scm.com/docs/git-credential-store#_storage_format | |||
| cat <<'EOF' >/usr/local/bin/git_env_credential | |||
There was a problem hiding this comment.
This isn't an executable, and probably shouldn't be present in /usr/local/bin. We write files in other locations, or it could be present in /usr/local/share with a filename prefix (like cross_git_env_credential), just to ensure there's never any conflict.
|
|
||
| chmod +x /usr/local/bin/git_env_credential | ||
| git config --system credential.helper "/usr/local/bin/git_env_credential" | ||
| git config --system url."https://".insteadOf ssh://git@ |
There was a problem hiding this comment.
This doesn't seem very sound, as SSH deps aren't interchangeable with HTTP deps for all git servers right now, specifically for Github, which is the most important git server available.
Support for HTTP password-based authentication was removed from Github in August 2021, now requiring SSH or token-based authentication, so it's probably a bad idea to re-write URLs with SSH to HTTP.
There was a problem hiding this comment.
A much better idea would be to allow passing SSH credentials (better yet, the agent) to the container if possible, as shown in #401.
|
This was fixed in #684. |
This is an attempt to deal with #401 by creating a thin credential wrapper (https://git-scm.com/docs/git-credential-store#_storage_format) that uses the
GIT_CREDENTIALSenvironment variable. Then it rewrites any ssh dependencies (which wouldn't have worked anyway) with their https equivalent. I've tested this as working on a project of mine with the followingCross.tomlandGIT_CREDENTIALS=https://aig787:<github personal access token>@github.comI put it here because it's where git gets installed, but it should be easy to move it elsewhere if there's a better fit.