Skip to content

Download ssh deps over http, allow passing in credentials #627

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

Download ssh deps over http, allow passing in credentials #627

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions docker/common.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,3 +36,13 @@ if_ubuntu install_packages \
g++ \
libc6-dev \
pkg-config

# Allow for passing in git credentials via environment variable in the format described here https://git-scm.com/docs/git-credential-store#_storage_format
cat <<'EOF' >/usr/local/bin/git_env_credential
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This isn't an executable, and probably shouldn't be present in /usr/local/bin. We write files in other locations, or it could be present in /usr/local/share with a filename prefix (like cross_git_env_credential), just to ensure there's never any conflict.

#!/bin/bash
echo url=$GIT_CREDENTIALS
EOF

chmod +x /usr/local/bin/git_env_credential
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The credentials file is a plain-text file format, and shouldn't need to be executable. The file format is:

https://user:[email protected]

git config --system credential.helper "/usr/local/bin/git_env_credential"
git config --system url."https://".insteadOf ssh://git@
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This doesn't seem very sound, as SSH deps aren't interchangeable with HTTP deps for all git servers right now, specifically for Github, which is the most important git server available.

Support for HTTP password-based authentication was removed from Github in August 2021, now requiring SSH or token-based authentication, so it's probably a bad idea to re-write URLs with SSH to HTTP.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A much better idea would be to allow passing SSH credentials (better yet, the agent) to the container if possible, as shown in #401.