Documentation
¶
Overview ¶
Package gitlsremote implements ports.CommitResolver by running `git ls-remote` against the Go source repository to resolve a release tag to its commit — the VCS-anchor half of the standard-library chain of custody.
Runtime dependency: git must be present in PATH, version 2.32 or newer. A missing git binary or an unreachable remote surfaces as an error, which the acquirer records as an unresolved commit rather than a failure.
The subprocess runs under the shared gitenv baseline: an allowlisted environment, no config discovery, and a private working directory. This lookup carries no attacker-controlled URL — repoURL is the compile-time constant domain.VCSRepoURL and tag is always prefixed into refs/tags/ — so the baseline is applied for consistency and to keep the two git call sites from drifting apart, not to close a known exposure here.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrGitNotInstalled = errors.New("git not found in PATH")
ErrGitNotInstalled is returned when the git binary cannot be found in PATH.
var ErrNetworkForbidden = fmt.Errorf( "%w: resolving the Go release tag reaches go.googlesource.com over the network; "+ "the standard-library record is anchored without its VCS commit", goenv.ErrNetworkForbidden)
ErrNetworkForbidden is returned instead of starting git when the environment declares no network access.
The acquirer already records an unresolved commit rather than a failure when this lookup cannot answer, so an air gap costs the standard library its VCS anchor and nothing else — which is the same accounting an absent git gets, and the same one --skip-vcs-verify asks for explicitly.
Functions ¶
This section is empty.
Types ¶
type Resolver ¶
type Resolver struct {
// contains filtered or unexported fields
}
Resolver resolves tags to commits via git ls-remote.
func (*Resolver) ResolveCommit ¶
ResolveCommit returns the commit SHA that tag resolves to in repoURL. It prefers the peeled ref (refs/tags/<tag>^{}) so an annotated tag resolves to the commit it points at rather than the tag object; a lightweight tag has no peeled ref and its direct SHA is used.
Source Files