Documentation
¶
Overview ¶
Package gitenv builds the process environment for a git subprocess that trusts nothing on the host and carries its credential only to the remote it is meant for.
The environment disables system and global git configuration, so only command-line flags, the configuration passed through the environment and the repository's own .git/config apply; disables terminal prompting; pins the transport protocols git may speak; and neutralises hooks, the credential helper and the HTTP proxy through configuration passed in the environment (GIT_CONFIG_COUNT with its numbered keys and values), which git reads at command scope, outranking the repository's config. A remote's credential travels as an Authorization header scoped to that remote's URL, so a url.<base>.insteadOf rewrite planted in .git/config cannot carry it to another host.
Configuration through the environment needs git 2.31, and GIT_CONFIG_GLOBAL git 2.32; older git ignores both silently, so the hook and config defences would fail open rather than closed. CheckVersion refuses such a git; callers run it once at startup and refuse to serve.
Index ¶
Constants ¶
const ( MinMajor = 2 MinMinor = 32 )
MinMajor and MinMinor name the oldest git Environ's variables all reach: GIT_CONFIG_GLOBAL arrived in 2.32, after GIT_CONFIG_COUNT in 2.31.
Variables ¶
This section is empty.
Functions ¶
func CheckVersion ¶
CheckVersion runs `git version` and fails when the binary is missing or predates MinMajor.MinMinor, so an environment git would silently ignore is caught where the caller can refuse to run instead of failing open on its first fetch.
func Environ ¶
Environ returns the environment for the subprocess: the parent environment less the git variables listed in inherited, then the variables that disable system and global config, prompting and unlisted protocols, then the configuration entries. The token, when there is one, appears only in a GIT_CONFIG_VALUE_<n> entry for http.<Remote>.extraheader.
Types ¶
type Config ¶
type Config struct {
Key, Value string
}
Config is one git configuration entry passed through the environment.
type Options ¶
type Options struct {
// Remote is the URL the subprocess contacts (a clone, fetch, push or
// ls-remote). Empty for a purely local run, which then carries no
// credential and cannot fail on a token refresh.
Remote string
// TokenSource mints the token presented to Remote as HTTP basic auth
// in an Authorization header scoped to Remote's URL. Nil, or an empty
// token, sends no credential. Not consulted when Remote is empty.
TokenSource oauth2.TokenSource
// AllowedProtocols is the GIT_ALLOW_PROTOCOL value, the colon-separated
// transports git may use. Empty pins https alone, which stops a
// url.<base>.insteadOf rewrite from redirecting a fetch to file://
// (attacker-chosen local objects), ssh, ext or another remote helper.
AllowedProtocols string
// Config is further configuration to pass through the environment, in
// order, ahead of the entries this package sets. git reads the last
// value of a single-valued key and an empty credential.helper clears the
// list, so a key this package pins keeps its value whatever Config
// says about it.
Config []Config
}
Options describe the subprocess an environment is built for.
Source Files