From: Mathieu Othacehe <m.othacehe@gmail.com>
To: "Ludovic Courtès" <ludo@gnu.org>
Cc: 38320@debbugs.gnu.org, "Erik Edrosa" <erik.edrosa@gmail.com>,
"Clément Lassieur" <clement@lassieur.org>
Subject: bug#38320: Cuirass: Allow to use authenticated Git repositories as inputs
Date: Tue, 04 Feb 2020 10:16:47 +0100 [thread overview]
Message-ID: <87tv4667b4.fsf@gmail.com> (raw)
In-Reply-To: <8736dp8z2p.fsf@gnu.org>
[-- Attachment #1: Type: text/plain, Size: 628 bytes --]
Hello,
Here's a small patch to (guix git) so that cloning/fetching from ssh
authenticated repositories is supported using ssh agent.
I tested:
* guix pull --url=git@gitlab.com:mothacehe/private.git
* guix pull with the following channel configuration
--8<---------------cut here---------------start------------->8---
(cons* (channel
(name 'gitlab)
(url "git@gitlab.com:mothacehe/test-channel.git"))
%default-channels)
--8<---------------cut here---------------end--------------->8---
This works fine, but we still need to see how it works for Cuirass
inputs and (guix git-download) module.
Mathieu
[-- Attachment #2: 0001-git-Add-ssh-authentication-support.patch --]
[-- Type: text/x-diff, Size: 2503 bytes --]
From ae380c15f1c37e2c94e0954975f5f712e76340ac Mon Sep 17 00:00:00 2001
From: Mathieu Othacehe <m.othacehe@gmail.com>
Date: Mon, 3 Feb 2020 18:05:02 +0100
Subject: [PATCH] git: Add ssh authentication support.
SSH agent authentication method is used.
* guix/git.scm (auth-method): New variable,
(clone*): pass previous variable in clone options,
(update-cached-checkout): pass previous variable in fetch options.
---
guix/git.scm | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/guix/git.scm b/guix/git.scm
index a12f1eec8e..aee7b325e0 100644
--- a/guix/git.scm
+++ b/guix/git.scm
@@ -1,5 +1,5 @@
;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2017 Mathieu Othacehe <m.othacehe@gmail.com>
+;;; Copyright © 2017, 2020 Mathieu Othacehe <m.othacehe@gmail.com>
;;; Copyright © 2018, 2019, 2020 Ludovic Courtès <ludo@gnu.org>
;;;
;;; This file is part of GNU Guix.
@@ -108,6 +108,9 @@ the 'SSL_CERT_FILE' and 'SSL_CERT_DIR' environment variables."
(string-append "R:" url)
url))))))
+;; Default authentication method.
+(define auth-method (%make-auth-ssh-agent))
+
(define (clone* url directory)
"Clone git repository at URL into DIRECTORY. Upon failure,
make sure no empty directory is left behind."
@@ -119,7 +122,9 @@ make sure no empty directory is left behind."
;; value in Guile-Git: <https://bugs.gnu.org/29238>.
(if (module-defined? (resolve-interface '(git))
'clone-init-options)
- (clone url directory (clone-init-options))
+ (clone url directory
+ (make-clone-options
+ #:fetch-options (make-fetch-options auth-method)))
(clone url directory)))
(lambda _
(false-if-exception (rmdir directory)))))
@@ -281,7 +286,8 @@ When RECURSIVE? is true, check out submodules as well, if any."
;; Only fetch remote if it has not been cloned just before.
(when (and cache-exists?
(not (reference-available? repository ref)))
- (remote-fetch (remote-lookup repository "origin")))
+ (remote-fetch (remote-lookup repository "origin")
+ #:fetch-options (make-fetch-options auth-method)))
(when recursive?
(update-submodules repository #:log-port log-port))
(let ((oid (switch-to-ref repository canonical-ref)))
--
2.25.0
[-- Attachment #3: Type: text/plain, Size: 979 bytes --]
Ludovic Courtès writes:
> Hey ho!
>
> Clément Lassieur <clement@lassieur.org> skribis:
>
>> Whoo, nice, thank you so much Mathieu! I'll test everything this
>> week-end probably, and start working on the (guix git) / Cuirass
>> counterpart (which is 1% of the work :D).
>
> Neat!
>
>>> So "latest-repository-commit" could be call with ssh authentication
>>> parameters. However, the guix-daemon won't be able to communicate with the
>>> user ssh-agent, and storing an unencrypted private ssh key in the store
>>> doesn't feel great to me.
>>>
>>> Do you see any workaround?
>>
>> As far as I understand, LATEST-REPOSITORY-COMMIT is never called by the
>> daemon, it downloads stuff first and then calls ADD-TO-STORE. So both
>> using the SSH agent or passing a private SSH key should be
>> straightforward.
>
> Indeed. ‘guix pull --url’ and ‘guix build --with-git-url’ (and similar)
> should work just fine.
>
> Thanks!
>
> Ludo’.
next prev parent reply other threads:[~2020-02-04 9:17 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-22 9:51 bug#38320: Cuirass: Allow to use authenticated Git repositories as inputs Clément Lassieur
2019-11-25 13:42 ` Mathieu Othacehe
2019-11-25 13:46 ` Mathieu Othacehe
2019-11-28 23:46 ` Clément Lassieur
2019-11-26 10:05 ` Ludovic Courtès
2019-12-09 16:41 ` Mathieu Othacehe
2019-12-10 14:28 ` Ludovic Courtès
2019-12-11 0:28 ` Erik Edrosa
2019-12-12 13:13 ` Ludovic Courtès
2019-12-11 11:53 ` Mathieu Othacehe
2019-12-11 15:36 ` Clément Lassieur
2019-12-12 13:15 ` Ludovic Courtès
2020-02-04 9:16 ` Mathieu Othacehe [this message]
2020-02-04 12:58 ` Ludovic Courtès
2020-02-05 8:45 ` Mathieu Othacehe
2020-02-05 21:24 ` Ludovic Courtès
2020-02-06 15:16 ` Mathieu Othacehe
2020-02-06 17:17 ` Ludovic Courtès
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87tv4667b4.fsf@gmail.com \
--to=m.othacehe@gmail.com \
--cc=38320@debbugs.gnu.org \
--cc=clement@lassieur.org \
--cc=erik.edrosa@gmail.com \
--cc=ludo@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.