Cloning from sourcehut (and non-git)

M4SS-Code / cargo-goggles

Verify that registry crates in your Cargo.lock are reproducible from the git repository

https://crates.io/crates/cargo-goggles

Apache License 2.0

36 stars 2 forks source link

Cloning from sourcehut (and non-git) #9

Open VorpalBlade opened 3 months ago

VorpalBlade commented 3 months ago

Cloning https://sr.ht/~icefox/oorandom/
Couldn't clone https://sr.ht/~icefox/oorandom/ repo status=exit status: 128

Well:

$ git clone 'https://sr.ht/~icefox/oorandom/'
Cloning into 'oorandom'...
fatal: remote error: 

You have tried to clone a project from sourcehut, but you probably meant to
clone a specific git repository for this project instead. A single project on
sourcehut often has more than one git repository.

To browse all of the available repositories for this project, visit this URL:

  https://sr.ht/~icefox/oorandom/sources

Digging further into this apparently the correct download link is https://hg.sr.ht/~icefox/oorandom (using hg!). This seems like such a rare edge case that I don't know if you want to bother with it.

Suspect repo link to begin with
Not git, and how are you supposed to even know that?

Thought I open a case for awareness still. Feel free to close if it is out of scope.

paolobarbolini commented 3 months ago

Well I'll start from the fact I don't even know how that stuff works. Does it have tags or some way of finding the code from a release? 😅

VorpalBlade commented 3 months ago

So, hg (that is the command line program name, the full name is Mercurial) is another version control system, just like git, Subversion and many others. For the most part git won. Mercurial is distributed (just like git, unlike subversion).

We used to use mercurial at work (about a decade ago) before switching to git. I'm trying to remember how to use it. I believe it does have tags and branches (though branches are more than just the automatically moving tags they are in git). Unfortunately it seems this particular project did not use tags, so it wouldn't have helped anyway.

link2xt commented 3 months ago

This should be reported to oorandom maintainers so they fix the repository URL to https://hg.sr.ht/~icefox/oorandom https://sr.ht/~icefox/oorandom/ should go into homepage, not repository. I submitted similar fix to https://github.com/RustCrypto/formats/pull/1373, but cargo-goggles (this project) has a workaround for the RustCrypto case.

link2xt commented 3 months ago

As for hg support, this bug should be upstreamed to cargo because it does not support hg in .cargo_vcs_info.json and we don't know the commit which should be checked out for the crate.

paolobarbolini commented 3 months ago

I submitted similar fix to RustCrypto/formats#1373, but cargo-goggles (this project) has a workaround for the RustCrypto case.

I like this idea. We could as part of #11 make a list of crates that need their repo links adjusted. I think the workaround will have to stay in place for a while. Fortunately there doesn't seem to be a way of exploiting it as a vulnerability.