crashappsec / chalk

Chalk allows you to follow code from development, through builds and into production.
https://crashoverride.com/
GNU General Public License v3.0
322 stars 11 forks source link

support all git pack object types #348

Open miki725 opened 2 weeks ago

miki725 commented 2 weeks ago

Git has multiple pack object types:

https://git-scm.com/docs/pack-format

Currently chalk can only understand either commit or tag object types however packed repos can store refs themselves as deltas. This means that if the repos HEAD points to such an object, chalk will not be able to understand it.

For example change:

https://github.com/crashappsec/chalk/blob/2dd27380cbf87c14bf5358e9854df8c74754941b/tests/functional/test_git.py#L69-L69

to use {random_hex}-1 tag and chalk will not report any git information at all.

Although implementing full delta spec which has multiple instructions is more complicated so probably worth looking into getting libgit into chalk as a dep.