search

in-toto / witness

Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.
https://witness.dev
Apache License 2.0
393 stars 56 forks source link

Git LFS support for git attestor #317

Open matglas opened 7 months ago

matglas commented 7 months ago

When attesting a git repo with lfs objects it shows files as being changed. But they are just checked out files. The attestation showing a changed state and all the lfs objects looks strange. Maybe it should check if the state of the lfs objects is correct based on the data in the repo. Just thinking out load.

mikhailswift commented 7 months ago

We use go-git for our git attestor and it looks like they currently don't support LFS:

https://github.com/go-git/go-git/blob/4f614891047bae5d0f7a253f014175505b9821d7/COMPATIBILITY.md?plain=1#L93

However, we may be able to contribute to go-git for this support, or investigate other solutions to!

matglas commented 7 months ago

As its mainly to get lfs status it could be enough to right a complementary status part into go-git just to verify lfs. I noticed from the issues they have on their go-git repo that git-lfs is not that ready for including it as a go module, even though their tooling is written as a go module. They have a pretty unstable API as they say themselves.

colek42 commented 6 months ago

would the omnitrail stuff we are doing help here? cc @fkautz