search

in-toto / witness

Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.
https://witness.dev
Apache License 2.0
416 stars 60 forks source link

Git LFS support for git attestor #317

Open matglas opened 1 year ago

matglas commented 1 year ago

When attesting a git repo with lfs objects it shows files as being changed. But they are just checked out files. The attestation showing a changed state and all the lfs objects looks strange. Maybe it should check if the state of the lfs objects is correct based on the data in the repo. Just thinking out load.

mikhailswift commented 1 year ago

We use go-git for our git attestor and it looks like they currently don't support LFS:

https://github.com/go-git/go-git/blob/4f614891047bae5d0f7a253f014175505b9821d7/COMPATIBILITY.md?plain=1#L93

However, we may be able to contribute to go-git for this support, or investigate other solutions to!

matglas commented 1 year ago

As its mainly to get lfs status it could be enough to right a complementary status part into go-git just to verify lfs. I noticed from the issues they have on their go-git repo that git-lfs is not that ready for including it as a go module, even though their tooling is written as a go module. They have a pretty unstable API as they say themselves.

colek42 commented 12 months ago

would the omnitrail stuff we are doing help here? cc @fkautz