cmd/go: support git remote helpers when running go get?

[keks]

What version of Go are you using (go version)?

go version go1.8 linux/amd64

What operating system and processor architecture are you using (go env)?

GOARCH="amd64"
GOBIN=""
GOEXE=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/home/keks/go"
GORACE=""
GOROOT="/home/keks/local/go"
GOTOOLDIR="/home/keks/local/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
CC="gcc"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build385569118=/tmp/go-build -gno-record-gcc-switches"
CXX="g++"
CGO_ENABLED="1"
PKG_CONFIG="pkg-config"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"

What did you do?

go get example.com/go/mypkg

Where example.com/go/mypkg is a vanity url that points to a git repo with an ssb:// url.

What did you expect to see?

go should use locally installed git remote helpers (i.e. look for git-remote-ssb in $PATH). It should fetch the source using that helper and (hopefully) build.

What did you see instead?

An error that transport "ssb" is not supported.

---

Note:
I initially petitioned for accepting git http clones from localhost without -insecure, so early comments reply to this idea.

[OneOfOne]

Why not just use go get -insecure example.com/go/mypkg?

[keks]

Because under the assumption that if an attacker can man-in-the-middle your connection to localhost, they are on your computer and can modify other (presumably safe) connections as well, leaving it no more insecure than HTTPS connections.

Also, it is really annoying having to type -insecure if you know that it isn't.

[bradfitz]

Sorry, this doesn't seem worth the effort.

If you're pointing at localhost, you have the code already and there's no need to go get it.

I'm going to close this, but maybe you're not telling us the whole story (http://xyproblem.info/) and we can reopen if we hear more.

[keks]

Alright.

Personally, I'm using ssb, which is a decentralized database running both a social network and something like github (might be down atm). Someone pushes to a repository in the decentralized database by publishing a signed message containing the new HEAD and the git packfile of all new git objects (or something along the lines).
Then, my local client reads this data and opens a web server that interprets all the messages and exposes the currently seen state as a http git repo. A git repo's local address looks something like http://localhost:7718/%25HGAxKZtUdirY68e79EUDpxPYUb4nSxI6cIyVVYZ3FQM%3D.sha256, so you want to hide that behind a vanity url as a package author.

As an alternative, it would be great if go get could use git remote helpers installed on the system. There exist ssb:// helpers for git, but go get doesn't use them if the ssb protocol is specified in the html headers of the document at the vanity url. Actually that would be much better, but seemed like the harder path.

[bradfitz]

I'll retitle this bug, then.

[keks]

thank you!

[keks]

I'll fix the bug text to reflect the new goal

[bradfitz]

Please don't. I'd rather you file a new bug.

…

On Fri, Jun 30, 2017 at 2:44 PM keks ***@***.***> wrote: I'll fix the bug text to reflect the new goal — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub <#20865 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAAKPe7j9Iei4h9D4Htga_HSGfilvO3gks5sJWw6gaJpZM4OKqws> .

[keks]

Oh, uhm, sorry. I thought this is the way to go since you already retitled the issue. Looks like I can't undo it.
I'll know better next time.

[rsc]

I don't think we're going to put a special case for ssb or http://localhost in, sorry. This is too niche and conflicts too much with the main logic.