ProxyCommand impl question

[janderssonse]

Hello!
One quite common scenario is that orgs are blocking port 22 but allowing 443. It is so common that some providers, like github has set upp endpoints for connecting via ssh over 443, ie ssh.github.com. Another common scenario is that all traffic is proxied over https. Now to set this up without go-git and a cli git binary would take somehting like (this is quite common usage):

Host github.com
ProxyCommand nc -X connect -x :8080 %h %p
Hostname ssh.github.com
Port 443
User git

But currently go-git seem to have no support for the ProxyCommand -so, my question is - have anyone implemented ProxyCommand with go-git succesfully, and have some code to share in an open repo for inspiration?

[pjbgf]

@janderssonse I am fairly confident that some projects are using go-git with proxies. You also should be able to just change the port on your remote when using go-git.

Are you experiencing a specific problem?

[janderssonse]

Thanks for reply. Yes, I'm using it with proxies for https-calls - that works super today and is not an issue. But what i meant is to when using the underlying ssh client push it through to an ssh-endpoint over https - like ssh.github.com:443, as in the ssh-config example given above, "ProxyCommand".. This can be supported in a few different ways. For a clearer example of the case I'm solving here I'll attach some Go-code. However, this case cant be tested if you dont have proxyserver available to verify that your run is correct. NOTE: this is quite a common scenario and that is why github,gitlab etc have setup enspoints like ssh.github.com:443 and alike. A really simple solution for go-git to allow this scenario, i guess, would be to respect the GIT_SSH_COMMAND variable and accept the command given there, replacing the underlying default ssh-call. Anyways, attaching a go-file example solving this case with a pure git binary call. The ssh-command is using corkscrew, but might as well have used netcat (nc).

[janderssonse]

package main

import (
"bytes"
"context"
"fmt"
"os"
"os/exec"
"strings"
"time"

"github.com/go-git/go-git/v5"

)

func findGitExecutable() (string, error) {
paths := []string{"git", "/usr/bin/git", "/usr/local/bin/git", "/opt/homebrew/bin/git"}
for _, path := range paths {
if verifyGit(path) {
return path, nil
}
}
return "", fmt.Errorf("no valid git executable found")
}

func verifyGit(path string) bool {
cmd := exec.Command(path, "--version")
var out bytes.Buffer
cmd.Stdout = &out
cmd.Stderr = &out
err := cmd.Run()
if err != nil {
fmt.Printf("Error verifying git at %s: %v\nOutput: %s\n", path, err, out.String())
return false
}
return strings.HasPrefix(out.String(), "git version")
}

func GitBinaryClone(url string, directory string) (*git.Repository, error) {
if err := os.MkdirAll(directory, 0755); err != nil {
return nil, fmt.Errorf("failed to create directory: %w", err)
}

gitPath, err := findGitExecutable()
if err != nil {
	return nil, fmt.Errorf("failed to find valid git executable: %w", err)
}

fmt.Printf("Using Git executable: %s\n", gitPath)

env := os.Environ()

// Set a custom SSH command - not supported by got-git so we have to use regular git
gitSSHCommand := `ssh -vvv -o ProxyCommand="corkscrew <YOURPROXYSERVER> <YOURPROXYSERVERPORT> %h %p" -o ConnectTimeout=10 -p 443`
env = append(env, fmt.Sprintf("GIT_SSH_COMMAND=%s", gitSSHCommand))

// Set Git URL rewrite configuration, as we want any regular call to git@github.com use their ssh.github.com-endpoint
env = append(env, "GIT_CONFIG_COUNT=1")
env = append(env, "GIT_CONFIG_KEY_0=url.ssh://git@ssh.github.com:443/.insteadOf")
env = append(env, "GIT_CONFIG_VALUE_0=git@github.com:")

ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
defer cancel()

cmd := exec.CommandContext(ctx, gitPath, "clone", url, directory)
cmd.Env = env
var stdout, stderr bytes.Buffer
cmd.Stdout = &stdout
cmd.Stderr = &stderr

fmt.Printf("Executing command: GIT_SSH_COMMAND='%s' GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0='%s' GIT_CONFIG_VALUE_0='%s' %s %s\n",
	gitSSHCommand, "url.ssh://git@ssh.github.com:443/.insteadOf", "git@github.com:", gitPath, strings.Join(cmd.Args[1:], " "))

err = cmd.Run()
if err != nil {
	fmt.Printf("Command output:\nStdout: %s\nStderr: %s\n", stdout.String(), stderr.String())
	return nil, fmt.Errorf("git clone failed: %w", err)
}

repo, err := git.PlainOpen(directory)
if err != nil {
	return nil, fmt.Errorf("failed to open cloned repository: %w", err)
}

return repo, nil

}

func main() {
url := "git@github.com:/.git"
directory := "/tmp/clonetargetdir"

repo, err := GitBinaryClone(url, directory)
if err != nil {
	fmt.Printf("Clone failed: %v\n", err)
	return
}

fmt.Printf("Repository cloned successfully to %s\n", directory)

head, err := repo.Head()
if err != nil {
	fmt.Printf("Failed to get HEAD: %v\n", err)
	return
}

fmt.Printf("Current HEAD: %s\n", head.Hash())

}

[janderssonse]

@pjbgf I would like to support this use case for a hobby project, https://github.com/itiquette/git-provider-sync but I'll go with git binary workaround for now :/. Still, hoping support for GIT_SSH_COMMAND will be supported in the future:)

[pjbgf]

Hey @janderssonse, thanks for detailing the issue. We could add that feature on the v6-exp branch, would you be willing to propose a PR for that?

[janderssonse]

Thanks for asking, I have a few things on my to-do-list to finish off, (I have two projects I really want to finish off in a respectable state atm :) but if no one else steps up before me, I would be willing to take a look in the future at it and discuss some proposals on a solution maybe. However, no promises, and this would still be many weeks in the future:)

[janderssonse]

A "few weeks later" :) I started a draft PR on it. I have not tested this for "real" yet but will the coming weeks.#2166 , expect more changes, so marked DRAFT

[janderssonse]

I pulled back my draft i think I can wire this up anyway with go-git idioms, - ill get back when i have the time to test it properly and post my findings.

[Rehheh011]

One thing that might be worth considering is whether support for ProxyCommand should be implemented directly, or if go-git could expose a more generic mechanism for customizing the underlying SSH dialer/transport. That would cover ProxyCommand, HTTP CONNECT proxies, bastion hosts, SOCKS proxies, and potentially other network topologies without needing to mirror OpenSSH configuration semantics. Has this approach been considered for v6?