Updating the Git protocol for SHA-256

Posted Jun 22, 2020 14:03 UTC (Mon) by cesarb (subscriber, #6266)
In reply to: Updating the Git protocol for SHA-256 by jezuch
Parent article: Updating the Git protocol for SHA-256

> So, HTTP(S) is not merely a transport in git but a completely different protocol?

There are actually two different http/https transports in git, the older "dumb" transport (put the files somewhere visible to the http daemon, make it export that directory through http, done), and the newer "smart" transport (which is more similar to a CGI script). So if I'm not miscounting, we have a total of six different transports in git: the "git" transport, the "dumb" http transport, the "smart" http transport, the ssh transport, the rsync transport, and the "local" transport (pointing directly to a local filesystem).

Updating the Git protocol for SHA-256

Posted Jun 22, 2020 15:44 UTC (Mon) by NYKevin (subscriber, #129325) [Link] (7 responses)

Ugh, I have so many questions here:

- Why do we need both dumb and smart HTTP(S)? Should the client even care what the server looks like internally?
- Why isn't local just a special case of rsync?
- The inclusion of both git and ssh in the list is questionable (you can tunnel anything over ssh, right?) but it's probably too late to fix now.

IIRC Mercurial has a grand total of three: HTTP(S), SSH, and local.

Updating the Git protocol for SHA-256

Posted Jun 22, 2020 16:02 UTC (Mon) by mirabilos (subscriber, #84359) [Link]

You need dumb http because there is no git server (initially), you just have reading (and possibly writing) access to a remote repository, over http, ssh, or something. Or even local files.

The git protocol is only used when there’s an actual server process involved, which isn’t always possible.

Updating the Git protocol for SHA-256

Posted Jun 22, 2020 18:08 UTC (Mon) by nix (subscriber, #2304) [Link] (5 responses)

You can tunnel anything over ssh, but the git protocol is meant for *anonymous* fetching -- and there is no such thing as unpassworded anonymous guest ssh access :)

Dumb HTTP doesn't require a server -- it only needs an HTTP server that can serve files. It's much slower and transfers a lot more than the smart protocol, but if you need it you really need it. Like git bundles, it's useful getting stuff to/from networkologically constrained environments.

Updating the Git protocol for SHA-256

Posted Jun 23, 2020 2:10 UTC (Tue) by pabs (subscriber, #43278) [Link] (4 responses)

"there is no such thing as unpassworded anonymous guest ssh access" doesn't appear to be true:

https://askubuntu.com/questions/583141/passwordless-and-k...
https://singpolyma.net/2009/11/anonymous-sftp-on-ubuntu/

PS: branchable.com allows anonymous git:// pushes to wikis.

http://ikiwiki.info/tips/untrusted_git_push/
https://ikiwiki-hosting.branchable.com/todo/anonymous_git...

Updating the Git protocol for SHA-256

Posted Jun 23, 2020 7:20 UTC (Tue) by niner (subscriber, #26151) [Link] (2 responses)

That's not really anonymous ssh, it's just ssh with a publicly known user name and password (in this case "anonymous" and "").

Updating the Git protocol for SHA-256

Posted Jun 23, 2020 12:19 UTC (Tue) by dezgeg (subscriber, #92243) [Link]

There is the "none" authentication method that can be used. E.g. "ssh nethack@alt.org" seems to use that. I suppose then the only thing needed is configuring the SSH server to ignore the username.

Updating the Git protocol for SHA-256

Posted Jun 25, 2020 9:09 UTC (Thu) by grawity (subscriber, #80596) [Link]

Well, if the password is actually empty, at least OpenSSH will outright let you skip password-based authentication – no password prompts to be shown. I have seen actual Git and Hg servers which use this (if I remember correctly, the OpenSolaris Hg repository used to be served exactly this way).

Sure you could argue that you still need a known username, but that can be simply included in the git+ssh:// URL (like people already do with git@github.com).

(Still, even if you had to press Enter at a blank password prompt, that's how CVS pserver used to work and everyone accepted it as "anonymous access" all the same.)

Updating the Git protocol for SHA-256

Posted Jul 8, 2020 19:28 UTC (Wed) by nix (subscriber, #2304) [Link]

OK, you live and learn: git:// allows pack reception! I clearly never read that part of the git-daemon manpage :)