Skip to content

Add git_ssl_no_verify option to disable SSL verification for HTTPS repos #420

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed

Conversation

synthead
Copy link

@synthead synthead commented Sep 17, 2019

Your checklist for this pull request

🚨Please review the guidelines for contributing to this repository.

  • Ensure all commits include DCO sign-off.
  • Ensure that your contributions pass unit testing.
  • Ensure that your contributions contain documentation if applicable.

Description

Fixes #419.

This PR adds a new git_ssl_no_verify configuration option like so:

  Git.configure do |config|
    config.git_ssl_no_verify = true
  end

This option sets ENV['GIT_SSL_NO_VERIFY'] to 'true' via Git::Lib#set_custom_git_env_variables when Git::Base.config.git_ssl_no_verify is truthy. It allows users to clone git repos over HTTPS without verifying SSL. This can sometimes ease friction in corporate environments with custom CAs, for example.

Signed-off-by: Maxwell Pray <synthead@github.com>
Signed-off-by: Maxwell Pray <synthead@github.com>
@synthead synthead changed the title Add git ssl no verify option Add git_ssl_no_verify option to disable SSL verification for HTTPS repos Sep 17, 2019
@synthead
Copy link
Author

Are there any changes you'd like me to make to this PR?

@stale
Copy link

stale bot commented Dec 10, 2019

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

@stale stale bot added the wontfix label Dec 10, 2019
@stale stale bot closed this Dec 17, 2019
@hlascelles hlascelles mentioned this pull request Jan 6, 2020
@perlun perlun reopened this Jan 14, 2020
@stale stale bot removed the wontfix label Jan 14, 2020
@perlun perlun requested a review from jcouball January 14, 2020 20:21
@perlun perlun added the pinned label Jan 14, 2020
@jcouball
Copy link
Member

Thank you for this contribution!

One thing I do not like about this is that you set the attribute with a truthy value, but it returns a string.

One might be tempted to set the value to 'false' which would return 'true' when queried later:

2.7.2 :001 > c = Git::Config.new
 => #<Git::Config:0x00007f8acf8f7350 @binary_path=nil, @git_ssh=nil, @git_ssl_no_verify=nil>
2.7.2 :002 > c.git_ssl_no_verify
 => nil
2.7.2 :003 > c.git_ssl_no_verify = 'true'
 => true
2.7.2 :004 > c.git_ssl_no_verify
 => "true"
2.7.2 :005 > c.git_ssl_no_verify = 'false'
 => "false"
2.7.2 :006 > c.git_ssl_no_verify
 => "true"
2.7.2 :007 >

Also, c.git_ssl_no_verify overrides the GIT_SSL_NO_VERIFY environment variable ONLY if c.git_ssl_no_verify is set to a non-truthy value. What is someone wants to use this option to disable the GIT_SSL_NO_VERIFY command? For this case, I think that you should only fallback to the environment variable if @git_ssl_no_verify is unset.

I think two options for this interface that would be better:

  1. Allow the user to set the value as a string and don't have an opinion about what is true/false/valid. It would simply be passed as-is to the command. If unset, use the environment variable.

  2. Have an opinion about what is valid and accept only values that git allows to represent a boolean value. Valid values are documented in the boolean section of git-config. If unset, use the environment variable.

@jcouball
Copy link
Member

jcouball commented Mar 9, 2023

Closing this PR without accepting it.

You can set the http.sslVerify global config option to accomplish this for all repositories:

Git.global_config('http.sslVerify', 'false')

For specific repos, you can clone with that option:

git.clone(<path>, config: ['http.sslVerify=false'])

Alternately, the GIT_SSL_NO_VERIFY environment variable still works.

@jcouball jcouball closed this Mar 9, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add option to disable SSL verification
3 participants