1// SPDX-License-Identifier: AGPL-3.0-or-later
2
3// Package gitcli implements the Git ports over the git binary. Every
4// invocation runs in an isolated environment that is built here and never
5// inherits the caller's.
6package gitcli
7
8import (
9 "bytes"
10 "context"
11 "errors"
12 "fmt"
13 "os/exec"
14 "path/filepath"
15 "runtime"
16 "strings"
17 "sync"
18 "time"
19)
20
21// Config configures a Git adapter. The adapter never reads the process
22// environment: the caller passes what it needs.
23type Config struct {
24 // Bin is the git executable: a name looked up in the process PATH, or a path.
25 // It is required; the default belongs to the configuration.
26 Bin string
27 // DataDir is the data root (absolute). repos/, repos/.staging/ and
28 // trash/ below it must exist; run/git-home/ is the HOME of git.
29 DataDir string
30 // Path is the PATH given to git, which it uses to find its helpers.
31 Path string
32 // MaxReceiveBytes is the largest pack a push may send
33 // (receive.maxInputSize); zero leaves Git unlimited.
34 MaxReceiveBytes int64
35 // CatFileIdle is how long a repository's long-lived `git cat-file`
36 // process may stay unused before it is stopped. Zero means 60 seconds.
37 CatFileIdle time.Duration
38 // MaxCatFiles bounds the long-lived cat-file processes. Zero means 16.
39 MaxCatFiles int
40 // MaxExec bounds the one-shot git processes that run at once (every
41 // command but the long-lived cat-file processes and the blob streams);
42 // callers beyond it wait for a slot until their context ends. Zero means
43 // max(4, 2*GOMAXPROCS).
44 MaxExec int
45 // MaxBlobStreams bounds the open blob streams, each of which holds a git
46 // process until its reader is closed. Streams beyond it are refused with
47 // domain.ErrResourceExhausted rather than queued: a slow reader could hold
48 // a slot for long. Zero means 32.
49 MaxBlobStreams int
50}
51
52// Git is the git CLI adapter for ports.GitRepos.
53type Git struct {
54 bin string
55 dataDir string
56 env []string
57 maxRecv int64
58
59 mu sync.Mutex // guards backend
60 backend string // git-http-backend, resolved on first use
61
62 cat *catPool // long-lived cat-file processes of the read side
63
64 exec chan struct{} // slots of the one-shot processes, see Config.MaxExec
65 blobs chan struct{} // slots of the blob streams, see Config.MaxBlobStreams
66}
67
68// Defaults of the process bounds.
69const defaultMaxBlobStreams = 32
70
71func defaultMaxExec() int { return max(4, 2*runtime.GOMAXPROCS(0)) }
72
73// New builds an adapter. It does not run git: call CheckVersion.
74func New(cfg Config) *Git {
75 env := buildEnv(cfg.DataDir, cfg.Path)
76 maxExec, maxBlobs := cfg.MaxExec, cfg.MaxBlobStreams
77 if maxExec <= 0 {
78 maxExec = defaultMaxExec()
79 }
80 if maxBlobs <= 0 {
81 maxBlobs = defaultMaxBlobStreams
82 }
83 return &Git{
84 bin: cfg.Bin, dataDir: cfg.DataDir, env: env, maxRecv: cfg.MaxReceiveBytes,
85 cat: newCatPool(cfg.Bin, env, cfg.CatFileIdle, cfg.MaxCatFiles),
86 exec: make(chan struct{}, maxExec),
87 blobs: make(chan struct{}, maxBlobs),
88 }
89}
90
91// Close stops the long-lived git processes of the read side and waits for
92// them, until ctx ends. Reads after Close fail with ErrClosed. Close is
93// idempotent; the adapter's write side keeps working.
94func (g *Git) Close(ctx context.Context) error { return g.cat.close(ctx) }
95
96// buildEnv returns the complete environment of every git invocation. Nothing
97// else is passed: no GIT_* variable, no user HOME, no locale.
98func buildEnv(dataDir, path string) []string {
99 return []string{
100 "GIT_CONFIG_NOSYSTEM=1",
101 "HOME=" + filepath.Join(dataDir, "run", "git-home"),
102 "GIT_TERMINAL_PROMPT=0",
103 "LC_ALL=C",
104 "PATH=" + path,
105 }
106}
107
108// commandTimeout bounds one git invocation when ctx has no deadline.
109const commandTimeout = 2 * time.Minute
110
111// acquireExec takes a slot of the one-shot processes, waiting until ctx ends.
112// The wait counts against the deadline of ctx, so a saturated server answers a
113// request with its deadline rather than hanging it.
114func (g *Git) acquireExec(ctx context.Context) (release func(), err error) {
115 select {
116 case g.exec <- struct{}{}:
117 return func() { <-g.exec }, nil
118 case <-ctx.Done():
119 return nil, ctx.Err()
120 }
121}
122
123// run executes git with args in the isolated environment and returns stdout.
124func (g *Git) run(ctx context.Context, args ...string) (string, error) {
125 if _, ok := ctx.Deadline(); !ok {
126 var cancel context.CancelFunc
127 ctx, cancel = context.WithTimeout(ctx, commandTimeout)
128 defer cancel()
129 }
130 release, err := g.acquireExec(ctx)
131 if err != nil {
132 return "", fmt.Errorf("git %s: %w", subcommand(args), err)
133 }
134 defer release()
135 cmd := exec.CommandContext(ctx, g.bin, args...)
136 cmd.Env = g.env
137 cmd.Dir = g.dataDir
138 cmd.WaitDelay = 5 * time.Second
139 var stdout, stderr bytes.Buffer
140 cmd.Stdout = &stdout
141 cmd.Stderr = &stderr
142 if err := cmd.Run(); err != nil {
143 msg := strings.TrimSpace(stderr.String())
144 if len(msg) > 512 {
145 msg = msg[:512] + "…"
146 }
147 var exit *exec.ExitError
148 if errors.As(err, &exit) && msg != "" {
149 return "", fmt.Errorf("git %s: %w: %s", subcommand(args), err, msg)
150 }
151 return "", fmt.Errorf("git %s: %w", subcommand(args), err)
152 }
153 return stdout.String(), nil
154}