@matheusbsbs / matheus-bagliano / commits / 2c9a2ae285

docs/config: mention protocol implications of url.insteadOf

If a URL rewrite switches the protocol to something nonstandard (like "persistent-https" for "https"), the user may be bitten by the fact that the default protocol restrictions are different between the two. Let's drop a note in insteadOf that points the user in the right direction. It would be nice if we could make this work out of the box, but we can't without knowing the security implications of the user's rewrite. Only the documentation for a particular remote helper can advise one way or the other. Since we do include the persistent-https helper in contrib/ (and since it was the helper in the real-world case that inspired that patch), let's also drop a note there. Suggested-by: Elliott Cable <me@ell.io> Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Jeff King committed May 31, 2017 at 01:18 UTC 2c9a2ae285b0806a5f754dcf6064f7cedc7e1fa8

2 files changed +17

Documentation/config.txt

@@ -3208,6 +3208,13 @@ url.<base>.insteadOf::

3208 the best alternative for the particular user, even for a

3209 never-before-seen repository on the site. When more than one

3210 insteadOf strings match a given URL, the longest match is used.

3211 ++

3212 +Note that any protocol restrictions will be applied to the rewritten

3213 +URL. If the rewrite changes the URL to use a custom protocol or remote

3214 +helper, you may need to adjust the `protocol.*.allow` config to permit

3215 +the request. In particular, protocols you expect to use for submodules

3216 +must be set to `always` rather than the default of `user`. See the

3217 +description of `protocol.allow` above.

3218

3219 url.<base>.pushInsteadOf::

3220 Any URL that starts with this value will not be pushed to;

contrib/persistent-https/README

+10

@@ -35,6 +35,16 @@ to use persistent-https:

35 [url "persistent-http"]

36 insteadof = http

38 +You may also want to allow the use of the persistent-https helper for

39 +submodule URLs (since any https URLs pointing to submodules will be

40 +rewritten, and Git's out-of-the-box defaults forbid submodules from

41 +using unknown remote helpers):

42 +

43 +[protocol "persistent-https"]

44 + allow = always

45 +[protocol "persistent-http"]

46 + allow = always

47 +

49 #####################################################################

50 # BUILDING FROM SOURCE