{"thread":{"id":"49087","subject":"'git submodule update' ignores [http] config","startedAt":"2018-08-09T22:50:31Z","lastAt":"2018-08-10T17:03:17Z","messageCount":3,"participants":["Jonathon Reinhart","Jonathan Nieder"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"355065","messageId":"CAPFHKzepqebXX7mrbeoc=+SHzWZ5N+6eOaLiC26tVGKogZoLGg@mail.gmail.com","threadId":"49087","inReplyTo":null,"subject":"'git submodule update' ignores [http] config","fromName":"Jonathon Reinhart","fromEmail":"jonathon.reinhart@gmail.com","sentAt":"2018-08-09T22:50:02Z","receivedAt":"2018-08-09T22:50:31Z","isPatch":false,"sender":{"key":"jonathon.reinhart@gmail.com","avatar":null},"body":"I've been trying to track down an issue with the GitLab CI Runner:\nhttps://gitlab.com/gitlab-org/gitlab-runner/issues/3497\n\nNote that I'm using \"git version 2.7.2.windows.1\".\n\nI've narrowed it down to an observation that the [http] config seems\nto be ignored by 'git submodule update'. Shouldn't those options be\nrespected by submodules?\n\nGiven a .git/config file like this:\n\n------------------------------------------------------------------------\n[fetch]\n    recurseSubmodules = false\n[http \"https://gitlab.exmaple.com\"]\n    sslCAInfo =\nC:\\\\Users\\\\gitlab-runner\\\\builds\\\\deadbeef\\\\0\\\\somegroup\\\\someproj.git\\\\CA_SERVER_TLS_CA_FILE\n[core]\n    ...\n[remote \"origin\"]\n    url = https://jreinhart:<private-access-token>@gitlab.example.com/somegroup/someproj.git\n    fetch = +refs/heads/*:refs/remotes/origin/*\n[branch \"master\"]\n    remote = origin\n    merge = refs/heads/master\n[submodule \"some-lib\"]\n    url = https://jreinhart:<private-access-token>@gitlab.example.com/somegroup/some-lib.git\n------------------------------------------------------------------------\n\n...I see the following results:\n\n------------------------------------------------------------------------\nC:\\Users\\jreinhart\\testrepo>set GIT_CURL_VERBOSE=1\nC:\\Users\\jreinhart\\testrepo>git fetch\n...\n* Connected to gitlab.example.com (x.x.x.x) port 443 (#0)\n* ALPN, offering http/1.1\n* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH\n* successfully set certificate verify locations:\n*   CAfile: C:\\Users\\gitlab-runner\\builds\\deadbeef\\0\\somegroup\\someproj.git\\CA_SERVER_TLS_CA_FILE\n  CApath: none\n* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384\n* ALPN, server did not agree to a protocol\n* Server certificate:\n*  <certificate details here>\n*        SSL certificate verify ok.\n...\nC:\\Users\\jreinhart\\testrepo>git checkout master\nC:\\Users\\jreinhart\\testrepo>git submodule update --init\n...\n* Connected to gitlab.example.com (x.x.x.x) port 443 (#0)\n* ALPN, offering http/1.1\n* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH\n* successfully set certificate verify locations:\n*   CAfile: C:/Program Files/Git/mingw64/ssl/certs/ca-bundle.crt\n  CApath: none\n* SSL certificate problem: unable to get local issuer certificate\n...\n------------------------------------------------------------------------\n\nNote that the CAfile reverted to its default instead of using the same\none from the `git fetch`.\n\n\nThanks in advance,\n\nJonathon Reinhart\n"},{"id":"355075","messageId":"20180810030624.GA101965@aiede.svl.corp.google.com","threadId":"49087","inReplyTo":"CAPFHKzepqebXX7mrbeoc=+SHzWZ5N+6eOaLiC26tVGKogZoLGg@mail.gmail.com","subject":"Re: 'git submodule update' ignores [http] config","fromName":"Jonathan Nieder","fromEmail":"jrnieder@gmail.com","sentAt":"2018-08-10T03:06:24Z","receivedAt":"2018-08-10T03:06:29Z","isPatch":false,"sender":{"key":"jrnieder@gmail.com","avatar":"https://avatars.githubusercontent.com/u/281595?v=4"},"body":"+cc: Stefan, who has been looking at fetch --recurse-submodules recently\nHi,\n\nJonathon Reinhart wrote:\n\n> I've narrowed it down to an observation that the [http] config seems\n> to be ignored by 'git submodule update'. Shouldn't those options be\n> respected by submodules?\n>\n> Given a .git/config file like this:\n>\n> ------------------------------------------------------------------------\n> [fetch]\n>     recurseSubmodules = false\n> [http \"https://gitlab.exmaple.com\"]\n>     sslCAInfo = C:\\\\Users\\\\gitlab-runner\\\\builds\\\\deadbeef\\\\0\\\\somegroup\\\\someproj.git\\\\CA_SERVER_TLS_CA_FILE\n[...]\n> C:\\Users\\jreinhart\\testrepo>set GIT_CURL_VERBOSE=1\n> C:\\Users\\jreinhart\\testrepo>git fetch\n[...]\n> *   CAfile: C:\\Users\\gitlab-runner\\builds\\deadbeef\\0\\somegroup\\someproj.git\\CA_SERVER_TLS_CA_FILE\n[...]\n> C:\\Users\\jreinhart\\testrepo>git checkout master\n> C:\\Users\\jreinhart\\testrepo>git submodule update --init\n[...]\n> *   CAfile: C:/Program Files/Git/mingw64/ssl/certs/ca-bundle.crt\n[...]\n> Note that the CAfile reverted to its default instead of using the same\n> one from the `git fetch`.\n\nInteresting.\n\nThe context is that \"git submodule update\" is simply running commands\nlike \"git fetch\" inside the submodules, and the repository-local\nconfig of the superproject does not apply there.\n\nIn the long run, commands like \"git fetch --recurse-submodules\" may\nchaange to use a single process.  It's possible that some of the\nrepository-local configuration of the superproject would apply at that\npoint, though the inconsistency would be confusing, so probably not\nthese particular settings.  Anyway, that's a faraway future; today,\n\"git fetch --recurse-submodules\" is also running \"git fetch\" commands\ninside the submodules, and the repository-local config of the\nsuperproject does not apply there.\n\nWould it work for you to put this configuration in the global config\nfile (\"git config --global --edit\")?  That way, it would be used by\nall repositories.  If you want it only to apply within the testrepo\ndirectory, you can use conditional includes --- something like:\n\n  in $HOME/.git/config/testrepo-ca:\n\n  [http \"https://gitlab.example.com\"]\n  \tsslCAInfo = ...\n\n  in $HOME/.git/config/git:\n\n  [includeIf \"gitdir/i:~/testrepo/**\"]\n  \tpath = testrepo-ca\n\nThanks and hope that helps,\nJonathan\n"},{"id":"355117","messageId":"CAPFHKze39tDyVVMg=op9RKty7OgWnscww7JvXAByNU7JxJJfLQ@mail.gmail.com","threadId":"49087","inReplyTo":"20180810030624.GA101965@aiede.svl.corp.google.com","subject":"Re: 'git submodule update' ignores [http] config","fromName":"Jonathon Reinhart","fromEmail":"jonathon.reinhart@gmail.com","sentAt":"2018-08-10T17:02:47Z","receivedAt":"2018-08-10T17:03:17Z","isPatch":false,"sender":{"key":"jonathon.reinhart@gmail.com","avatar":null},"body":"Thanks Jonathan.\n\nThe confirmation that the super-project config does not apply to the\nsubmodules is what I was really looking for. We'll go from here.\n\nThis is a bit complicated, because this config is all generated\ndynamically by the GitLab CI Runner when it is setting up a build job.\n(See the linked issue in my first email for the gory details).\n\nThank you,\nJonathon\n>\n> +cc: Stefan, who has been looking at fetch --recurse-submodules recently\n> Hi,\n>\n> Jonathon Reinhart wrote:\n>\n> > I've narrowed it down to an observation that the [http] config seems\n> > to be ignored by 'git submodule update'. Shouldn't those options be\n> > respected by submodules?\n> >\n> > Given a .git/config file like this:\n> >\n> > ------------------------------------------------------------------------\n> > [fetch]\n> >     recurseSubmodules = false\n> > [http \"https://gitlab.exmaple.com\"]\n> >     sslCAInfo = C:\\\\Users\\\\gitlab-runner\\\\builds\\\\deadbeef\\\\0\\\\somegroup\\\\someproj.git\\\\CA_SERVER_TLS_CA_FILE\n> [...]\n> > C:\\Users\\jreinhart\\testrepo>set GIT_CURL_VERBOSE=1\n> > C:\\Users\\jreinhart\\testrepo>git fetch\n> [...]\n> > *   CAfile: C:\\Users\\gitlab-runner\\builds\\deadbeef\\0\\somegroup\\someproj.git\\CA_SERVER_TLS_CA_FILE\n> [...]\n> > C:\\Users\\jreinhart\\testrepo>git checkout master\n> > C:\\Users\\jreinhart\\testrepo>git submodule update --init\n> [...]\n> > *   CAfile: C:/Program Files/Git/mingw64/ssl/certs/ca-bundle.crt\n> [...]\n> > Note that the CAfile reverted to its default instead of using the same\n> > one from the `git fetch`.\n>\n> Interesting.\n>\n> The context is that \"git submodule update\" is simply running commands\n> like \"git fetch\" inside the submodules, and the repository-local\n> config of the superproject does not apply there.\n>\n> In the long run, commands like \"git fetch --recurse-submodules\" may\n> chaange to use a single process.  It's possible that some of the\n> repository-local configuration of the superproject would apply at that\n> point, though the inconsistency would be confusing, so probably not\n> these particular settings.  Anyway, that's a faraway future; today,\n> \"git fetch --recurse-submodules\" is also running \"git fetch\" commands\n> inside the submodules, and the repository-local config of the\n> superproject does not apply there.\n>\n> Would it work for you to put this configuration in the global config\n> file (\"git config --global --edit\")?  That way, it would be used by\n> all repositories.  If you want it only to apply within the testrepo\n> directory, you can use conditional includes --- something like:\n>\n>   in $HOME/.git/config/testrepo-ca:\n>\n>   [http \"https://gitlab.example.com\"]\n>         sslCAInfo = ...\n>\n>   in $HOME/.git/config/git:\n>\n>   [includeIf \"gitdir/i:~/testrepo/**\"]\n>         path = testrepo-ca\n>\n> Thanks and hope that helps,\n> Jonathan\n"}]}