{"thread":{"id":"55333","subject":"GIT_SSH and mirror not working with git 2.30.1","startedAt":"2021-03-16T18:54:27Z","lastAt":"2021-03-16T20:34:39Z","messageCount":3,"participants":["Lamborn, Peter Craig","Andreas Schwab","Jeff King"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"419401","messageId":"e39d23615e084671965fc96174ac881e@lanl.gov","threadId":"55333","inReplyTo":null,"subject":"GIT_SSH and mirror not working with git 2.30.1","fromName":"Lamborn, Peter Craig","fromEmail":"plamborn@lanl.gov","sentAt":"2021-03-16T18:53:24Z","receivedAt":"2021-03-16T18:54:27Z","isPatch":false,"sender":{"key":"plamborn@lanl.gov","avatar":null},"body":"\nWe have some machines behind firewalls and gateways that cannot access git repos directly. We have been using GIT_SSH and mirror to push and pull git request through a less restricted machine. This has been working for a while, specifically both git 2.24.1 and git 2.28 can handle the method we have been doing. \n\n\nWhen you try the same thing with git 2.30.1, the \"git push\" commands still succeed. But \"git pull\" returns this:\n\n\n$ git pull \nhint: Pulling without specifying how to reconcile divergent branches is\nhint: discouraged. You can squelch this message by running one of the following\nhint: commands sometime before your next pull:\nhint:\nhint: git config pull.rebase false # merge (the default strategy)\nhint: git config pull.rebase true # rebase\nhint: git config pull.ff only # fast-forward only\nhint:\nhint: You can replace \"git config\" with \"git config --global\" to set a default\nhint: preference for all repositories. You can also pass --rebase, --no-rebase,\nhint: or --ff-only on the command line to override the configured default per\nhint: invocation.\n\n\nssh: connect to host port 22: Operation timed out\nfatal: Could not read from remote repository.\n\nPlease make sure you have the correct access rights\nand the repository exists.\n$\n\nDoes git 2.30.1 change something about mirrors and/or GIT_SSH that would cause git pulls to fail? Do we need to adjust our current process?\n\nOur method:\n\ndestination_machine$ mkdir \ndestination_machine$ cd \ndestination_machine$ git --bare init\n\n...\n\nworkstation$ cat ssh-hop.sh\n#!/bin/bash\n \nMACHINE_REGEXP=\"<...>\"\n \nif [[ $1 =~ $MACHINE_REGEXP ]]; then\n \n exec ssh ssh \"$@\"\n \nelse\n exec ssh \"$@\"\nfi\n\nworkstation$ chmod u+x ssh-hop.sh\nworkstation$ export GIT_SSH=/ssh-hop.sh\nworkstation$ cd \nworkstation$ git remote add --mirror :\nworkstation$ git push \nworkstation$ git pull \n\n\n\nThank you,\n\nPeter"},{"id":"419406","messageId":"87r1keyiu1.fsf@igel.home","threadId":"55333","inReplyTo":"e39d23615e084671965fc96174ac881e@lanl.gov","subject":"Re: GIT_SSH and mirror not working with git 2.30.1","fromName":"Andreas Schwab","fromEmail":"schwab@linux-m68k.org","sentAt":"2021-03-16T19:55:18Z","receivedAt":"2021-03-16T19:56:14Z","isPatch":false,"sender":{"key":"schwab@linux-m68k.org","avatar":"https://avatars.githubusercontent.com/u/2175493?v=4"},"body":"On Mär 16 2021, Lamborn, Peter Craig wrote:\n\n> workstation$ cat ssh-hop.sh\n> #!/bin/bash\n> \n> MACHINE_REGEXP=\"<...>\"\n> \n> if [[ $1 =~ $MACHINE_REGEXP ]]; then\n> \n> exec ssh ssh \"$@\"\n> \n> else\n> exec ssh \"$@\"\n> fi\n\nFWIW, it might be easier to use the ProxyJump configuration setting of\nssh instead.\n\nAndreas.\n\n-- \nAndreas Schwab, schwab@linux-m68k.org\nGPG Key fingerprint = 7578 EB47 D4E5 4D69 2510 2552 DF73 E780 A9DA AEC1\n\"And now for something completely different.\"\n"},{"id":"419407","messageId":"YFEWLNZ09ycJQ5uM@coredump.intra.peff.net","threadId":"55333","inReplyTo":"e39d23615e084671965fc96174ac881e@lanl.gov","subject":"Re: GIT_SSH and mirror not working with git 2.30.1","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2021-03-16T20:33:48Z","receivedAt":"2021-03-16T20:34:39Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Tue, Mar 16, 2021 at 06:53:24PM +0000, Lamborn, Peter Craig wrote:\n\n> We have some machines behind firewalls and gateways that cannot access\n> git repos directly. We have been using GIT_SSH and mirror to push and\n> pull git request through a less restricted machine. This has been\n> working for a while, specifically both git 2.24.1 and git 2.28 can\n> handle the method we have been doing.\n> [...]\n> workstation$ cat ssh-hop.sh\n> #!/bin/bash\n> \n> MACHINE_REGEXP=\"<...>\"\n> \n> if [[ $1 =~ $MACHINE_REGEXP ]]; then\n> \n> exec ssh ssh \"$@\"\n> \n> else\n> exec ssh \"$@\"\n> fi\n\nI suspect the problem is that your script blindly matches \"$1\". Doing\nso makes the assumption that Git will never pass any other options to\nssh. Traditionally Git _usually_ wouldn't do so (unless it needed\nspecific options like \"-p\", \"-4/-6\", etc).\n\nBut in Git's newer \"v2\" protocol, we have to pass an environment\nvariable across the wire, which requires using \"-o\". E.g.:\n\n [using v2.28]\n $ GIT_TRACE2_BRIEF=1 GIT_TRACE2=1 git ls-remote git@github.com:nosuch/repo 2>&1 | grep child_start\n child_start[0] ssh git@github.com 'git-upload-pack '\\''nosuch/repo'\\'''\n\n [using v2.29]\n $ GIT_TRACE2_BRIEF=1 GIT_TRACE2=1 git ls-remote git@github.com:nosuch/repo 2>&1 | grep child_start\n child_start[0] ssh -o SendEnv=GIT_PROTOCOL git@github.com 'git-upload-pack '\\''nosuch/repo'\\'''\n\n> When you try the same thing with git 2.30.1, the \"git push\" commands\n> still succeed. But \"git pull\" returns this:\n\nUsing the new protocol became the default in v2.29. It also is only used\nfor fetching, not pushing. So that explains why it's a problem in\nv2.30.1, and also why \"git push\" isn't affected.\n\n> ssh: connect to host port 22: Operation timed out\n> fatal: Could not read from remote repository.\n\nThis part is presumably just what happens when the \"hop\" behavior of\nyour script doesn't kick in. A straight \"ssh\" is run under the hood, but\nyour firewall probably times it out.\n\n> Does git 2.30.1 change something about mirrors and/or GIT_SSH that\n> would cause git pulls to fail? Do we need to adjust our current\n> process?\n\nAdjusting your script to look for the hostname in the second-to-last\nargument would probably be more robust. But as Andreas noted, using\nssh's ProxyJump feature would be better still.\n\n-Peff\n"}]}