Re: [PATCH] http: add custom hostname to IP address resolves

From: Christian Couder <christian.couder@gmail.com>
Date: May 9, 2022, 15:40 UTC
Message-ID: <CAP8UFD2BTmeYuVsq2AJg32qEjPXXB5oGtU1i8KK=xjZrS39eZA@mail.gmail.com>
In-Reply-To: <20220505111608.o63obxrifoqz6j5w@carlos-mbp.lan>

On Thu, May 5, 2022 at 1:16 PM Carlo Marcelo Arenas Belón <carenas@gmail.com> wrote:

> On Thu, May 05, 2022 at 12:48:50PM +0200, Christian Couder wrote:

Show 9 quoted lines

> > Ok with renaming and implementing it only in transport commands. I
> > don't want, and I don't think it should be necessary, to invent a way
> > to do the same for non cURL transports though. I think it should be Ok
> > with the doc saying that the option has only been implemented for
> > HTTP(S) yet and will have no effect when other transports are used.
>
> I think it will be better if git aborts with an error if it is used for
> a transport that it doesn't support, instead of relying in the documentation,
> though.

This has drawbacks, as this is likely to be called through scripts or apps and the calling code would have to be a bit more complex as passing the option couldn't be done independently of the transport/URL used.

Anyway until others complain, I prefer to leave it as an obscure configuration called "http.curloptResolve" and meant to help server operators as Junio says. This avoids wondering about such issues.

Show 7 quoted lines

> > If there is a simple way to do the same thing for ssh, then I might
> > take a look at it later. For "file" or bundle transports, I don't
> > think it makes sense, and the "git" transport is not used much in big
> > hosting services where this feature is likely to be used.
>
> This seems definitely useful also for ssh which is also used in big
> hosting services.

I am not sure it is as useful for ssh. And maybe someone will take a look at implementing it if that's the case.

> Ironically, I think would be even more useful for the "git" transport
> specially because it doesn't have other protections to rely on that
> would help prevent spoofing (like TLS), which might be also why it is
> not that widely used anymore.

Yeah, more secure alternatives have taken over for good.