Re: bundles discovery and clones

> On Mon, Jun 10, 2024 at 02:25:19PM -0400, matthew sporleder wrote:
> 
> > I have recently been playing with git clone --bundle-uri and loving it
> > because I can clone with almost-*zero* resources being used on the
> > server!
> > 
> > I am a little confused by https://git-scm.com/docs/bundle-uri
> > mentioning "discovery" and things. Is this something being added to
> > the git cli, a special feature for other clients, or is it still too
> > early-days to talk about much?
> > 
> > I would love to produce bundles of common use cases and have them
> > auto-discovered by git clone *without* the --bundle-uri parameter, and
> > then let our CDN do the heavy lifting of satisfying things like:
> > git clone
> > git clone --depth=0
> > git clone --single-branch --branch main
> > 
> > I'm not sure I hold out as much hope for pre-bundling pulls/updates
> > but any movement towards offloading our big-ish repos to CDNs is a win
> > for us.
> 
> I don't think the server side is well documented, but peeking at the
> code, I think you want this on the server:
> 
>   git config uploadpack.advertiseBundleURIs true
>   git config bundle.version 1
>   git config bundle.mode any
>   git config bundle.foo.uri https://example.com/your.bundle
> 
> And then the clients need to tell Git that they allow bundle transfers:
> 
>   git config --global transfer.bundleURI true
> 
> I'm not sure if we'd eventually flip the client-side switch to "true" by
> default (which is what you'd need for this to happen without any user
> participation at all).
> 
> One gotcha there is that clients are now accessing an arbitrary URL
> provided by the server, so there are cross-site security implications.

> It might make more sense to allow only relative URLs without ".." (so if
> I fetched from https://example.com/foo.git, the server could use only
> the relative "bundles/bar.bundle", which would then be found at
> https://example.com/foo.git/bundles/bar.bundle").
> 
> -Peff
>