Re: Is git over http (git-http-push) ready for production ?

From: Tay Ray Chuan <rctay89@gmail.com>
Date: Feb 19, 2010, 11:14 UTC
Message-ID: <be6fef0d1002190314n4300aed3uc58d812b83342db2@mail.gmail.com>
In-Reply-To: <hllp07$o78$1@ger.gmane.org>

Hi,

On Fri, Feb 19, 2010 at 6:26 PM, Fabien <fabien.ubuntu@gmail.com> wrote:

> I had to delete the davlock file and restart apache to solve the issue.

I guess this is a regression. Before remote helpers were introduced, the dumb http-push program was able to release locks on the remote side on such signals.

> So, this operation doesn't seem really atomic ?

Overall, git-push over dav isn't atomic. At most, it is atomic at the individual object level - for example, you won't get a blob with SHA-1 "abc123" but hashes to a different SHA-1 value.

> Another problem I see is the password in clear text in ~/.netrc to avoid
>  to type passwords all the time.

Might sound pathetic, but you could chmod it to make it readable only to yourself.

Show 5 quoted lines

> Is there any plan to address this problem ? There used to be the same
> case in subversion (yep, sorry for the comparison), and they finally
> addressed that by supporting GNOME Keyring and KWallet.
> For what I saw, http support is provided thru libcurl, so it may not be
> that easy.

You said it yourself. :)

If you really think .netrc isn't your cup of tea, you could tunnel through ssh.

-- 
Cheers,
Ray Chuan