Skip to content

gitserver: TLS configuration is ignored when invoking `git` from `createCommitFromPatch`

Created by: LawnGnome

This was reported in sourcegraph/customer#688.

It's possible to configure Sourcegraph to communicate with a code host that uses a self-signed certificate by setting the following options:

  1. In the external service configuration, adding a certificate option with a public key, and
  2. In the site configuration, adding a block to experimentalFeatures that looks something like this: 
    "experimentalFeatures": {
  "tls.external": {
    "certificates": [
      "-----BEGIN CERTIFICATE-----\n<CERT CONTENT>\n-----END CERTIFICATE-----"
    ]
  }
}

(There's also an option to just straight up skip verification, but let's pretend we didn't see that for now.)

These get used for different things: the site configuration certificate is used for API requests to the code host, and then the tls.external certificate is used by gitserver. (Why are these different? Good question. No idea.) The former works fine across the board. The latter works fine… for cloning and pulling. But not for pushing, which is what we need in Batch Changes.

Why?

cmd/gitserver/server provides a function called runWith that ensures that the right environment variables are provided to Git to handle the TLS configuration (among other things). Unfortunately, createCommitFromPatch provides its own wrapper that doesn't delegate down to runWith.

I think the quick and dirty fix here is just to delegate to runWith instead of directly to CombinedOutput(), since the semantics are essentially the same. Testing this now, PR coming soon.