Now, the remote tracker is always updated. If gitinterface.Fetch is used
with a refName, it assumes the default is to fetch to the same target in
the local repository. By default, it also updates the remote tracker.
For more granular control, FetchRefSpec must be used.
Signed-off-by: Aditya Sirish <aditya@saky.in>
This fixes a previously unnoticed bug in setting the test config where
the user's name and email were actually left blank. This is an issue
with how go-git parses the raw parts of the config vs the defined
structs. This was primarily noticed because of mismatched hashes on
GitHub actions in the tag, the expected values have changed in some
existing tests as well.
Signed-off-by: Aditya Sirish <aditya@saky.in>
1. Commit now returns the ID of the newly created commit. This will help
us avoid extraneous calls to repo.Reference to get the new state of
the affected ref.
2. Commit also creates the ref if it doesn't already exist. This allows
to skip initializing (to zero) refs we're about to commit to anyway.
Note: this commit does not actually remove those extra
initializations. That is left to a future patch or clean up pass.
Signed-off-by: Aditya Sirish <aditya@saky.in>
* Add functions to track changes introduced by commits or between commits
* Add function to check if a commit knows another using reachability
Signed-off-by: Aditya Sirish <aditya@saky.in>
This commit introduces early, experimental support for gitsign
signatures on git commits. It uses TAP-18 to specify sigstore identity
constraints in delegations.
The feature introduced here depends on unreleased prototype code in
go-securesystemslib and is also insufficiently tested due to some
sigstore library constraints.
See: #73
Signed-off-by: Aditya Sirish <aditya@saky.in>
This commit introduces basic verification workflows for Git refs.
Specifically, a Git ref can be verified against either the latest policy
or from the very start of the RSL. As part of this, relative
verification is also introduced from one RSL entry to the next.
Note: also adds basic Match functionality for delegation patterns in the tuf
package.
Signed-off-by: Aditya Sirish <aditya@saky.in>
Currently, we're using a zerohash for the tree ID for RSL entries. This
is flagged as an error by Git, and visible when trying to push to some
forges.
Signed-off-by: Aditya Sirish <aditya@saky.in>
This is a full fledged refactor of the cmd package based on this comment:
https://github.com/adityasaky/gittuf/pull/41#discussion_r1198995982.
First, the dev subcommand is retired as it was necessary to test certain
RSL functions which have now been built. The subcommand also printed out
the git config, again something we no longer need. To that end,
GetConfig() in gitinterface has been made private.
Second, the trust and policy subcommands have been reimplemented using
the recommended structure with specific packages that construct them
with their options.
Finally, the cmd package has been moved to the internal namespace.
Signed-off-by: Aditya Sirish <aditya@saky.in>
First, the test is switched to using an in-memory repository. Second,
due to changes in how config is read, we no longer have the issue of
system / user git configs polluting the test config. So, the previously
disabled tests (expected to error out) have been enabled as well.
Signed-off-by: Aditya Sirish <aditya@saky.in>
This removes several direct fs handling for namespace creation as well
as making the RSL package dependent on repo information being passed in.
This also means that several tests can move to in-memory repositories.
Signed-off-by: Aditya Sirish <aditya@saky.in>
This commit includes several plumbing changes.
* Support for trees and blobs in gitinterface
* Initialization of refs/gittuf independent of policy / RSL packages
* Initialization of policy and policy-staging namespaces
* rsl.InitializeNamespace is now only responsible for its own namespace
* Replaces some t.Error calls with t.Fatal
Signed-off-by: Aditya Sirish <aditya@saky.in>
This package includes a set of helpers to interface with the underlying
git repository. Features:
* parse git configs to determine commit signing mechanism
* create and sign commit objects
Signed-off-by: Aditya Sirish <aditya@saky.in>
