mirror of
https://github.com/vee1e/gittuf.git
synced 2026-09-01 18:27:06 +00:00
lakshit verma
a4cbba9b15
golangci-lint (gosec G703) flags the worktree and commondir path reads as path traversal because it cannot see across the validation functions. Each resolved path is constrained before use: it must point into an existing directory that is not the repository's GIT_DIR, and for linked worktrees the .git entry must in turn reference this repository. Annotate the read sites to reflect that these are trusted repository-local paths. Also fix test-only lints from the CI gate: use 0600 file permissions for temporary files and mark TestGetWorktree parallel at the top level. Signed-off-by: lakshit verma <vermalucky2004@gmail.com> |
||
|---|---|---|
| .. | ||
| blob.go | ||
| blob_test.go | ||
| changes.go | ||
| changes_test.go | ||
| commit.go | ||
| commit_test.go | ||
| common.go | ||
| common_test.go | ||
| config.go | ||
| config_test.go | ||
| hash.go | ||
| hash_test.go | ||
| log.go | ||
| log_test.go | ||
| object.go | ||
| object_test.go | ||
| README.md | ||
| references.go | ||
| references_test.go | ||
| remote.go | ||
| remote_test.go | ||
| replace_ref_test.go | ||
| repository.go | ||
| repository_test.go | ||
| signature.go | ||
| signature_test.go | ||
| status.go | ||
| status_test.go | ||
| sync.go | ||
| sync_test.go | ||
| tag.go | ||
| tag_test.go | ||
| tree.go | ||
| tree_test.go | ||
| utils.go | ||
| utils_test.go | ||
| worktree_test.go | ||
gittuf's gitinterface Package
gittuf's gitinterface package is a lightweight Go API for interacting with Git
repositories. It is similar to go-git in
its goal, but differs as, unlike go-git, gitinterface uses the Git binary
for its operations.
To operate correctly, gitinterface requires a Git binary version of 2.34 or
higher.