don't set the GIT_SSL_CAINFO when an external Git is used

[shiftkey]

If you're using dugite on Linux but want to use an external Git, you won't have the dugite-native distribution and it's CA bundle available. This means this file might not exist on disk.

If a LOCAL_GIT_DIRECTORY is defined as per #85, we should not set GIT_SSL_CAINFO and instead assume the user has their GIT_SSL_CAINFO environment variable set to point to their own bundle.

[kittaakos]

After resolving #113, I have managed to use an external Git executable for cloning public repositories on both OS X and Windows. Unfortunately, it still fails on Linux. I can see such errors on the CI:

GitError: Cloning into '/tmp/d-11784-3076-1xxin47.zddvqs38fr'...
fatal: unable to access 'https://github.com/TypeFox/dugite-extra.git/': Problem with the SSL CA cert (path? access rights?)

The same test happily passes when I do not use an external Git executable but the one shipped with dugite.

What do you think, does my error somehow related to this ticket? Thanks in advance for your kind help!

[shiftkey]

@kittaakos yeah, this is related to your setup. Thanks for uncovering it!

The bundled certificates referred to here come from the upstream curl project.

I think the changes around using an external Git now break these lines (because you're using LOCAL_GIT_DIRECTORY rather than the inbuilt Git directory):

dugite/lib/git-environment.ts

Lines 102 to 103 in a2f6b82

	const sslCABundle = `${gitDir}/ssl/cacert.pem`
	env.GIT_SSL_CAINFO = sslCABundle

What if we did something like this inside that last Linux conditional?

if (process.platform === 'linux') {
  // when building Git for Linux and then running it from
  // an arbitrary location, you should set PREFIX for the
  // process to ensure that it knows how to resolve things
  env.PREFIX = gitDir

  // if the user hasn't specified their own certificate bundle
  if (!process.env.GIT_SSL_CAINFO) {
    // resolve the path to the original Git directory
    const distroPath = ...
    
    // bypass whatever certificates might be set and use
    // the bundle included in the distribution
    const sslCABundle = `${distroPath}/ssl/cacert.pem`
    env.GIT_SSL_CAINFO = sslCABundle
  }
}

[ShubhamManuSharma]

hello sir,
I am stuck in quite similar problem as i can seen here,
The main Issue is pipeline stuck. As i am pasting the stuck section of pipeline. The question is,
Is it the same problem due to GIT_SSL_CAINFO variable setting??

++ export GIT_SSL_CAINFO=/home/gitlab-runner/builds/541451b1/1/buildroot_source/buildroot.tmp/GIT_SSL_CAINFO
++ GIT_SSL_CAINFO=/home/gitlab-runner/builds/541451b1/1/buildroot_source/buildroot.tmp/GIT_SSL_CAINFO
++ mkdir -p /home/gitlab-runner/builds/541451b1/1/buildroot_source/buildroot.tmp/git-template
++ rm -r -f /home/gitlab-runner/builds/541451b1/1/buildroot_source/buildroot
++ git config -f /home/gitlab-runner/builds/541451b1/1/buildroot_source/buildroot.tmp/git-template/config fetch.recurseSubmodules false
++ echo 'Cloning repository...'
Cloning repository...
++ git clone --no-checkout https://gitlab-ci-token:xxxxxxxxxxxxxxxxxxxx@git.inventum.in/buildroot_source/buildroot.git /home/gitlab-runner/builds/541451b1/1/buildroot_source/buildroot --template /home/gitlab-runner/builds/541451b1/1/buildroot_source/buildroot.tmp/git-template
Cloning into '/home/gitlab-runner/builds/541451b1/1/buildroot_source/buildroot'...
++ cd /home/gitlab-runner/builds/541451b1/1/buildroot_source/buildroot
++ echo 'Checking out 07939291 as sched...'
Checking out 07939291 as sched...
++ git checkout -f -q 079392912e17290f3de1167b42072db42293ee88
++ echo 'Skipping Git submodules setup'
Skipping Git submodules setup

• exit 0
  ERROR: Job failed: execution took longer than 2h0m0s seconds

[shiftkey]

Is it the same problem due to GIT_SSL_CAINFO variable setting??

@ShubhamManuSharma I'm not sure where this value is coming from:

++ export GIT_SSL_CAINFO=/home/gitlab-runner/builds/541451b1/1/buildroot_source/buildroot.tmp/GIT_SSL_CAINFO

From the Git documentation:

http.sslCAInfo::
	File containing the certificates to verify the peer with when
	fetching or pushing over HTTPS. Can be overridden by the
	`GIT_SSL_CAINFO` environment variable.

This should point to a file on disk containing certificates that can be used, but it doesn't look like a valid file.

[shiftkey]

@ShubhamManuSharma actually, I think you'll need to talk with GitLab runner support as it seems that the Git operations are successful and the job times out somewhere in the pipeline:

exit 0
ERROR: Job failed: execution took longer than 2h0m0s seconds