Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use https for github sources (github deprecated insecure git) #218

Merged
merged 1 commit into from
Jul 14, 2022

Conversation

abrom
Copy link
Contributor

@abrom abrom commented Nov 2, 2021

Github have recently dropped support for fetching sources using the git protocol (port 9418) in a bid to prevent MITM issues.

Subsequently trying to fetch a source defined with the github option will result in:

10:27:06  bower mypackage#master                             ECMDERR Failed to execute "git ls-remote --tags --heads git://github.com/user/mypackage.git", exit code of #128 fatal: remote error:    The unauthenticated git protocol on port 9418 is no longer supported. Please see https://github.blog/2021-09-01-improving-git-protocol-security-github/ for more information.
10:27:06  
10:27:06  Additional error details:
10:27:06  fatal: remote error: 
10:27:06    The unauthenticated git protocol on port 9418 is no longer supported.
10:27:06  Please see https://github.blog/2021-09-01-improving-git-protocol-security-github/ for more information.
10:27:06  rake aborted!

This change swaps out the insecure git protocol for https in the DSL parsing.

Note of course that this would still allow someone to specify the git protocol using the git option, however given this issue is only specific to Github, that would seem perfectly reasonable.

This could do with some sort of explanation in the README, however it very much comes down to how the git content is hosted so very likely outside the scope of this project

@abrom abrom force-pushed the use-https-for-github-sources branch from 457b042 to 9b86da9 Compare November 2, 2021 03:45
@rharriso rharriso merged commit 09ca17c into rharriso:master Jul 14, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants