Commit `cabf60cf5b`

cabf60cf5be6415ea1a1da2e8269db8a4efea155

parent: 5441d8b8bf

Verified · cmc ci/build: success ci/sonar: success ci/test: success ci/vuln: success

cmc <hello@cleberg.net> · 2026-09-04 23:40 UTC

exec: resolve git and ssh once, at start-up

Every spawn passed a bare "git" or "ssh" and let the kernel search PATH
again. 74 of the 118 findings in the first SonarCloud scan were this one
rule, which is the practical reason to change it: a dashboard that is
mostly permanent noise is one nobody reads, which is the state a scan
exists to avoid.

There are three real gains behind that, in the order they matter.

A missing tool is now one legible failure at start-up — gitbayd calls
toolpath.Verify before it loads config — instead of an opaque one at the
first push, on whichever request happened to need git.

The command a long-lived daemon runs is fixed for its lifetime, decided
from the environment it started with rather than resolved afresh each
time. gitbayd and gitbay-runner both run under systemd with a root-owned
PATH and a read-only /usr, so the search was never attacker-influenced in
a shipped configuration; a spawn that cannot be redirected is still one
fewer thing to reason about.

And the lookup leaves the hot path. A repository page can spawn several
git processes and each was searching PATH from scratch.

An unresolvable tool falls back to the bare name, so anything running
before Verify fails exactly the way it used to.

Production code only. The findings are all there, and rewriting the tests
would have been churn for a scanner that does not read them.

Closes #153

Layout: unified · split

cmd/gitbay-runner/main.go +5 −4

 	"time"
 	"gitbay.org/gitbay/internal/buildinfo"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 type job struct {
 	defer os.RemoveAll(dir)
 	// One long-lived `runner log` session receives the whole stream.
-	logCmd := exec.Command("ssh", append(r.sshOpts, r.remote, "runner", "log", fmt.Sprint(j.ID))...)
+	logCmd := exec.Command(toolpath.Look("ssh"), append(r.sshOpts, r.remote, "runner", "log", fmt.Sprint(j.ID))...)
 	pipe, err := logCmd.StdinPipe()
 	if err != nil {
 		log.Printf("build %d: log pipe: %v", j.ID, err)
 	}
 	steps = append(steps, []string{"-C", dir, "checkout", "-q", j.SHA})
 	for _, args := range steps {
-		cmd := exec.Command("git", args...)
+		cmd := exec.Command(toolpath.Look("git"), args...)
 		cmd.Env = append(os.Environ(), "GIT_SSH_COMMAND="+gitSSH, "GIT_TERMINAL_PROMPT=0")
 		cmd.Stdout, cmd.Stderr = sink, sink
 		if ok, why := runStep(cmd, deadline); !ok {
 	for _, step := range j.Steps {
 		fmt.Fprintf(sink, "$ %s\n", step)
-		cmd := exec.Command("sh", "-c", step)
+		cmd := exec.Command(toolpath.Look("sh"), "-c", step)
 		cmd.Dir = dir
 		cmd.Env = append(os.Environ(),
 			"GITBAY_REPO="+j.Repo, "GITBAY_SHA="+j.SHA, "GITBAY_REF="+j.Ref, "GITBAY_JOB="+j.Job, "CI=true")
 // ssh runs one control command against the server and returns stdout.
 func (r *runner) ssh(stdin io.Reader, args ...string) (string, error) {
-	cmd := exec.Command("ssh", append(append(r.sshOpts, r.remote), args...)...)
+	cmd := exec.Command(toolpath.Look("ssh"), append(append(r.sshOpts, r.remote), args...)...)
 	if stdin != nil {
 		cmd.Stdin = stdin
 	}

cmd/gitbay/local.go +5 −4

 	"gitbay.org/gitbay/internal/cliconfig"
 	"gitbay.org/gitbay/internal/protocol"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 // hasBodyFlag reports whether args already carry body/message input.
 	fmt.Fprintf(f, "\n# Write the %s body above. Lines starting with '#' are ignored.\n# Save an empty file to skip the body.\n", kind)
 	f.Close()
-	ed := exec.Command("sh", "-c", editor+" "+shellQuote(f.Name()))
+	ed := exec.Command(toolpath.Look("sh"), "-c", editor+" "+shellQuote(f.Name()))
 	ed.Stdin, ed.Stdout, ed.Stderr = os.Stdin, os.Stdout, os.Stderr
 	if err := ed.Run(); err != nil {
 		return nil, nil, false, fmt.Errorf("editor: %w", err)
 }
 func runGitLocal(args ...string) int {
-	cmd := exec.Command("git", args...)
+	cmd := exec.Command(toolpath.Look("git"), args...)
 	cmd.Stdin, cmd.Stdout, cmd.Stderr = os.Stdin, os.Stdout, os.Stderr
 	if err := cmd.Run(); err != nil {
 		if ee, ok := err.(*exec.ExitError); ok {
 	args := sshArgs(t.inst)
 	quoted := quoteAll(serverArgv)
 	args = append(args, t.inst.SSHUser()+"@"+t.inst.Host, "--", strings.Join(quoted, " "))
-	cmd := exec.Command("ssh", args...)
+	cmd := exec.Command(toolpath.Look("ssh"), args...)
 	cmd.Stderr = os.Stderr
 	out, err := cmd.Output()
 	if err != nil {
 // currentBranch is the checked-out branch of the working directory's
 // clone, or "" outside a clone or on a detached HEAD.
 func currentBranch() string {
-	out, err := exec.Command("git", "symbolic-ref", "--quiet", "--short", "HEAD").Output()
+	out, err := exec.Command(toolpath.Look("git"), "symbolic-ref", "--quiet", "--short", "HEAD").Output()
 	if err != nil {
 		return ""
 	}

cmd/gitbay/migrate.go +4 −3

 	"github.com/spf13/cobra"
 	"gitbay.org/gitbay/internal/protocol"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 func migrateCmd() *cobra.Command {
 	}
 	args = append(args, "git@"+host, "--")
 	args = append(args, extra...)
-	return exec.Command("ssh", args...)
+	return exec.Command(toolpath.Look("ssh"), args...)
 }
 func runMigrate(from string, fromPort int) int {
 		if fromPort != 0 && fromPort != 22 {
 			srcURL = fmt.Sprintf("ssh://git@%s:%d/%s.git", from, fromPort, repoPath)
 		}
-		clone := exec.Command("git", "clone", "--quiet", "--mirror", srcURL, tmp+"/r")
+		clone := exec.Command(toolpath.Look("git"), "clone", "--quiet", "--mirror", srcURL, tmp+"/r")
 		clone.Stderr = os.Stderr
 		if err := clone.Run(); err != nil {
 			fmt.Fprintf(os.Stderr, "gitbay: cloning %s failed; fix and re-run migrate (it resumes)\n", repoPath)
 			os.RemoveAll(tmp)
 			return protocol.ExitFailure
 		}
-		push := exec.Command("git", "-C", tmp+"/r", "push", "--quiet", t.inst.CloneURL(repoPath),
+		push := exec.Command(toolpath.Look("git"), "-C", tmp+"/r", "push", "--quiet", t.inst.CloneURL(repoPath),
 			"+refs/heads/*:refs/heads/*", "+refs/tags/*:refs/tags/*")
 		if len(t.inst.SSHOptions) > 0 {
 			push.Env = append(os.Environ(), "GIT_SSH_COMMAND=ssh "+strings.Join(quoteAll(t.inst.SSHOptions), " "))

cmd/gitbay/ssh.go +4 −3

 	"gitbay.org/gitbay/internal/cliconfig"
 	"gitbay.org/gitbay/internal/protocol"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 // context is the resolved target for a command: which instance to talk to
 }
 func originURL() string {
-	out, err := exec.Command("git", "remote", "get-url", "origin").Output()
+	out, err := exec.Command(toolpath.Look("git"), "remote", "get-url", "origin").Output()
 	if err != nil {
 		return ""
 	}
 	}
 	args = append(args, t.inst.SSHUser()+"@"+t.inst.Host, "--", strings.Join(quoted, " "))
-	cmd := exec.Command("ssh", args...)
+	cmd := exec.Command(toolpath.Look("ssh"), args...)
 	cmd.Stdin = stdin
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
 		quoted[i] = shellQuote(a)
 	}
 	args = append(args, t.inst.SSHUser()+"@"+t.inst.Host, "--", strings.Join(quoted, " "))
-	out, err := exec.Command("ssh", args...).Output()
+	out, err := exec.Command(toolpath.Look("ssh"), args...).Output()
 	if err != nil {
 		code := protocol.ExitProtocol
 		if ee, ok := err.(*exec.ExitError); ok && ee.ExitCode() != 255 {

cmd/gitbayd/hook.go +3 −2

 	"gitbay.org/gitbay/internal/gitutil"
 	"gitbay.org/gitbay/internal/hookd"
 	"gitbay.org/gitbay/internal/policy"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 // incomingSHAs lists the commits this push introduces, in order, without
 			continue
 		}
 		// Everything reachable from the new tip that no existing ref has.
-		raw, err := exec.Command("git", "rev-list", u.New, "--not", "--all").Output()
+		raw, err := exec.Command(toolpath.Look("git"), "rev-list", u.New, "--not", "--all").Output()
 		if err != nil {
 			return nil, fmt.Errorf("rev-list %s: %w", u.New, err)
 		}
 	// part-way through a large push leaves git blocked writing into a
 	// pipe nobody is reading and Wait blocked on git.
 	ctx, cancel := context.WithCancel(context.Background())
-	cmd := exec.CommandContext(ctx, "git", "cat-file", "--batch")
+	cmd := exec.CommandContext(ctx, toolpath.Look("git"), "cat-file", "--batch")
 	stdin, err := cmd.StdinPipe()
 	if err != nil {
 		cancel()

cmd/gitbayd/main.go +7

 	"gitbay.org/gitbay/internal/notify"
 	"gitbay.org/gitbay/internal/sshd"
 	"gitbay.org/gitbay/internal/store"
+	"gitbay.org/gitbay/internal/toolpath"
 	"gitbay.org/gitbay/internal/webhook"
 )
 			// First line of every run: the journal then says which commit is
 			// serving, without rebuilding the binary to find out.
 			logBuild()
+			// The tools this daemon shells out to are resolved once, at
+			// package init. Say so now rather than failing on whichever
+			// request first needed git.
+			if err := toolpath.Verify(); err != nil {
+				return fmt.Errorf("required tools missing: %w", err)
+			}
 			cfg, err := config.Load(configPath)
 			if err != nil {
 				return err

cmd/gitbayd/maint.go +2 −1

 	"gitbay.org/gitbay/internal/gitutil"
 	"gitbay.org/gitbay/internal/lfs"
 	"gitbay.org/gitbay/internal/store"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 func gcCmd() *cobra.Command {
 				if aggressive {
 					gcArgs = append(gcArgs, "--aggressive")
 				}
-				if out, err := exec.Command("git", gcArgs...).CombinedOutput(); err != nil {
+				if out, err := exec.Command(toolpath.Look("git"), gcArgs...).CombinedOutput(); err != nil {
 					fmt.Fprintf(os.Stderr, "%s: gc failed: %v\n%s", r.Path(), err, out)
 					continue
 				}

internal/gitd/gitd.go +2 −1

 	"gitbay.org/gitbay/internal/config"
 	"gitbay.org/gitbay/internal/control"
 	"gitbay.org/gitbay/internal/store"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 type Server struct {
 	}
 	dir := control.RepoDir(s.cfg.Server.Root, repo.OwnerName, repo.Name)
-	cmd := exec.Command("git", "upload-pack", dir)
+	cmd := exec.Command(toolpath.Look("git"), "upload-pack", dir)
 	cmd.Env = append(os.Environ(), protoEnv...)
 	cmd.Stdin = conn
 	cmd.Stdout = conn

internal/gitutil/blame.go +3 −1

 	"os/exec"
 	"strconv"
 	"strings"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 // BlameHunk is a run of consecutive lines attributed to one commit.
 	if err != nil {
 		return nil, err
 	}
-	cmd := exec.Command("git", "-C", dir, "blame", "--porcelain",
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "blame", "--porcelain",
 		fmt.Sprintf("-L%d,%d", start, end), sha, "--", path)
 	out, err := cmd.Output()
 	if err != nil {

internal/gitutil/facts.go +5 −3

 	"sort"
 	"strconv"
 	"strings"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 // CountCommits returns the number of commits reachable from ref, or 0 when
 // the ref does not resolve (an empty repository).
 func CountCommits(dir, ref string) int {
-	out, err := exec.Command("git", "-C", dir, "rev-list", "--count", "--end-of-options", ref).Output()
+	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "rev-list", "--count", "--end-of-options", ref).Output()
 	if err != nil {
 		return 0
 	}
 // tie back to an account, after the repository's own .mailmap has had its
 // say — a bare repo resolves that from HEAD:.mailmap with no config.
 func Contributors(dir, ref string) []Contributor {
-	out, err := exec.Command("git", "-C", dir, "log",
+	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "log",
 		"--use-mailmap", "--format=%aN%x01%aE", "--end-of-options", ref).Output()
 	if err != nil {
 		return nil
 // largest first, keyed by the extension map the caller supplies. Only
 // blobs count; git's own metadata does not.
 func Languages(dir, ref string, lang func(path string) string) []Language {
-	out, err := exec.Command("git", "-C", dir, "ls-tree", "-r", "-l", "--full-name", "--end-of-options", ref).Output()
+	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "ls-tree", "-r", "-l", "--full-name", "--end-of-options", ref).Output()
 	if err != nil {
 		return nil
 	}

internal/gitutil/gitutil.go +14 −12

 	"os/exec"
 	"path/filepath"
 	"strings"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 // InitBare creates a bare repository with the shared hooks directory wired
 	if err := os.MkdirAll(filepath.Dir(path), 0o750); err != nil {
 		return err
 	}
-	cmd := exec.Command("git", "init", "--bare", "--initial-branch="+defaultBranch, path)
+	cmd := exec.Command(toolpath.Look("git"), "init", "--bare", "--initial-branch="+defaultBranch, path)
 	if out, err := cmd.CombinedOutput(); err != nil {
 		return fmt.Errorf("git init: %v\n%s", err, out)
 	}
 	// An empty hooksPath leaves the bare repo with no hooks — used for
 	// companion repos (wikis) that carry no ref policy.
 	if hooksPath != "" {
-		cmd = exec.Command("git", "-C", path, "config", "core.hooksPath", hooksPath)
+		cmd = exec.Command(toolpath.Look("git"), "-C", path, "config", "core.hooksPath", hooksPath)
 		if out, err := cmd.CombinedOutput(); err != nil {
 			return fmt.Errorf("git config core.hooksPath: %v\n%s", err, out)
 		}
 	default:
 		return fmt.Errorf("unknown service %q", service)
 	}
-	cmd := exec.Command("git", args...)
+	cmd := exec.Command(toolpath.Look("git"), args...)
 	cmd.Env = append(os.Environ(), extraEnv...)
 	cmd.Stdin = stdin
 	cmd.Stdout = stdout
 // dir. It must run with the caller's environment intact so that quarantined
 // objects during pre-receive remain visible.
 func IsAncestor(dir, old, new string) (bool, error) {
-	cmd := exec.Command("git", "-C", dir, "merge-base", "--is-ancestor", old, new)
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "merge-base", "--is-ancestor", old, new)
 	err := cmd.Run()
 	if err == nil {
 		return true, nil
 // RevList returns up to limit commit SHAs reachable from ref, newest first.
 func RevList(dir, ref string, limit int) ([]string, error) {
-	cmd := exec.Command("git", "-C", dir, "rev-list", fmt.Sprintf("--max-count=%d", limit), "--end-of-options", ref)
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "rev-list", fmt.Sprintf("--max-count=%d", limit), "--end-of-options", ref)
 	out, err := cmd.Output()
 	if err != nil {
 		return nil, fmt.Errorf("rev-list %s: %w", ref, err)
 // touch filePath, newest first. The "--" keeps the path from ever being
 // read as an option or ref.
 func RevListPath(dir, ref, filePath string, limit int) ([]string, error) {
-	cmd := exec.Command("git", "-C", dir, "rev-list",
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "rev-list",
 		fmt.Sprintf("--max-count=%d", limit), "--end-of-options", ref, "--", filePath)
 	out, err := cmd.Output()
 	if err != nil {
 // PeelToCommit resolves a ref or object to its commit — annotated tags
 // peel to the commit they point at.
 func PeelToCommit(dir, ref string) (string, error) {
-	out, err := exec.Command("git", "-C", dir, "rev-parse", "--verify", "--end-of-options", ref+"^{commit}").Output()
+	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "rev-parse", "--verify", "--end-of-options", ref+"^{commit}").Output()
 	if err != nil {
 		return "", fmt.Errorf("rev-parse %s^{commit}: %w", ref, err)
 	}
 // ReadCommit returns the raw commit object bytes.
 func ReadCommit(dir, sha string) ([]byte, error) {
-	cmd := exec.Command("git", "-C", dir, "cat-file", "commit", "--end-of-options", sha)
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "cat-file", "commit", "--end-of-options", sha)
 	out, err := cmd.Output()
 	if err != nil {
 		return nil, fmt.Errorf("cat-file commit %s: %w", sha, err)
 // an interactive caller can watch. extraEnv carries credentials via
 // GIT_ASKPASS; the URL itself must never contain them.
 func FetchMirror(ctx context.Context, dir, url string, errW io.Writer, extraEnv []string) error {
-	cmd := exec.CommandContext(ctx, "git", "-C", dir, "fetch", "--progress", "--no-write-fetch-head", url,
+	cmd := exec.CommandContext(ctx, toolpath.Look("git"), "-C", dir, "fetch", "--progress", "--no-write-fetch-head", url,
 		"+refs/heads/*:refs/heads/*",
 		"+refs/tags/*:refs/tags/*",
 		"+refs/notes/*:refs/notes/*")
 // handshakes. extraEnv carries credentials via GIT_ASKPASS; the URL must
 // never contain them.
 func FetchPullHeads(ctx context.Context, dir, url string, errW io.Writer, extraEnv []string) error {
-	cmd := exec.CommandContext(ctx, "git", "-C", dir, "fetch", "--no-write-fetch-head", "--no-tags",
+	cmd := exec.CommandContext(ctx, toolpath.Look("git"), "-C", dir, "fetch", "--no-write-fetch-head", "--no-tags",
 		url, "+refs/pull/*/head:refs/gh-pull/*")
 	cmd.Env = append(os.Environ(), extraEnv...)
 	cmd.Stderr = errW
 // RemoteDefaultBranch asks the remote which branch HEAD points at.
 func RemoteDefaultBranch(ctx context.Context, url string, extraEnv []string) (string, error) {
-	cmd := exec.CommandContext(ctx, "git", "ls-remote", "--symref", url, "HEAD")
+	cmd := exec.CommandContext(ctx, toolpath.Look("git"), "ls-remote", "--symref", url, "HEAD")
 	cmd.Env = append(os.Environ(), extraEnv...)
 	out, err := cmd.Output()
 	if err != nil {
 // SetHead points the bare repo's HEAD at a branch.
 func SetHead(dir, branch string) error {
-	cmd := exec.Command("git", "-C", dir, "symbolic-ref", "HEAD", "refs/heads/"+branch)
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "symbolic-ref", "HEAD", "refs/heads/"+branch)
 	if out, err := cmd.CombinedOutput(); err != nil {
 		return fmt.Errorf("symbolic-ref: %v\n%s", err, out)
 	}

internal/gitutil/grep.go +3 −1

 	"strconv"
 	"strings"
 	"time"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 type GrepMatch struct {
 	defer cancel()
 	// -z: NUL after the path and the line number, so paths containing
 	// ':' parse unambiguously (format: "ref:path\0line\0text\n").
-	cmd := exec.CommandContext(ctx, "git", "-C", dir, "grep", "-nIiF", "-z", "-e", query, "--end-of-options", ref)
+	cmd := exec.CommandContext(ctx, toolpath.Look("git"), "-C", dir, "grep", "-nIiF", "-z", "-e", query, "--end-of-options", ref)
 	out, err := cmd.Output()
 	if err != nil {
 		if ee, ok := err.(*exec.ExitError); ok && ee.ExitCode() == 1 {

internal/gitutil/lastcommit.go +5 −3

 	"strconv"
 	"strings"
 	"time"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 // EntryCommit is the newest commit touching one entry of a tree listing.
 	if prefix != "" {
 		args = append(args, "--", strings.TrimSuffix(prefix, "/"))
 	}
-	cmd := exec.Command("git", args...)
+	cmd := exec.Command(toolpath.Look("git"), args...)
 	stdout, err := cmd.StdoutPipe()
 	if err != nil {
 		return nil
 // TipCommit is the commit at ref, for the bar above a tree listing that
 // answers "who touched this repository last".
 func TipCommit(dir, ref string) EntryCommit {
-	out, err := exec.Command("git", "-C", dir, "log", "-1",
+	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "log", "-1",
 		"--format=%H%x1f%ct%x1f%an%x1f%ae%x1f%s", "--end-of-options", ref).Output()
 	if err != nil {
 		return EntryCommit{}
 // page can report the facts the file listing no longer carries: its size,
 // and whether it is executable or a symlink.
 func StatPath(dir, ref, path string) (TreeEntry, bool) {
-	out, err := exec.Command("git", "-C", dir, "ls-tree", "-l", "--end-of-options", ref, "--", path).Output()
+	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "ls-tree", "-l", "--end-of-options", ref, "--", path).Output()
 	if err != nil {
 		return TreeEntry{}, false
 	}

internal/gitutil/lfs.go +4 −2

 	"regexp"
 	"strconv"
 	"strings"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 // lfsPointerMax bounds a pointer file; real ones are around 130 bytes.
 // anywhere in the repository: every object, not just the reachable ones,
 // since an unreachable blob is still an object gc has not removed.
 func LFSPointerOIDs(dir string) ([]string, error) {
-	list := exec.Command("git", "-C", dir, "cat-file", "--batch-all-objects",
+	list := exec.Command(toolpath.Look("git"), "-C", dir, "cat-file", "--batch-all-objects",
 		"--batch-check=%(objecttype) %(objectsize) %(objectname)")
 	out, err := list.Output()
 	if err != nil {
 	if len(small) == 0 {
 		return nil, nil
 	}
-	cat := exec.Command("git", "-C", dir, "cat-file", "--batch")
+	cat := exec.Command(toolpath.Look("git"), "-C", dir, "cat-file", "--batch")
 	cat.Stdin = strings.NewReader(strings.Join(small, "\n") + "\n")
 	out, err = cat.Output()
 	if err != nil {

internal/gitutil/merge.go +22 −20

 	"os"
 	"os/exec"
 	"strings"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 // FetchInto copies srcRef from srcDir into dstDir as dstRef, forcing the
 // update. Objects are copied, not shared — the destination owns everything
 // afterward, which is what keeps MRs alive when their fork is deleted.
 func FetchInto(dstDir, srcDir, srcRef, dstRef string) error {
-	cmd := exec.Command("git", "-C", dstDir, "fetch", "--quiet", "--no-write-fetch-head",
+	cmd := exec.Command(toolpath.Look("git"), "-C", dstDir, "fetch", "--quiet", "--no-write-fetch-head",
 		srcDir, "+"+srcRef+":"+dstRef)
 	if out, err := cmd.CombinedOutput(); err != nil {
 		return fmt.Errorf("fetch %s from %s: %v\n%s", srcRef, srcDir, err, out)
 	if oldSHA != "" {
 		args = append(args, oldSHA)
 	}
-	cmd := exec.Command("git", args...)
+	cmd := exec.Command(toolpath.Look("git"), args...)
 	if out, err := cmd.CombinedOutput(); err != nil {
 		return fmt.Errorf("update-ref %s: %v\n%s", ref, err, out)
 	}
 }
 func DeleteRef(dir, ref string) error {
-	cmd := exec.Command("git", "-C", dir, "update-ref", "-d", ref)
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "update-ref", "-d", ref)
 	if out, err := cmd.CombinedOutput(); err != nil {
 		return fmt.Errorf("delete-ref %s: %v\n%s", ref, err, out)
 	}
 // RevListRange returns commits in old..new, newest first.
 func RevListRange(dir, old, new string) ([]string, error) {
-	cmd := exec.Command("git", "-C", dir, "rev-list", "--end-of-options", new, "^"+old)
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "rev-list", "--end-of-options", new, "^"+old)
 	out, err := cmd.Output()
 	if err != nil {
 		return nil, fmt.Errorf("rev-list %s..%s: %w", old, new, err)
 // MergeTree performs a real merge of ours and theirs, returning the merged
 // tree id. conflict=true means the merge cannot be done automatically.
 func MergeTree(dir, ours, theirs string) (tree string, conflict bool, err error) {
-	cmd := exec.Command("git", "-C", dir, "merge-tree", "--write-tree", "--end-of-options", ours, theirs)
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "merge-tree", "--write-tree", "--end-of-options", ours, theirs)
 	out, runErr := cmd.Output()
 	tree = strings.TrimSpace(strings.SplitN(string(out), "\n", 2)[0])
 	if runErr != nil {
 	for _, p := range parents {
 		args = append(args, "-p", p)
 	}
-	cmd := exec.Command("git", args...)
+	cmd := exec.Command(toolpath.Look("git"), args...)
 	cmd.Env = append(os.Environ(),
 		"GIT_AUTHOR_NAME="+name, "GIT_AUTHOR_EMAIL="+email,
 		"GIT_COMMITTER_NAME="+name, "GIT_COMMITTER_EMAIL="+email,
 // truncated says whether it was cut, so the caller can say so instead of
 // rendering a hunk that ends mid-line (#117).
 func Diff(dir, old, new string, limit int64) (patch string, truncated bool, err error) {
-	cmd := exec.Command("git", "-C", dir, "diff", "--stat", "--patch", "--end-of-options", old, new)
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "diff", "--stat", "--patch", "--end-of-options", old, new)
 	out, err := cmd.Output()
 	if err != nil {
 		return "", false, fmt.Errorf("diff: %w", err)
 // MergeBase returns the best common ancestor, or an error if none exists.
 func MergeBase(dir, a, b string) (string, error) {
-	cmd := exec.Command("git", "-C", dir, "merge-base", "--end-of-options", a, b)
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "merge-base", "--end-of-options", a, b)
 	out, err := cmd.Output()
 	if err != nil {
 		return "", fmt.Errorf("no common history between %s and %s", a, b)
 	}
 	// Hash the new blob.
-	hb := exec.Command("git", "-C", dir, "hash-object", "-w", "--stdin")
+	hb := exec.Command(toolpath.Look("git"), "-C", dir, "hash-object", "-w", "--stdin")
 	hb.Stdin = strings.NewReader(string(content))
 	out, err := hb.Output()
 	if err != nil {
 	defer os.Remove(idx.Name())
 	env := append(os.Environ(), "GIT_INDEX_FILE="+idx.Name())
-	rt := exec.Command("git", "-C", dir, "read-tree", parent+"^{tree}")
+	rt := exec.Command(toolpath.Look("git"), "-C", dir, "read-tree", parent+"^{tree}")
 	rt.Env = env
 	if out, err := rt.CombinedOutput(); err != nil {
 		return "", fmt.Errorf("read-tree: %v\n%s", err, out)
 	}
-	ui := exec.Command("git", "-C", dir, "update-index", "--add", "--cacheinfo", "100644,"+blob+","+path)
+	ui := exec.Command(toolpath.Look("git"), "-C", dir, "update-index", "--add", "--cacheinfo", "100644,"+blob+","+path)
 	ui.Env = env
 	if out, err := ui.CombinedOutput(); err != nil {
 		return "", fmt.Errorf("update-index: %v\n%s", err, out)
 	}
-	wt := exec.Command("git", "-C", dir, "write-tree")
+	wt := exec.Command(toolpath.Look("git"), "-C", dir, "write-tree")
 	wt.Env = env
 	out, err = wt.Output()
 	if err != nil {
 // CommitParents returns the parent SHAs of a commit.
 func CommitParents(dir, sha string) ([]string, error) {
-	out, err := exec.Command("git", "-C", dir, "rev-list", "--parents", "-n1", "--end-of-options", sha).Output()
+	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "rev-list", "--parents", "-n1", "--end-of-options", sha).Output()
 	if err != nil {
 		return nil, fmt.Errorf("rev-list --parents %s: %w", sha, err)
 	}
 // AuthorIdent returns a commit's author name, email, and ISO date.
 func AuthorIdent(dir, sha string) (name, email, date string, err error) {
-	out, err := exec.Command("git", "-C", dir, "log", "-1", "--format=%an%x1f%ae%x1f%aI", "--end-of-options", sha).Output()
+	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "log", "-1", "--format=%an%x1f%ae%x1f%aI", "--end-of-options", sha).Output()
 	if err != nil {
 		return "", "", "", fmt.Errorf("log %s: %w", sha, err)
 	}
 // CommitMessage returns a commit's full message.
 func CommitMessage(dir, sha string) (string, error) {
-	out, err := exec.Command("git", "-C", dir, "log", "-1", "--format=%B", "--end-of-options", sha).Output()
+	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "log", "-1", "--format=%B", "--end-of-options", sha).Output()
 	if err != nil {
 		return "", fmt.Errorf("log %s: %w", sha, err)
 	}
 // MergeTreeOnto replays commit's changes (relative to base) onto onto,
 // returning the resulting tree. conflict=true when it cannot apply cleanly.
 func MergeTreeOnto(dir, base, onto, commit string) (tree string, conflict bool, err error) {
-	cmd := exec.Command("git", "-C", dir, "merge-tree", "--write-tree", "--merge-base="+base, "--end-of-options", onto, commit)
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "merge-tree", "--write-tree", "--merge-base="+base, "--end-of-options", onto, commit)
 	out, runErr := cmd.Output()
 	tree = strings.TrimSpace(strings.SplitN(string(out), "\n", 2)[0])
 	if runErr != nil {
 	for _, p := range parents {
 		args = append(args, "-p", p)
 	}
-	cmd := exec.Command("git", args...)
+	cmd := exec.Command(toolpath.Look("git"), args...)
 	env := append(os.Environ(),
 		"GIT_AUTHOR_NAME="+authorName, "GIT_AUTHOR_EMAIL="+authorEmail,
 		"GIT_COMMITTER_NAME="+committerName, "GIT_COMMITTER_EMAIL="+committerEmail,
 // ResolveTree returns the tree id of a commit.
 func ResolveTree(dir, sha string) (string, error) {
-	out, err := exec.Command("git", "-C", dir, "rev-parse", "--verify", "--end-of-options", sha+"^{tree}").Output()
+	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "rev-parse", "--verify", "--end-of-options", sha+"^{tree}").Output()
 	if err != nil {
 		return "", fmt.Errorf("rev-parse %s^{tree}: %w", sha, err)
 	}
 // DiffFiles lists the paths changed between old and new.
 func DiffFiles(dir, old, new string) ([]string, error) {
-	out, err := exec.Command("git", "-C", dir, "diff", "--name-only", "--end-of-options", old, new).Output()
+	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "diff", "--name-only", "--end-of-options", old, new).Output()
 	if err != nil {
 		return nil, fmt.Errorf("diff --name-only: %w", err)
 	}
 // tells a reviewer nothing. It pairs at 80, and two genuinely unrelated
 // commits are still left unpaired there; both measured.
 func RangeDiff(dir, oldBase, oldHead, newBase, newHead string, limit int64) (patch string, truncated bool, err error) {
-	cmd := exec.Command("git", "-C", dir, "range-diff", "--creation-factor=80", "--end-of-options",
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "range-diff", "--creation-factor=80", "--end-of-options",
 		oldBase+".."+oldHead, newBase+".."+newHead)
 	out, err := cmd.Output()
 	if err != nil {

internal/gitutil/messages.go +7 −5

 	"fmt"
 	"os/exec"
 	"strings"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 const zeroSHA = "0000000000000000000000000000000000000000"
 	if old != "" && old != zeroSHA {
 		args = append(args, "^"+old)
 	}
-	out, err := exec.Command("git", args...).Output()
+	out, err := exec.Command(toolpath.Look("git"), args...).Output()
 	if err != nil {
 		return nil, fmt.Errorf("rev-list authors: %w", err)
 	}
 // Parents returns a commit's parent shas.
 func Parents(dir, sha string) []string {
-	out, err := exec.Command("git", "-C", dir, "log", "-1", "--format=%P", sha).Output()
+	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "log", "-1", "--format=%P", sha).Output()
 	if err != nil {
 		return nil
 	}
 // LastCommitDate returns the committer date (YYYY-MM-DD) of the ref tip,
 // or "" for empty repos.
 func LastCommitDate(dir, ref string) string {
-	out, err := exec.Command("git", "-C", dir, "log", "-1", "--format=%cs", ref).Output()
+	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "log", "-1", "--format=%cs", ref).Output()
 	if err != nil {
 		return ""
 	}
 // HasCommit reports whether sha names a commit object present in dir.
 func HasCommit(dir, sha string) bool {
-	return exec.Command("git", "-C", dir, "cat-file", "-e", sha+"^{commit}").Run() == nil
+	return exec.Command(toolpath.Look("git"), "-C", dir, "cat-file", "-e", sha+"^{commit}").Run() == nil
 }
 type CommitMsg struct {
 	if old != "" && old != zeroSHA {
 		args = append(args, "^"+old)
 	}
-	out, err := exec.Command("git", args...).Output()
+	out, err := exec.Command(toolpath.Look("git"), args...).Output()
 	if err != nil {
 		return nil, fmt.Errorf("rev-list messages: %w", err)
 	}

internal/gitutil/read.go +8 −6

 	"strconv"
 	"strings"
 	"time"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 type TreeEntry struct {
 	if path != "" {
 		spec = ref + ":" + path
 	}
-	cmd := exec.Command("git", "-C", dir, "ls-tree", "-l", "--end-of-options", spec)
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "ls-tree", "-l", "--end-of-options", spec)
 	out, err := cmd.Output()
 	if err != nil {
 		return nil, fmt.Errorf("ls-tree %s: %w", spec, err)
 // ReadBlob returns the contents of ref:path, capped at limit bytes.
 func ReadBlob(dir, ref, path string, limit int64) ([]byte, error) {
-	cmd := exec.Command("git", "-C", dir, "cat-file", "blob", "--end-of-options", ref+":"+path)
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "cat-file", "blob", "--end-of-options", ref+":"+path)
 	stdout, err := cmd.StdoutPipe()
 	if err != nil {
 		return nil, err
 // ResolveRef resolves a ref or sha to a full commit sha; errors if absent.
 func ResolveRef(dir, ref string) (string, error) {
-	cmd := exec.Command("git", "-C", dir, "rev-parse", "--verify", "--quiet", "--end-of-options", ref+"^{commit}")
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "rev-parse", "--verify", "--quiet", "--end-of-options", ref+"^{commit}")
 	out, err := cmd.Output()
 	if err != nil {
 		return "", fmt.Errorf("unknown ref %q", ref)
 // Refs lists branches or tags; kind is "heads" or "tags".
 func Refs(dir, kind string) ([]Ref, error) {
-	cmd := exec.Command("git", "-C", dir, "for-each-ref",
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "for-each-ref",
 		"--format=%(refname:short) %(objectname)", "refs/"+kind)
 	out, err := cmd.Output()
 	if err != nil {
 func Archive(dir, ref, prefix string, w io.Writer) error {
 	ctx, cancel := context.WithTimeout(context.Background(), archiveTimeout)
 	defer cancel()
-	cmd := exec.CommandContext(ctx, "git", "-C", dir, "archive", "--format=tar.gz", "--prefix="+prefix+"/", "--end-of-options", ref)
+	cmd := exec.CommandContext(ctx, toolpath.Look("git"), "-C", dir, "archive", "--format=tar.gz", "--prefix="+prefix+"/", "--end-of-options", ref)
 	lw := &cappedWriter{w: w, left: MaxArchiveBytes, stop: cancel}
 	cmd.Stdout = lw
 	err := cmd.Run()
 // ShowPatch returns the stat+patch text for one commit.
 func ShowPatch(dir, sha string, limit int64) (patch string, truncated bool, err error) {
-	cmd := exec.Command("git", "-C", dir, "show", "--stat", "--patch", "--format=", "--end-of-options", sha)
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "show", "--stat", "--patch", "--format=", "--end-of-options", sha)
 	stdout, err := cmd.StdoutPipe()
 	if err != nil {
 		return "", false, err

internal/mirror/mirror.go +2 −1

 	"gitbay.org/gitbay/internal/config"
 	"gitbay.org/gitbay/internal/control"
 	"gitbay.org/gitbay/internal/store"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 const askpassScript = `#!/bin/sh
 		args = []string{"-C", dir, "fetch", "--prune", m.URL,
 			"+refs/heads/*:refs/heads/*", "+refs/tags/*:refs/tags/*"}
 	}
-	cmd := exec.CommandContext(ctx, "git", args...)
+	cmd := exec.CommandContext(ctx, toolpath.Look("git"), args...)
 	cmd.Env = env
 	if out, err := cmd.CombinedOutput(); err != nil {
 		return fmt.Errorf("git %s: %v: %.300s", m.Direction, err, out)

internal/toolpath/toolpath.go added +64

@@ -0,0 +1,64 @@
	1	// Package toolpath resolves the external programs gitbay runs — git, ssh,
	2	// sh — to absolute paths once, when the process starts, instead of
	3	// letting the kernel search PATH on every spawn.
	4	//
	5	// Three things it buys, in the order they matter.
	6	//
	7	// A missing tool becomes one legible failure at start-up rather than an
	8	// opaque one at the first push, on whichever request happened to need it.
	9	//
	10	// The command a long-lived daemon runs is then fixed for its lifetime,
	11	// decided from the environment it was started with rather than resolved
	12	// afresh each time. gitbayd and gitbay-runner both run under systemd with
	13	// a root-owned PATH and a read-only /usr, so a search was never
	14	// attacker-influenced in a shipped configuration — but a spawn that
	15	// cannot be redirected is one fewer thing to reason about, and it is what
	16	// the scanner asks for (go:S4036).
	17	//
	18	// And the lookup leaves the hot path: a repository page can spawn several
	19	// git processes, and each was searching PATH from scratch.
	20	package toolpath
	21
	22	import (
	23	"fmt"
	24	"os/exec"
	25	"strings"
	26	"sync"
	27	)
	28
	29	var (
	30	mu sync.Mutex
	31	cache = map[string]string{}
	32	missing []string
	33	)
	34
	35	// Look returns the absolute path to name, or name itself when it is not
	36	// on PATH. Returning the bare name keeps the failure where it already
	37	// was — exec reporting it — for anything that runs before Verify, and for
	38	// a tool a particular binary never actually uses.
	39	func Look(name string) string {
	40	mu.Lock()
	41	defer mu.Unlock()
	42	if p, ok := cache[name]; ok {
	43	return p
	44	}
	45	p, err := exec.LookPath(name)
	46	if err != nil {
	47	p = name
	48	missing = append(missing, name)
	49	}
	50	cache[name] = p
	51	return p
	52	}
	53
	54	// Verify reports the tools that were asked for and not found, so a daemon
	55	// can refuse to start rather than fail on its first request. Call it after
	56	// the packages that need tools are initialised.
	57	func Verify() error {
	58	mu.Lock()
	59	defer mu.Unlock()
	60	if len(missing) == 0 {
	61	return nil
	62	}
	63	return fmt.Errorf("not found on PATH: %s", strings.Join(missing, ", "))
	64	}

internal/toolpath/toolpath_test.go added +47

@@ -0,0 +1,47 @@
	1	package toolpath
	2
	3	import (
	4	"os/exec"
	5	"path/filepath"
	6	"strings"
	7	"testing"
	8	)
	9
	10	func TestLookResolvesToAnAbsolutePath(t *testing.T) {
	11	got := Look("go")
	12	if !filepath.IsAbs(got) {
	13	t.Fatalf("Look(go) = %q, want an absolute path", got)
	14	}
	15	want, err := exec.LookPath("go")
	16	if err != nil {
	17	t.Fatal(err)
	18	}
	19	if got != want {
	20	t.Errorf("Look(go) = %q, want %q", got, want)
	21	}
	22	}
	23
	24	// A second call must not search again: resolving once is the point, and a
	25	// daemon that re-resolved would follow a PATH that changed under it.
	26	func TestLookIsResolvedOnce(t *testing.T) {
	27	first := Look("go")
	28	if second := Look("go"); second != first {
	29	t.Errorf("Look(go) returned %q then %q", first, second)
	30	}
	31	}
	32
	33	// An absent tool falls back to the bare name so exec reports it the way
	34	// it always did, and Verify names it.
	35	func TestMissingToolFallsBackAndIsReported(t *testing.T) {
	36	const name = "gitbay-no-such-tool-exists"
	37	if got := Look(name); got != name {
	38	t.Errorf("Look(%q) = %q, want the bare name back", name, got)
	39	}
	40	err := Verify()
	41	if err == nil {
	42	t.Fatal("Verify found nothing missing after an unresolvable lookup")
	43	}
	44	if !strings.Contains(err.Error(), name) {
	45	t.Errorf("Verify error %q does not name the missing tool", err)
	46	}
	47	}

Commit cabf60cf5b

Commit `cabf60cf5b`