Commit `cabf60cf5b`

cabf60cf5be6415ea1a1da2e8269db8a4efea155

parent: 5441d8b8bf

Verified · cmc ci/build: success ci/sonar: success ci/test: success ci/vuln: success

cmc <hello@cleberg.net> · 2026-09-04 23:40 UTC

exec: resolve git and ssh once, at start-up

Every spawn passed a bare "git" or "ssh" and let the kernel search PATH
again. 74 of the 118 findings in the first SonarCloud scan were this one
rule, which is the practical reason to change it: a dashboard that is
mostly permanent noise is one nobody reads, which is the state a scan
exists to avoid.

There are three real gains behind that, in the order they matter.

A missing tool is now one legible failure at start-up — gitbayd calls
toolpath.Verify before it loads config — instead of an opaque one at the
first push, on whichever request happened to need git.

The command a long-lived daemon runs is fixed for its lifetime, decided
from the environment it started with rather than resolved afresh each
time. gitbayd and gitbay-runner both run under systemd with a root-owned
PATH and a read-only /usr, so the search was never attacker-influenced in
a shipped configuration; a spawn that cannot be redirected is still one
fewer thing to reason about.

And the lookup leaves the hot path. A repository page can spawn several
git processes and each was searching PATH from scratch.

An unresolvable tool falls back to the bare name, so anything running
before Verify fails exactly the way it used to.

Production code only. The findings are all there, and rewriting the tests
would have been churn for a scanner that does not read them.

Closes #153

Layout: unified · split

cmd/gitbay-runner/main.go +5 −4

		@@ -24,6 +24,7 @@ import (
24	24	"time"
25	25
26	26	"gitbay.org/gitbay/internal/buildinfo"
	27	"gitbay.org/gitbay/internal/toolpath"
27	28	)
28	29
29	30	type job struct {
		@@ -203,7 +204,7 @@ func (r *runner) run(j job) bool {
203	204	defer os.RemoveAll(dir)
204	205
205	206	// One long-lived `runner log` session receives the whole stream.
206		logCmd := exec.Command("ssh", append(r.sshOpts, r.remote, "runner", "log", fmt.Sprint(j.ID))...)
	207	logCmd := exec.Command(toolpath.Look("ssh"), append(r.sshOpts, r.remote, "runner", "log", fmt.Sprint(j.ID))...)
207	208	pipe, err := logCmd.StdinPipe()
208	209	if err != nil {
209	210	log.Printf("build %d: log pipe: %v", j.ID, err)
		@@ -294,7 +295,7 @@ func (r *runner) run(j job) bool {
294	295	}
295	296	steps = append(steps, []string{"-C", dir, "checkout", "-q", j.SHA})
296	297	for _, args := range steps {
297		cmd := exec.Command("git", args...)
	298	cmd := exec.Command(toolpath.Look("git"), args...)
298	299	cmd.Env = append(os.Environ(), "GIT_SSH_COMMAND="+gitSSH, "GIT_TERMINAL_PROMPT=0")
299	300	cmd.Stdout, cmd.Stderr = sink, sink
300	301	if ok, why := runStep(cmd, deadline); !ok {
		@@ -305,7 +306,7 @@ func (r *runner) run(j job) bool {
305	306
306	307	for _, step := range j.Steps {
307	308	fmt.Fprintf(sink, "$ %s\n", step)
308		cmd := exec.Command("sh", "-c", step)
	309	cmd := exec.Command(toolpath.Look("sh"), "-c", step)
309	310	cmd.Dir = dir
310	311	cmd.Env = append(os.Environ(),
311	312	"GITBAY_REPO="+j.Repo, "GITBAY_SHA="+j.SHA, "GITBAY_REF="+j.Ref, "GITBAY_JOB="+j.Job, "CI=true")
		@@ -323,7 +324,7 @@ func (r *runner) run(j job) bool {
323	324
324	325	// ssh runs one control command against the server and returns stdout.
325	326	func (r *runner) ssh(stdin io.Reader, args ...string) (string, error) {
326		cmd := exec.Command("ssh", append(append(r.sshOpts, r.remote), args...)...)
	327	cmd := exec.Command(toolpath.Look("ssh"), append(append(r.sshOpts, r.remote), args...)...)
327	328	if stdin != nil {
328	329	cmd.Stdin = stdin
329	330	}

cmd/gitbay/local.go +5 −4

		@@ -11,6 +11,7 @@ import (
11	11
12	12	"gitbay.org/gitbay/internal/cliconfig"
13	13	"gitbay.org/gitbay/internal/protocol"
	14	"gitbay.org/gitbay/internal/toolpath"
14	15	)
15	16
16	17	// hasBodyFlag reports whether args already carry body/message input.
		@@ -50,7 +51,7 @@ func maybeEditor(args []string, kind string, prefill func() string) ([]string, *
50	51	fmt.Fprintf(f, "\n# Write the %s body above. Lines starting with '#' are ignored.\n# Save an empty file to skip the body.\n", kind)
51	52	f.Close()
52	53
53		ed := exec.Command("sh", "-c", editor+" "+shellQuote(f.Name()))
	54	ed := exec.Command(toolpath.Look("sh"), "-c", editor+" "+shellQuote(f.Name()))
54	55	ed.Stdin, ed.Stdout, ed.Stderr = os.Stdin, os.Stdout, os.Stderr
55	56	if err := ed.Run(); err != nil {
56	57	return nil, nil, false, fmt.Errorf("editor: %w", err)
		@@ -74,7 +75,7 @@ func maybeEditor(args []string, kind string, prefill func() string) ([]string, *
74	75	}
75	76
76	77	func runGitLocal(args ...string) int {
77		cmd := exec.Command("git", args...)
	78	cmd := exec.Command(toolpath.Look("git"), args...)
78	79	cmd.Stdin, cmd.Stdout, cmd.Stderr = os.Stdin, os.Stdout, os.Stderr
79	80	if err := cmd.Run(); err != nil {
80	81	if ee, ok := err.(*exec.ExitError); ok {
		@@ -190,7 +191,7 @@ func captureSSH(t target, serverArgv []string) (string, int) {
190	191	args := sshArgs(t.inst)
191	192	quoted := quoteAll(serverArgv)
192	193	args = append(args, t.inst.SSHUser()+"@"+t.inst.Host, "--", strings.Join(quoted, " "))
193		cmd := exec.Command("ssh", args...)
	194	cmd := exec.Command(toolpath.Look("ssh"), args...)
194	195	cmd.Stderr = os.Stderr
195	196	out, err := cmd.Output()
196	197	if err != nil {
		@@ -301,7 +302,7 @@ func cmdRemoteList() int {
301	302	// currentBranch is the checked-out branch of the working directory's
302	303	// clone, or "" outside a clone or on a detached HEAD.
303	304	func currentBranch() string {
304		out, err := exec.Command("git", "symbolic-ref", "--quiet", "--short", "HEAD").Output()
	305	out, err := exec.Command(toolpath.Look("git"), "symbolic-ref", "--quiet", "--short", "HEAD").Output()
305	306	if err != nil {
306	307	return ""
307	308	}

cmd/gitbay/migrate.go +4 −3

		@@ -11,6 +11,7 @@ import (
11	11	"github.com/spf13/cobra"
12	12
13	13	"gitbay.org/gitbay/internal/protocol"
	14	"gitbay.org/gitbay/internal/toolpath"
14	15	)
15	16
16	17	func migrateCmd() *cobra.Command {
		@@ -43,7 +44,7 @@ func sourceSSH(host string, port int, extra ...string) *exec.Cmd {
43	44	}
44	45	args = append(args, "git@"+host, "--")
45	46	args = append(args, extra...)
46		return exec.Command("ssh", args...)
	47	return exec.Command(toolpath.Look("ssh"), args...)
47	48	}
48	49
49	50	func runMigrate(from string, fromPort int) int {
		@@ -99,14 +100,14 @@ func runMigrate(from string, fromPort int) int {
99	100	if fromPort != 0 && fromPort != 22 {
100	101	srcURL = fmt.Sprintf("ssh://git@%s:%d/%s.git", from, fromPort, repoPath)
101	102	}
102		clone := exec.Command("git", "clone", "--quiet", "--mirror", srcURL, tmp+"/r")
	103	clone := exec.Command(toolpath.Look("git"), "clone", "--quiet", "--mirror", srcURL, tmp+"/r")
103	104	clone.Stderr = os.Stderr
104	105	if err := clone.Run(); err != nil {
105	106	fmt.Fprintf(os.Stderr, "gitbay: cloning %s failed; fix and re-run migrate (it resumes)\n", repoPath)
106	107	os.RemoveAll(tmp)
107	108	return protocol.ExitFailure
108	109	}
109		push := exec.Command("git", "-C", tmp+"/r", "push", "--quiet", t.inst.CloneURL(repoPath),
	110	push := exec.Command(toolpath.Look("git"), "-C", tmp+"/r", "push", "--quiet", t.inst.CloneURL(repoPath),
110	111	"+refs/heads/:refs/heads/", "+refs/tags/:refs/tags/")
111	112	if len(t.inst.SSHOptions) > 0 {
112	113	push.Env = append(os.Environ(), "GIT_SSH_COMMAND=ssh "+strings.Join(quoteAll(t.inst.SSHOptions), " "))

cmd/gitbay/ssh.go +4 −3

		@@ -13,6 +13,7 @@ import (
13	13
14	14	"gitbay.org/gitbay/internal/cliconfig"
15	15	"gitbay.org/gitbay/internal/protocol"
	16	"gitbay.org/gitbay/internal/toolpath"
16	17	)
17	18
18	19	// context is the resolved target for a command: which instance to talk to
		@@ -59,7 +60,7 @@ func resolveTarget() (target, error) {
59	60	}
60	61
61	62	func originURL() string {
62		out, err := exec.Command("git", "remote", "get-url", "origin").Output()
	63	out, err := exec.Command(toolpath.Look("git"), "remote", "get-url", "origin").Output()
63	64	if err != nil {
64	65	return ""
65	66	}
		@@ -115,7 +116,7 @@ func runSSH(t target, serverArgv []string, stdin io.Reader) int {
115	116	}
116	117	args = append(args, t.inst.SSHUser()+"@"+t.inst.Host, "--", strings.Join(quoted, " "))
117	118
118		cmd := exec.Command("ssh", args...)
	119	cmd := exec.Command(toolpath.Look("ssh"), args...)
119	120	cmd.Stdin = stdin
120	121	cmd.Stdout = os.Stdout
121	122	cmd.Stderr = os.Stderr
		@@ -145,7 +146,7 @@ func sshCapture(t target, serverArgv []string) (string, int) {
145	146	quoted[i] = shellQuote(a)
146	147	}
147	148	args = append(args, t.inst.SSHUser()+"@"+t.inst.Host, "--", strings.Join(quoted, " "))
148		out, err := exec.Command("ssh", args...).Output()
	149	out, err := exec.Command(toolpath.Look("ssh"), args...).Output()
149	150	if err != nil {
150	151	code := protocol.ExitProtocol
151	152	if ee, ok := err.(*exec.ExitError); ok && ee.ExitCode() != 255 {

cmd/gitbayd/hook.go +3 −2

		@@ -15,6 +15,7 @@ import (
15	15	"gitbay.org/gitbay/internal/gitutil"
16	16	"gitbay.org/gitbay/internal/hookd"
17	17	"gitbay.org/gitbay/internal/policy"
	18	"gitbay.org/gitbay/internal/toolpath"
18	19	)
19	20
20	21	// incomingSHAs lists the commits this push introduces, in order, without
		@@ -28,7 +29,7 @@ func incomingSHAs(updates []policy.RefUpdate) ([]string, error) {
28	29	continue
29	30	}
30	31	// Everything reachable from the new tip that no existing ref has.
31		raw, err := exec.Command("git", "rev-list", u.New, "--not", "--all").Output()
	32	raw, err := exec.Command(toolpath.Look("git"), "rev-list", u.New, "--not", "--all").Output()
32	33	if err != nil {
33	34	return nil, fmt.Errorf("rev-list %s: %w", u.New, err)
34	35	}
		@@ -62,7 +63,7 @@ func streamIncomingCommits(updates []policy.RefUpdate, emit func(hookd.RawCommit
62	63	// part-way through a large push leaves git blocked writing into a
63	64	// pipe nobody is reading and Wait blocked on git.
64	65	ctx, cancel := context.WithCancel(context.Background())
65		cmd := exec.CommandContext(ctx, "git", "cat-file", "--batch")
	66	cmd := exec.CommandContext(ctx, toolpath.Look("git"), "cat-file", "--batch")
66	67	stdin, err := cmd.StdinPipe()
67	68	if err != nil {
68	69	cancel()

cmd/gitbayd/main.go +7

		@@ -32,6 +32,7 @@ import (
32	32	"gitbay.org/gitbay/internal/notify"
33	33	"gitbay.org/gitbay/internal/sshd"
34	34	"gitbay.org/gitbay/internal/store"
	35	"gitbay.org/gitbay/internal/toolpath"
35	36	"gitbay.org/gitbay/internal/webhook"
36	37	)
37	38
		@@ -122,6 +123,12 @@ func serveCmd() *cobra.Command {
122	123	// First line of every run: the journal then says which commit is
123	124	// serving, without rebuilding the binary to find out.
124	125	logBuild()
	126	// The tools this daemon shells out to are resolved once, at
	127	// package init. Say so now rather than failing on whichever
	128	// request first needed git.
	129	if err := toolpath.Verify(); err != nil {
	130	return fmt.Errorf("required tools missing: %w", err)
	131	}
125	132	cfg, err := config.Load(configPath)
126	133	if err != nil {
127	134	return err

cmd/gitbayd/maint.go +2 −1

		@@ -13,6 +13,7 @@ import (
13	13	"gitbay.org/gitbay/internal/gitutil"
14	14	"gitbay.org/gitbay/internal/lfs"
15	15	"gitbay.org/gitbay/internal/store"
	16	"gitbay.org/gitbay/internal/toolpath"
16	17	)
17	18
18	19	func gcCmd() *cobra.Command {
		@@ -51,7 +52,7 @@ func gcCmd() *cobra.Command {
51	52	if aggressive {
52	53	gcArgs = append(gcArgs, "--aggressive")
53	54	}
54		if out, err := exec.Command("git", gcArgs...).CombinedOutput(); err != nil {
	55	if out, err := exec.Command(toolpath.Look("git"), gcArgs...).CombinedOutput(); err != nil {
55	56	fmt.Fprintf(os.Stderr, "%s: gc failed: %v\n%s", r.Path(), err, out)
56	57	continue
57	58	}

internal/gitd/gitd.go +2 −1

		@@ -16,6 +16,7 @@ import (
16	16	"gitbay.org/gitbay/internal/config"
17	17	"gitbay.org/gitbay/internal/control"
18	18	"gitbay.org/gitbay/internal/store"
	19	"gitbay.org/gitbay/internal/toolpath"
19	20	)
20	21
21	22	type Server struct {
		@@ -68,7 +69,7 @@ func (s *Server) handle(conn net.Conn) {
68	69	}
69	70
70	71	dir := control.RepoDir(s.cfg.Server.Root, repo.OwnerName, repo.Name)
71		cmd := exec.Command("git", "upload-pack", dir)
	72	cmd := exec.Command(toolpath.Look("git"), "upload-pack", dir)
72	73	cmd.Env = append(os.Environ(), protoEnv...)
73	74	cmd.Stdin = conn
74	75	cmd.Stdout = conn

internal/gitutil/blame.go +3 −1

		@@ -7,6 +7,8 @@ import (
7	7	"os/exec"
8	8	"strconv"
9	9	"strings"
	10
	11	"gitbay.org/gitbay/internal/toolpath"
10	12	)
11	13
12	14	// BlameHunk is a run of consecutive lines attributed to one commit.
		@@ -28,7 +30,7 @@ func Blame(dir, ref, path string, start, end int) ([]BlameHunk, error) {
28	30	if err != nil {
29	31	return nil, err
30	32	}
31		cmd := exec.Command("git", "-C", dir, "blame", "--porcelain",
	33	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "blame", "--porcelain",
32	34	fmt.Sprintf("-L%d,%d", start, end), sha, "--", path)
33	35	out, err := cmd.Output()
34	36	if err != nil {

internal/gitutil/facts.go +5 −3

		@@ -5,12 +5,14 @@ import (
5	5	"sort"
6	6	"strconv"
7	7	"strings"
	8
	9	"gitbay.org/gitbay/internal/toolpath"
8	10	)
9	11
10	12	// CountCommits returns the number of commits reachable from ref, or 0 when
11	13	// the ref does not resolve (an empty repository).
12	14	func CountCommits(dir, ref string) int {
13		out, err := exec.Command("git", "-C", dir, "rev-list", "--count", "--end-of-options", ref).Output()
	15	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "rev-list", "--count", "--end-of-options", ref).Output()
14	16	if err != nil {
15	17	return 0
16	18	}
		@@ -30,7 +32,7 @@ type Contributor struct {
30	32	// tie back to an account, after the repository's own .mailmap has had its
31	33	// say — a bare repo resolves that from HEAD:.mailmap with no config.
32	34	func Contributors(dir, ref string) []Contributor {
33		out, err := exec.Command("git", "-C", dir, "log",
	35	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "log",
34	36	"--use-mailmap", "--format=%aN%x01%aE", "--end-of-options", ref).Output()
35	37	if err != nil {
36	38	return nil
		@@ -62,7 +64,7 @@ func Contributors(dir, ref string) []Contributor {
62	64	// largest first, keyed by the extension map the caller supplies. Only
63	65	// blobs count; git's own metadata does not.
64	66	func Languages(dir, ref string, lang func(path string) string) []Language {
65		out, err := exec.Command("git", "-C", dir, "ls-tree", "-r", "-l", "--full-name", "--end-of-options", ref).Output()
	67	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "ls-tree", "-r", "-l", "--full-name", "--end-of-options", ref).Output()
66	68	if err != nil {
67	69	return nil
68	70	}

internal/gitutil/gitutil.go +14 −12

		@@ -11,6 +11,8 @@ import (
11	11	"os/exec"
12	12	"path/filepath"
13	13	"strings"
	14
	15	"gitbay.org/gitbay/internal/toolpath"
14	16	)
15	17
16	18	// InitBare creates a bare repository with the shared hooks directory wired
		@@ -19,14 +21,14 @@ func InitBare(path, defaultBranch, hooksPath string) error {
19	21	if err := os.MkdirAll(filepath.Dir(path), 0o750); err != nil {
20	22	return err
21	23	}
22		cmd := exec.Command("git", "init", "--bare", "--initial-branch="+defaultBranch, path)
	24	cmd := exec.Command(toolpath.Look("git"), "init", "--bare", "--initial-branch="+defaultBranch, path)
23	25	if out, err := cmd.CombinedOutput(); err != nil {
24	26	return fmt.Errorf("git init: %v\n%s", err, out)
25	27	}
26	28	// An empty hooksPath leaves the bare repo with no hooks — used for
27	29	// companion repos (wikis) that carry no ref policy.
28	30	if hooksPath != "" {
29		cmd = exec.Command("git", "-C", path, "config", "core.hooksPath", hooksPath)
	31	cmd = exec.Command(toolpath.Look("git"), "-C", path, "config", "core.hooksPath", hooksPath)
30	32	if out, err := cmd.CombinedOutput(); err != nil {
31	33	return fmt.Errorf("git config core.hooksPath: %v\n%s", err, out)
32	34	}
		@@ -49,7 +51,7 @@ func Transport(service, repoPath string, stdin io.Reader, stdout, errW io.Writer
49	51	default:
50	52	return fmt.Errorf("unknown service %q", service)
51	53	}
52		cmd := exec.Command("git", args...)
	54	cmd := exec.Command(toolpath.Look("git"), args...)
53	55	cmd.Env = append(os.Environ(), extraEnv...)
54	56	cmd.Stdin = stdin
55	57	cmd.Stdout = stdout
		@@ -61,7 +63,7 @@ func Transport(service, repoPath string, stdin io.Reader, stdout, errW io.Writer
61	63	// dir. It must run with the caller's environment intact so that quarantined
62	64	// objects during pre-receive remain visible.
63	65	func IsAncestor(dir, old, new string) (bool, error) {
64		cmd := exec.Command("git", "-C", dir, "merge-base", "--is-ancestor", old, new)
	66	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "merge-base", "--is-ancestor", old, new)
65	67	err := cmd.Run()
66	68	if err == nil {
67	69	return true, nil
		@@ -87,7 +89,7 @@ func ZeroSHA(s string) bool {
87	89
88	90	// RevList returns up to limit commit SHAs reachable from ref, newest first.
89	91	func RevList(dir, ref string, limit int) ([]string, error) {
90		cmd := exec.Command("git", "-C", dir, "rev-list", fmt.Sprintf("--max-count=%d", limit), "--end-of-options", ref)
	92	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "rev-list", fmt.Sprintf("--max-count=%d", limit), "--end-of-options", ref)
91	93	out, err := cmd.Output()
92	94	if err != nil {
93	95	return nil, fmt.Errorf("rev-list %s: %w", ref, err)
		@@ -105,7 +107,7 @@ func RevList(dir, ref string, limit int) ([]string, error) {
105	107	// touch filePath, newest first. The "--" keeps the path from ever being
106	108	// read as an option or ref.
107	109	func RevListPath(dir, ref, filePath string, limit int) ([]string, error) {
108		cmd := exec.Command("git", "-C", dir, "rev-list",
	110	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "rev-list",
109	111	fmt.Sprintf("--max-count=%d", limit), "--end-of-options", ref, "--", filePath)
110	112	out, err := cmd.Output()
111	113	if err != nil {
		@@ -123,7 +125,7 @@ func RevListPath(dir, ref, filePath string, limit int) ([]string, error) {
123	125	// PeelToCommit resolves a ref or object to its commit — annotated tags
124	126	// peel to the commit they point at.
125	127	func PeelToCommit(dir, ref string) (string, error) {
126		out, err := exec.Command("git", "-C", dir, "rev-parse", "--verify", "--end-of-options", ref+"^{commit}").Output()
	128	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "rev-parse", "--verify", "--end-of-options", ref+"^{commit}").Output()
127	129	if err != nil {
128	130	return "", fmt.Errorf("rev-parse %s^{commit}: %w", ref, err)
129	131	}
		@@ -132,7 +134,7 @@ func PeelToCommit(dir, ref string) (string, error) {
132	134
133	135	// ReadCommit returns the raw commit object bytes.
134	136	func ReadCommit(dir, sha string) ([]byte, error) {
135		cmd := exec.Command("git", "-C", dir, "cat-file", "commit", "--end-of-options", sha)
	137	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "cat-file", "commit", "--end-of-options", sha)
136	138	out, err := cmd.Output()
137	139	if err != nil {
138	140	return nil, fmt.Errorf("cat-file commit %s: %w", sha, err)
		@@ -145,7 +147,7 @@ func ReadCommit(dir, sha string) ([]byte, error) {
145	147	// an interactive caller can watch. extraEnv carries credentials via
146	148	// GIT_ASKPASS; the URL itself must never contain them.
147	149	func FetchMirror(ctx context.Context, dir, url string, errW io.Writer, extraEnv []string) error {
148		cmd := exec.CommandContext(ctx, "git", "-C", dir, "fetch", "--progress", "--no-write-fetch-head", url,
	150	cmd := exec.CommandContext(ctx, toolpath.Look("git"), "-C", dir, "fetch", "--progress", "--no-write-fetch-head", url,
149	151	"+refs/heads/:refs/heads/",
150	152	"+refs/tags/:refs/tags/",
151	153	"+refs/notes/:refs/notes/")
		@@ -168,7 +170,7 @@ func FetchMirror(ctx context.Context, dir, url string, errW io.Writer, extraEnv
168	170	// handshakes. extraEnv carries credentials via GIT_ASKPASS; the URL must
169	171	// never contain them.
170	172	func FetchPullHeads(ctx context.Context, dir, url string, errW io.Writer, extraEnv []string) error {
171		cmd := exec.CommandContext(ctx, "git", "-C", dir, "fetch", "--no-write-fetch-head", "--no-tags",
	173	cmd := exec.CommandContext(ctx, toolpath.Look("git"), "-C", dir, "fetch", "--no-write-fetch-head", "--no-tags",
172	174	url, "+refs/pull//head:refs/gh-pull/")
173	175	cmd.Env = append(os.Environ(), extraEnv...)
174	176	cmd.Stderr = errW
		@@ -180,7 +182,7 @@ func FetchPullHeads(ctx context.Context, dir, url string, errW io.Writer, extraE
180	182
181	183	// RemoteDefaultBranch asks the remote which branch HEAD points at.
182	184	func RemoteDefaultBranch(ctx context.Context, url string, extraEnv []string) (string, error) {
183		cmd := exec.CommandContext(ctx, "git", "ls-remote", "--symref", url, "HEAD")
	185	cmd := exec.CommandContext(ctx, toolpath.Look("git"), "ls-remote", "--symref", url, "HEAD")
184	186	cmd.Env = append(os.Environ(), extraEnv...)
185	187	out, err := cmd.Output()
186	188	if err != nil {
		@@ -199,7 +201,7 @@ func RemoteDefaultBranch(ctx context.Context, url string, extraEnv []string) (st
199	201
200	202	// SetHead points the bare repo's HEAD at a branch.
201	203	func SetHead(dir, branch string) error {
202		cmd := exec.Command("git", "-C", dir, "symbolic-ref", "HEAD", "refs/heads/"+branch)
	204	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "symbolic-ref", "HEAD", "refs/heads/"+branch)
203	205	if out, err := cmd.CombinedOutput(); err != nil {
204	206	return fmt.Errorf("symbolic-ref: %v\n%s", err, out)
205	207	}

internal/gitutil/grep.go +3 −1

		@@ -7,6 +7,8 @@ import (
7	7	"strconv"
8	8	"strings"
9	9	"time"
	10
	11	"gitbay.org/gitbay/internal/toolpath"
10	12	)
11	13
12	14	type GrepMatch struct {
		@@ -23,7 +25,7 @@ func Grep(dir, ref, query string, max int) ([]GrepMatch, error) {
23	25	defer cancel()
24	26	// -z: NUL after the path and the line number, so paths containing
25	27	// ':' parse unambiguously (format: "ref:path\0line\0text\n").
26		cmd := exec.CommandContext(ctx, "git", "-C", dir, "grep", "-nIiF", "-z", "-e", query, "--end-of-options", ref)
	28	cmd := exec.CommandContext(ctx, toolpath.Look("git"), "-C", dir, "grep", "-nIiF", "-z", "-e", query, "--end-of-options", ref)
27	29	out, err := cmd.Output()
28	30	if err != nil {
29	31	if ee, ok := err.(*exec.ExitError); ok && ee.ExitCode() == 1 {

internal/gitutil/lastcommit.go +5 −3

		@@ -6,6 +6,8 @@ import (
6	6	"strconv"
7	7	"strings"
8	8	"time"
	9
	10	"gitbay.org/gitbay/internal/toolpath"
9	11	)
10	12
11	13	// EntryCommit is the newest commit touching one entry of a tree listing.
		@@ -49,7 +51,7 @@ func LastCommits(dir, ref, path string, names []string) map[string]EntryCommit {
49	51	if prefix != "" {
50	52	args = append(args, "--", strings.TrimSuffix(prefix, "/"))
51	53	}
52		cmd := exec.Command("git", args...)
	54	cmd := exec.Command(toolpath.Look("git"), args...)
53	55	stdout, err := cmd.StdoutPipe()
54	56	if err != nil {
55	57	return nil
		@@ -107,7 +109,7 @@ func parseCommitHeader(s string) EntryCommit {
107	109	// TipCommit is the commit at ref, for the bar above a tree listing that
108	110	// answers "who touched this repository last".
109	111	func TipCommit(dir, ref string) EntryCommit {
110		out, err := exec.Command("git", "-C", dir, "log", "-1",
	112	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "log", "-1",
111	113	"--format=%H%x1f%ct%x1f%an%x1f%ae%x1f%s", "--end-of-options", ref).Output()
112	114	if err != nil {
113	115	return EntryCommit{}
		@@ -137,7 +139,7 @@ func entryName(changed, prefix string) (string, bool) {
137	139	// page can report the facts the file listing no longer carries: its size,
138	140	// and whether it is executable or a symlink.
139	141	func StatPath(dir, ref, path string) (TreeEntry, bool) {
140		out, err := exec.Command("git", "-C", dir, "ls-tree", "-l", "--end-of-options", ref, "--", path).Output()
	142	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "ls-tree", "-l", "--end-of-options", ref, "--", path).Output()
141	143	if err != nil {
142	144	return TreeEntry{}, false
143	145	}

internal/gitutil/lfs.go +4 −2

		@@ -7,6 +7,8 @@ import (
7	7	"regexp"
8	8	"strconv"
9	9	"strings"
	10
	11	"gitbay.org/gitbay/internal/toolpath"
10	12	)
11	13
12	14	// lfsPointerMax bounds a pointer file; real ones are around 130 bytes.
		@@ -18,7 +20,7 @@ var lfsOIDLine = regexp.MustCompile(`(?m)^oid sha256:([0-9a-f]{64})$`)
18	20	// anywhere in the repository: every object, not just the reachable ones,
19	21	// since an unreachable blob is still an object gc has not removed.
20	22	func LFSPointerOIDs(dir string) ([]string, error) {
21		list := exec.Command("git", "-C", dir, "cat-file", "--batch-all-objects",
	23	list := exec.Command(toolpath.Look("git"), "-C", dir, "cat-file", "--batch-all-objects",
22	24	"--batch-check=%(objecttype) %(objectsize) %(objectname)")
23	25	out, err := list.Output()
24	26	if err != nil {
		@@ -38,7 +40,7 @@ func LFSPointerOIDs(dir string) ([]string, error) {
38	40	if len(small) == 0 {
39	41	return nil, nil
40	42	}
41		cat := exec.Command("git", "-C", dir, "cat-file", "--batch")
	43	cat := exec.Command(toolpath.Look("git"), "-C", dir, "cat-file", "--batch")
42	44	cat.Stdin = strings.NewReader(strings.Join(small, "\n") + "\n")
43	45	out, err = cat.Output()
44	46	if err != nil {

internal/gitutil/merge.go +22 −20

		@@ -6,13 +6,15 @@ import (
6	6	"os"
7	7	"os/exec"
8	8	"strings"
	9
	10	"gitbay.org/gitbay/internal/toolpath"
9	11	)
10	12
11	13	// FetchInto copies srcRef from srcDir into dstDir as dstRef, forcing the
12	14	// update. Objects are copied, not shared — the destination owns everything
13	15	// afterward, which is what keeps MRs alive when their fork is deleted.
14	16	func FetchInto(dstDir, srcDir, srcRef, dstRef string) error {
15		cmd := exec.Command("git", "-C", dstDir, "fetch", "--quiet", "--no-write-fetch-head",
	17	cmd := exec.Command(toolpath.Look("git"), "-C", dstDir, "fetch", "--quiet", "--no-write-fetch-head",
16	18	srcDir, "+"+srcRef+":"+dstRef)
17	19	if out, err := cmd.CombinedOutput(); err != nil {
18	20	return fmt.Errorf("fetch %s from %s: %v\n%s", srcRef, srcDir, err, out)
		@@ -28,7 +30,7 @@ func UpdateRefCAS(dir, ref, newSHA, oldSHA string) error {
28	30	if oldSHA != "" {
29	31	args = append(args, oldSHA)
30	32	}
31		cmd := exec.Command("git", args...)
	33	cmd := exec.Command(toolpath.Look("git"), args...)
32	34	if out, err := cmd.CombinedOutput(); err != nil {
33	35	return fmt.Errorf("update-ref %s: %v\n%s", ref, err, out)
34	36	}
		@@ -36,7 +38,7 @@ func UpdateRefCAS(dir, ref, newSHA, oldSHA string) error {
36	38	}
37	39
38	40	func DeleteRef(dir, ref string) error {
39		cmd := exec.Command("git", "-C", dir, "update-ref", "-d", ref)
	41	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "update-ref", "-d", ref)
40	42	if out, err := cmd.CombinedOutput(); err != nil {
41	43	return fmt.Errorf("delete-ref %s: %v\n%s", ref, err, out)
42	44	}
		@@ -45,7 +47,7 @@ func DeleteRef(dir, ref string) error {
45	47
46	48	// RevListRange returns commits in old..new, newest first.
47	49	func RevListRange(dir, old, new string) ([]string, error) {
48		cmd := exec.Command("git", "-C", dir, "rev-list", "--end-of-options", new, "^"+old)
	50	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "rev-list", "--end-of-options", new, "^"+old)
49	51	out, err := cmd.Output()
50	52	if err != nil {
51	53	return nil, fmt.Errorf("rev-list %s..%s: %w", old, new, err)
		@@ -62,7 +64,7 @@ func RevListRange(dir, old, new string) ([]string, error) {
62	64	// MergeTree performs a real merge of ours and theirs, returning the merged
63	65	// tree id. conflict=true means the merge cannot be done automatically.
64	66	func MergeTree(dir, ours, theirs string) (tree string, conflict bool, err error) {
65		cmd := exec.Command("git", "-C", dir, "merge-tree", "--write-tree", "--end-of-options", ours, theirs)
	67	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "merge-tree", "--write-tree", "--end-of-options", ours, theirs)
66	68	out, runErr := cmd.Output()
67	69	tree = strings.TrimSpace(strings.SplitN(string(out), "\n", 2)[0])
68	70	if runErr != nil {
		@@ -81,7 +83,7 @@ func CommitTree(dir, tree string, parents []string, name, email, message string)
81	83	for _, p := range parents {
82	84	args = append(args, "-p", p)
83	85	}
84		cmd := exec.Command("git", args...)
	86	cmd := exec.Command(toolpath.Look("git"), args...)
85	87	cmd.Env = append(os.Environ(),
86	88	"GIT_AUTHOR_NAME="+name, "GIT_AUTHOR_EMAIL="+email,
87	89	"GIT_COMMITTER_NAME="+name, "GIT_COMMITTER_EMAIL="+email,
		@@ -98,7 +100,7 @@ func CommitTree(dir, tree string, parents []string, name, email, message string)
98	100	// truncated says whether it was cut, so the caller can say so instead of
99	101	// rendering a hunk that ends mid-line (#117).
100	102	func Diff(dir, old, new string, limit int64) (patch string, truncated bool, err error) {
101		cmd := exec.Command("git", "-C", dir, "diff", "--stat", "--patch", "--end-of-options", old, new)
	103	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "diff", "--stat", "--patch", "--end-of-options", old, new)
102	104	out, err := cmd.Output()
103	105	if err != nil {
104	106	return "", false, fmt.Errorf("diff: %w", err)
		@@ -122,7 +124,7 @@ func cutAtLine(out []byte, limit int64) ([]byte, bool) {
122	124
123	125	// MergeBase returns the best common ancestor, or an error if none exists.
124	126	func MergeBase(dir, a, b string) (string, error) {
125		cmd := exec.Command("git", "-C", dir, "merge-base", "--end-of-options", a, b)
	127	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "merge-base", "--end-of-options", a, b)
126	128	out, err := cmd.Output()
127	129	if err != nil {
128	130	return "", fmt.Errorf("no common history between %s and %s", a, b)
		@@ -141,7 +143,7 @@ func CommitFileChange(dir, branch, path string, content []byte, name, email, mes
141	143	}
142	144
143	145	// Hash the new blob.
144		hb := exec.Command("git", "-C", dir, "hash-object", "-w", "--stdin")
	146	hb := exec.Command(toolpath.Look("git"), "-C", dir, "hash-object", "-w", "--stdin")
145	147	hb.Stdin = strings.NewReader(string(content))
146	148	out, err := hb.Output()
147	149	if err != nil {
		@@ -159,17 +161,17 @@ func CommitFileChange(dir, branch, path string, content []byte, name, email, mes
159	161	defer os.Remove(idx.Name())
160	162	env := append(os.Environ(), "GIT_INDEX_FILE="+idx.Name())
161	163
162		rt := exec.Command("git", "-C", dir, "read-tree", parent+"^{tree}")
	164	rt := exec.Command(toolpath.Look("git"), "-C", dir, "read-tree", parent+"^{tree}")
163	165	rt.Env = env
164	166	if out, err := rt.CombinedOutput(); err != nil {
165	167	return "", fmt.Errorf("read-tree: %v\n%s", err, out)
166	168	}
167		ui := exec.Command("git", "-C", dir, "update-index", "--add", "--cacheinfo", "100644,"+blob+","+path)
	169	ui := exec.Command(toolpath.Look("git"), "-C", dir, "update-index", "--add", "--cacheinfo", "100644,"+blob+","+path)
168	170	ui.Env = env
169	171	if out, err := ui.CombinedOutput(); err != nil {
170	172	return "", fmt.Errorf("update-index: %v\n%s", err, out)
171	173	}
172		wt := exec.Command("git", "-C", dir, "write-tree")
	174	wt := exec.Command(toolpath.Look("git"), "-C", dir, "write-tree")
173	175	wt.Env = env
174	176	out, err = wt.Output()
175	177	if err != nil {
		@@ -189,7 +191,7 @@ func CommitFileChange(dir, branch, path string, content []byte, name, email, mes
189	191
190	192	// CommitParents returns the parent SHAs of a commit.
191	193	func CommitParents(dir, sha string) ([]string, error) {
192		out, err := exec.Command("git", "-C", dir, "rev-list", "--parents", "-n1", "--end-of-options", sha).Output()
	194	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "rev-list", "--parents", "-n1", "--end-of-options", sha).Output()
193	195	if err != nil {
194	196	return nil, fmt.Errorf("rev-list --parents %s: %w", sha, err)
195	197	}
		@@ -202,7 +204,7 @@ func CommitParents(dir, sha string) ([]string, error) {
202	204
203	205	// AuthorIdent returns a commit's author name, email, and ISO date.
204	206	func AuthorIdent(dir, sha string) (name, email, date string, err error) {
205		out, err := exec.Command("git", "-C", dir, "log", "-1", "--format=%an%x1f%ae%x1f%aI", "--end-of-options", sha).Output()
	207	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "log", "-1", "--format=%an%x1f%ae%x1f%aI", "--end-of-options", sha).Output()
206	208	if err != nil {
207	209	return "", "", "", fmt.Errorf("log %s: %w", sha, err)
208	210	}
		@@ -215,7 +217,7 @@ func AuthorIdent(dir, sha string) (name, email, date string, err error) {
215	217
216	218	// CommitMessage returns a commit's full message.
217	219	func CommitMessage(dir, sha string) (string, error) {
218		out, err := exec.Command("git", "-C", dir, "log", "-1", "--format=%B", "--end-of-options", sha).Output()
	220	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "log", "-1", "--format=%B", "--end-of-options", sha).Output()
219	221	if err != nil {
220	222	return "", fmt.Errorf("log %s: %w", sha, err)
221	223	}
		@@ -225,7 +227,7 @@ func CommitMessage(dir, sha string) (string, error) {
225	227	// MergeTreeOnto replays commit's changes (relative to base) onto onto,
226	228	// returning the resulting tree. conflict=true when it cannot apply cleanly.
227	229	func MergeTreeOnto(dir, base, onto, commit string) (tree string, conflict bool, err error) {
228		cmd := exec.Command("git", "-C", dir, "merge-tree", "--write-tree", "--merge-base="+base, "--end-of-options", onto, commit)
	230	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "merge-tree", "--write-tree", "--merge-base="+base, "--end-of-options", onto, commit)
229	231	out, runErr := cmd.Output()
230	232	tree = strings.TrimSpace(strings.SplitN(string(out), "\n", 2)[0])
231	233	if runErr != nil {
		@@ -245,7 +247,7 @@ func CommitTreeIdent(dir, tree string, parents []string,
245	247	for _, p := range parents {
246	248	args = append(args, "-p", p)
247	249	}
248		cmd := exec.Command("git", args...)
	250	cmd := exec.Command(toolpath.Look("git"), args...)
249	251	env := append(os.Environ(),
250	252	"GIT_AUTHOR_NAME="+authorName, "GIT_AUTHOR_EMAIL="+authorEmail,
251	253	"GIT_COMMITTER_NAME="+committerName, "GIT_COMMITTER_EMAIL="+committerEmail,
		@@ -263,7 +265,7 @@ func CommitTreeIdent(dir, tree string, parents []string,
263	265
264	266	// ResolveTree returns the tree id of a commit.
265	267	func ResolveTree(dir, sha string) (string, error) {
266		out, err := exec.Command("git", "-C", dir, "rev-parse", "--verify", "--end-of-options", sha+"^{tree}").Output()
	268	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "rev-parse", "--verify", "--end-of-options", sha+"^{tree}").Output()
267	269	if err != nil {
268	270	return "", fmt.Errorf("rev-parse %s^{tree}: %w", sha, err)
269	271	}
		@@ -272,7 +274,7 @@ func ResolveTree(dir, sha string) (string, error) {
272	274
273	275	// DiffFiles lists the paths changed between old and new.
274	276	func DiffFiles(dir, old, new string) ([]string, error) {
275		out, err := exec.Command("git", "-C", dir, "diff", "--name-only", "--end-of-options", old, new).Output()
	277	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "diff", "--name-only", "--end-of-options", old, new).Output()
276	278	if err != nil {
277	279	return nil, fmt.Errorf("diff --name-only: %w", err)
278	280	}
		@@ -304,7 +306,7 @@ func DiffFiles(dir, old, new string) ([]string, error) {
304	306	// tells a reviewer nothing. It pairs at 80, and two genuinely unrelated
305	307	// commits are still left unpaired there; both measured.
306	308	func RangeDiff(dir, oldBase, oldHead, newBase, newHead string, limit int64) (patch string, truncated bool, err error) {
307		cmd := exec.Command("git", "-C", dir, "range-diff", "--creation-factor=80", "--end-of-options",
	309	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "range-diff", "--creation-factor=80", "--end-of-options",
308	310	oldBase+".."+oldHead, newBase+".."+newHead)
309	311	out, err := cmd.Output()
310	312	if err != nil {

internal/gitutil/messages.go +7 −5

		@@ -4,6 +4,8 @@ import (
4	4	"fmt"
5	5	"os/exec"
6	6	"strings"
	7
	8	"gitbay.org/gitbay/internal/toolpath"
7	9	)
8	10
9	11	const zeroSHA = "0000000000000000000000000000000000000000"
		@@ -22,7 +24,7 @@ func RevListAuthors(dir, old, new string, max int) ([]CommitAuthor, error) {
22	24	if old != "" && old != zeroSHA {
23	25	args = append(args, "^"+old)
24	26	}
25		out, err := exec.Command("git", args...).Output()
	27	out, err := exec.Command(toolpath.Look("git"), args...).Output()
26	28	if err != nil {
27	29	return nil, fmt.Errorf("rev-list authors: %w", err)
28	30	}
		@@ -39,7 +41,7 @@ func RevListAuthors(dir, old, new string, max int) ([]CommitAuthor, error) {
39	41
40	42	// Parents returns a commit's parent shas.
41	43	func Parents(dir, sha string) []string {
42		out, err := exec.Command("git", "-C", dir, "log", "-1", "--format=%P", sha).Output()
	44	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "log", "-1", "--format=%P", sha).Output()
43	45	if err != nil {
44	46	return nil
45	47	}
		@@ -49,7 +51,7 @@ func Parents(dir, sha string) []string {
49	51	// LastCommitDate returns the committer date (YYYY-MM-DD) of the ref tip,
50	52	// or "" for empty repos.
51	53	func LastCommitDate(dir, ref string) string {
52		out, err := exec.Command("git", "-C", dir, "log", "-1", "--format=%cs", ref).Output()
	54	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "log", "-1", "--format=%cs", ref).Output()
53	55	if err != nil {
54	56	return ""
55	57	}
		@@ -58,7 +60,7 @@ func LastCommitDate(dir, ref string) string {
58	60
59	61	// HasCommit reports whether sha names a commit object present in dir.
60	62	func HasCommit(dir, sha string) bool {
61		return exec.Command("git", "-C", dir, "cat-file", "-e", sha+"^{commit}").Run() == nil
	63	return exec.Command(toolpath.Look("git"), "-C", dir, "cat-file", "-e", sha+"^{commit}").Run() == nil
62	64	}
63	65
64	66	type CommitMsg struct {
		@@ -76,7 +78,7 @@ func RevListMessages(dir, old, new string, max int) ([]CommitMsg, error) {
76	78	if old != "" && old != zeroSHA {
77	79	args = append(args, "^"+old)
78	80	}
79		out, err := exec.Command("git", args...).Output()
	81	out, err := exec.Command(toolpath.Look("git"), args...).Output()
80	82	if err != nil {
81	83	return nil, fmt.Errorf("rev-list messages: %w", err)
82	84	}

internal/gitutil/read.go +8 −6

		@@ -10,6 +10,8 @@ import (
10	10	"strconv"
11	11	"strings"
12	12	"time"
	13
	14	"gitbay.org/gitbay/internal/toolpath"
13	15	)
14	16
15	17	type TreeEntry struct {
		@@ -26,7 +28,7 @@ func ListTree(dir, ref, path string) ([]TreeEntry, error) {
26	28	if path != "" {
27	29	spec = ref + ":" + path
28	30	}
29		cmd := exec.Command("git", "-C", dir, "ls-tree", "-l", "--end-of-options", spec)
	31	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "ls-tree", "-l", "--end-of-options", spec)
30	32	out, err := cmd.Output()
31	33	if err != nil {
32	34	return nil, fmt.Errorf("ls-tree %s: %w", spec, err)
		@@ -56,7 +58,7 @@ func ListTree(dir, ref, path string) ([]TreeEntry, error) {
56	58
57	59	// ReadBlob returns the contents of ref:path, capped at limit bytes.
58	60	func ReadBlob(dir, ref, path string, limit int64) ([]byte, error) {
59		cmd := exec.Command("git", "-C", dir, "cat-file", "blob", "--end-of-options", ref+":"+path)
	61	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "cat-file", "blob", "--end-of-options", ref+":"+path)
60	62	stdout, err := cmd.StdoutPipe()
61	63	if err != nil {
62	64	return nil, err
		@@ -74,7 +76,7 @@ func ReadBlob(dir, ref, path string, limit int64) ([]byte, error) {
74	76
75	77	// ResolveRef resolves a ref or sha to a full commit sha; errors if absent.
76	78	func ResolveRef(dir, ref string) (string, error) {
77		cmd := exec.Command("git", "-C", dir, "rev-parse", "--verify", "--quiet", "--end-of-options", ref+"^{commit}")
	79	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "rev-parse", "--verify", "--quiet", "--end-of-options", ref+"^{commit}")
78	80	out, err := cmd.Output()
79	81	if err != nil {
80	82	return "", fmt.Errorf("unknown ref %q", ref)
		@@ -89,7 +91,7 @@ type Ref struct {
89	91
90	92	// Refs lists branches or tags; kind is "heads" or "tags".
91	93	func Refs(dir, kind string) ([]Ref, error) {
92		cmd := exec.Command("git", "-C", dir, "for-each-ref",
	94	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "for-each-ref",
93	95	"--format=%(refname:short) %(objectname)", "refs/"+kind)
94	96	out, err := cmd.Output()
95	97	if err != nil {
		@@ -118,7 +120,7 @@ var ErrArchiveTooLarge = errors.New("archive exceeds the size limit")
118	120	func Archive(dir, ref, prefix string, w io.Writer) error {
119	121	ctx, cancel := context.WithTimeout(context.Background(), archiveTimeout)
120	122	defer cancel()
121		cmd := exec.CommandContext(ctx, "git", "-C", dir, "archive", "--format=tar.gz", "--prefix="+prefix+"/", "--end-of-options", ref)
	123	cmd := exec.CommandContext(ctx, toolpath.Look("git"), "-C", dir, "archive", "--format=tar.gz", "--prefix="+prefix+"/", "--end-of-options", ref)
122	124	lw := &cappedWriter{w: w, left: MaxArchiveBytes, stop: cancel}
123	125	cmd.Stdout = lw
124	126	err := cmd.Run()
		@@ -152,7 +154,7 @@ func (c *cappedWriter) Write(p []byte) (int, error) {
152	154
153	155	// ShowPatch returns the stat+patch text for one commit.
154	156	func ShowPatch(dir, sha string, limit int64) (patch string, truncated bool, err error) {
155		cmd := exec.Command("git", "-C", dir, "show", "--stat", "--patch", "--format=", "--end-of-options", sha)
	157	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "show", "--stat", "--patch", "--format=", "--end-of-options", sha)
156	158	stdout, err := cmd.StdoutPipe()
157	159	if err != nil {
158	160	return "", false, err

internal/mirror/mirror.go +2 −1

		@@ -17,6 +17,7 @@ import (
17	17	"gitbay.org/gitbay/internal/config"
18	18	"gitbay.org/gitbay/internal/control"
19	19	"gitbay.org/gitbay/internal/store"
	20	"gitbay.org/gitbay/internal/toolpath"
20	21	)
21	22
22	23	const askpassScript = `#!/bin/sh
		@@ -106,7 +107,7 @@ func (w *Worker) sync(m store.Mirror) error {
106	107	args = []string{"-C", dir, "fetch", "--prune", m.URL,
107	108	"+refs/heads/:refs/heads/", "+refs/tags/:refs/tags/"}
108	109	}
109		cmd := exec.CommandContext(ctx, "git", args...)
	110	cmd := exec.CommandContext(ctx, toolpath.Look("git"), args...)
110	111	cmd.Env = env
111	112	if out, err := cmd.CombinedOutput(); err != nil {
112	113	return fmt.Errorf("git %s: %v: %.300s", m.Direction, err, out)

internal/toolpath/toolpath.go added +64

		@@ -0,0 +1,64 @@
	1	// Package toolpath resolves the external programs gitbay runs — git, ssh,
	2	// sh — to absolute paths once, when the process starts, instead of
	3	// letting the kernel search PATH on every spawn.
	4	//
	5	// Three things it buys, in the order they matter.
	6	//
	7	// A missing tool becomes one legible failure at start-up rather than an
	8	// opaque one at the first push, on whichever request happened to need it.
	9	//
	10	// The command a long-lived daemon runs is then fixed for its lifetime,
	11	// decided from the environment it was started with rather than resolved
	12	// afresh each time. gitbayd and gitbay-runner both run under systemd with
	13	// a root-owned PATH and a read-only /usr, so a search was never
	14	// attacker-influenced in a shipped configuration — but a spawn that
	15	// cannot be redirected is one fewer thing to reason about, and it is what
	16	// the scanner asks for (go:S4036).
	17	//
	18	// And the lookup leaves the hot path: a repository page can spawn several
	19	// git processes, and each was searching PATH from scratch.
	20	package toolpath
	21
	22	import (
	23	"fmt"
	24	"os/exec"
	25	"strings"
	26	"sync"
	27	)
	28
	29	var (
	30	mu sync.Mutex
	31	cache = map[string]string{}
	32	missing []string
	33	)
	34
	35	// Look returns the absolute path to name, or name itself when it is not
	36	// on PATH. Returning the bare name keeps the failure where it already
	37	// was — exec reporting it — for anything that runs before Verify, and for
	38	// a tool a particular binary never actually uses.
	39	func Look(name string) string {
	40	mu.Lock()
	41	defer mu.Unlock()
	42	if p, ok := cache[name]; ok {
	43	return p
	44	}
	45	p, err := exec.LookPath(name)
	46	if err != nil {
	47	p = name
	48	missing = append(missing, name)
	49	}
	50	cache[name] = p
	51	return p
	52	}
	53
	54	// Verify reports the tools that were asked for and not found, so a daemon
	55	// can refuse to start rather than fail on its first request. Call it after
	56	// the packages that need tools are initialised.
	57	func Verify() error {
	58	mu.Lock()
	59	defer mu.Unlock()
	60	if len(missing) == 0 {
	61	return nil
	62	}
	63	return fmt.Errorf("not found on PATH: %s", strings.Join(missing, ", "))
	64	}

internal/toolpath/toolpath_test.go added +47

		@@ -0,0 +1,47 @@
	1	package toolpath
	2
	3	import (
	4	"os/exec"
	5	"path/filepath"
	6	"strings"
	7	"testing"
	8	)
	9
	10	func TestLookResolvesToAnAbsolutePath(t *testing.T) {
	11	got := Look("go")
	12	if !filepath.IsAbs(got) {
	13	t.Fatalf("Look(go) = %q, want an absolute path", got)
	14	}
	15	want, err := exec.LookPath("go")
	16	if err != nil {
	17	t.Fatal(err)
	18	}
	19	if got != want {
	20	t.Errorf("Look(go) = %q, want %q", got, want)
	21	}
	22	}
	23
	24	// A second call must not search again: resolving once is the point, and a
	25	// daemon that re-resolved would follow a PATH that changed under it.
	26	func TestLookIsResolvedOnce(t *testing.T) {
	27	first := Look("go")
	28	if second := Look("go"); second != first {
	29	t.Errorf("Look(go) returned %q then %q", first, second)
	30	}
	31	}
	32
	33	// An absent tool falls back to the bare name so exec reports it the way
	34	// it always did, and Verify names it.
	35	func TestMissingToolFallsBackAndIsReported(t *testing.T) {
	36	const name = "gitbay-no-such-tool-exists"
	37	if got := Look(name); got != name {
	38	t.Errorf("Look(%q) = %q, want the bare name back", name, got)
	39	}
	40	err := Verify()
	41	if err == nil {
	42	t.Fatal("Verify found nothing missing after an unresolvable lookup")
	43	}
	44	if !strings.Contains(err.Error(), name) {
	45	t.Errorf("Verify error %q does not name the missing tool", err)
	46	}
	47	}

Commit cabf60cf5b

Commit `cabf60cf5b`