exec: resolve git and ssh once, at start-up !255

merged merged by cmc on 2026-09-05 00:02 UTC · krz/gitbay:sonar-toolpath into main

20 files changed, +216 −72

Layout: unified · split

cmd/gitbay-runner/main.go +5 −4

 	"time"
 	"gitbay.org/gitbay/internal/buildinfo"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 type job struct {
 	defer os.RemoveAll(dir)
 	// One long-lived `runner log` session receives the whole stream.
-	logCmd := exec.Command("ssh", append(r.sshOpts, r.remote, "runner", "log", fmt.Sprint(j.ID))...)
+	logCmd := exec.Command(toolpath.Look("ssh"), append(r.sshOpts, r.remote, "runner", "log", fmt.Sprint(j.ID))...)
 	pipe, err := logCmd.StdinPipe()
 	if err != nil {
 		log.Printf("build %d: log pipe: %v", j.ID, err)
 	}
 	steps = append(steps, []string{"-C", dir, "checkout", "-q", j.SHA})
 	for _, args := range steps {
-		cmd := exec.Command("git", args...)
+		cmd := exec.Command(toolpath.Look("git"), args...)
 		cmd.Env = append(os.Environ(), "GIT_SSH_COMMAND="+gitSSH, "GIT_TERMINAL_PROMPT=0")
 		cmd.Stdout, cmd.Stderr = sink, sink
 		if ok, why := runStep(cmd, deadline); !ok {
 	for _, step := range j.Steps {
 		fmt.Fprintf(sink, "$ %s\n", step)
-		cmd := exec.Command("sh", "-c", step)
+		cmd := exec.Command(toolpath.Look("sh"), "-c", step)
 		cmd.Dir = dir
 		cmd.Env = append(os.Environ(),
 			"GITBAY_REPO="+j.Repo, "GITBAY_SHA="+j.SHA, "GITBAY_REF="+j.Ref, "GITBAY_JOB="+j.Job, "CI=true")
 // ssh runs one control command against the server and returns stdout.
 func (r *runner) ssh(stdin io.Reader, args ...string) (string, error) {
-	cmd := exec.Command("ssh", append(append(r.sshOpts, r.remote), args...)...)
+	cmd := exec.Command(toolpath.Look("ssh"), append(append(r.sshOpts, r.remote), args...)...)
 	if stdin != nil {
 		cmd.Stdin = stdin
 	}

cmd/gitbay/local.go +5 −4

 	"gitbay.org/gitbay/internal/cliconfig"
 	"gitbay.org/gitbay/internal/protocol"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 // hasBodyFlag reports whether args already carry body/message input.
 	fmt.Fprintf(f, "\n# Write the %s body above. Lines starting with '#' are ignored.\n# Save an empty file to skip the body.\n", kind)
 	f.Close()
-	ed := exec.Command("sh", "-c", editor+" "+shellQuote(f.Name()))
+	ed := exec.Command(toolpath.Look("sh"), "-c", editor+" "+shellQuote(f.Name()))
 	ed.Stdin, ed.Stdout, ed.Stderr = os.Stdin, os.Stdout, os.Stderr
 	if err := ed.Run(); err != nil {
 		return nil, nil, false, fmt.Errorf("editor: %w", err)
 }
 func runGitLocal(args ...string) int {
-	cmd := exec.Command("git", args...)
+	cmd := exec.Command(toolpath.Look("git"), args...)
 	cmd.Stdin, cmd.Stdout, cmd.Stderr = os.Stdin, os.Stdout, os.Stderr
 	if err := cmd.Run(); err != nil {
 		if ee, ok := err.(*exec.ExitError); ok {
 	args := sshArgs(t.inst)
 	quoted := quoteAll(serverArgv)
 	args = append(args, t.inst.SSHUser()+"@"+t.inst.Host, "--", strings.Join(quoted, " "))
-	cmd := exec.Command("ssh", args...)
+	cmd := exec.Command(toolpath.Look("ssh"), args...)
 	cmd.Stderr = os.Stderr
 	out, err := cmd.Output()
 	if err != nil {
 // currentBranch is the checked-out branch of the working directory's
 // clone, or "" outside a clone or on a detached HEAD.
 func currentBranch() string {
-	out, err := exec.Command("git", "symbolic-ref", "--quiet", "--short", "HEAD").Output()
+	out, err := exec.Command(toolpath.Look("git"), "symbolic-ref", "--quiet", "--short", "HEAD").Output()
 	if err != nil {
 		return ""
 	}

cmd/gitbay/migrate.go +4 −3

 	"github.com/spf13/cobra"
 	"gitbay.org/gitbay/internal/protocol"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 func migrateCmd() *cobra.Command {
 	}
 	args = append(args, "git@"+host, "--")
 	args = append(args, extra...)
-	return exec.Command("ssh", args...)
+	return exec.Command(toolpath.Look("ssh"), args...)
 }
 func runMigrate(from string, fromPort int) int {
 		if fromPort != 0 && fromPort != 22 {
 			srcURL = fmt.Sprintf("ssh://git@%s:%d/%s.git", from, fromPort, repoPath)
 		}
-		clone := exec.Command("git", "clone", "--quiet", "--mirror", srcURL, tmp+"/r")
+		clone := exec.Command(toolpath.Look("git"), "clone", "--quiet", "--mirror", srcURL, tmp+"/r")
 		clone.Stderr = os.Stderr
 		if err := clone.Run(); err != nil {
 			fmt.Fprintf(os.Stderr, "gitbay: cloning %s failed; fix and re-run migrate (it resumes)\n", repoPath)
 			os.RemoveAll(tmp)
 			return protocol.ExitFailure
 		}
-		push := exec.Command("git", "-C", tmp+"/r", "push", "--quiet", t.inst.CloneURL(repoPath),
+		push := exec.Command(toolpath.Look("git"), "-C", tmp+"/r", "push", "--quiet", t.inst.CloneURL(repoPath),
 			"+refs/heads/*:refs/heads/*", "+refs/tags/*:refs/tags/*")
 		if len(t.inst.SSHOptions) > 0 {
 			push.Env = append(os.Environ(), "GIT_SSH_COMMAND=ssh "+strings.Join(quoteAll(t.inst.SSHOptions), " "))

cmd/gitbay/ssh.go +4 −3

 	"gitbay.org/gitbay/internal/cliconfig"
 	"gitbay.org/gitbay/internal/protocol"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 // context is the resolved target for a command: which instance to talk to
 }
 func originURL() string {
-	out, err := exec.Command("git", "remote", "get-url", "origin").Output()
+	out, err := exec.Command(toolpath.Look("git"), "remote", "get-url", "origin").Output()
 	if err != nil {
 		return ""
 	}
 	}
 	args = append(args, t.inst.SSHUser()+"@"+t.inst.Host, "--", strings.Join(quoted, " "))
-	cmd := exec.Command("ssh", args...)
+	cmd := exec.Command(toolpath.Look("ssh"), args...)
 	cmd.Stdin = stdin
 	cmd.Stdout = os.Stdout
 	cmd.Stderr = os.Stderr
 		quoted[i] = shellQuote(a)
 	}
 	args = append(args, t.inst.SSHUser()+"@"+t.inst.Host, "--", strings.Join(quoted, " "))
-	out, err := exec.Command("ssh", args...).Output()
+	out, err := exec.Command(toolpath.Look("ssh"), args...).Output()
 	if err != nil {
 		code := protocol.ExitProtocol
 		if ee, ok := err.(*exec.ExitError); ok && ee.ExitCode() != 255 {

cmd/gitbayd/hook.go +3 −2

 	"gitbay.org/gitbay/internal/gitutil"
 	"gitbay.org/gitbay/internal/hookd"
 	"gitbay.org/gitbay/internal/policy"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 // incomingSHAs lists the commits this push introduces, in order, without
 			continue
 		}
 		// Everything reachable from the new tip that no existing ref has.
-		raw, err := exec.Command("git", "rev-list", u.New, "--not", "--all").Output()
+		raw, err := exec.Command(toolpath.Look("git"), "rev-list", u.New, "--not", "--all").Output()
 		if err != nil {
 			return nil, fmt.Errorf("rev-list %s: %w", u.New, err)
 		}
 	// part-way through a large push leaves git blocked writing into a
 	// pipe nobody is reading and Wait blocked on git.
 	ctx, cancel := context.WithCancel(context.Background())
-	cmd := exec.CommandContext(ctx, "git", "cat-file", "--batch")
+	cmd := exec.CommandContext(ctx, toolpath.Look("git"), "cat-file", "--batch")
 	stdin, err := cmd.StdinPipe()
 	if err != nil {
 		cancel()

cmd/gitbayd/main.go +7

 	"gitbay.org/gitbay/internal/notify"
 	"gitbay.org/gitbay/internal/sshd"
 	"gitbay.org/gitbay/internal/store"
+	"gitbay.org/gitbay/internal/toolpath"
 	"gitbay.org/gitbay/internal/webhook"
 )
 			// First line of every run: the journal then says which commit is
 			// serving, without rebuilding the binary to find out.
 			logBuild()
+			// The tools this daemon shells out to are resolved once, at
+			// package init. Say so now rather than failing on whichever
+			// request first needed git.
+			if err := toolpath.Verify(); err != nil {
+				return fmt.Errorf("required tools missing: %w", err)
+			}
 			cfg, err := config.Load(configPath)
 			if err != nil {
 				return err

cmd/gitbayd/maint.go +2 −1

 	"gitbay.org/gitbay/internal/gitutil"
 	"gitbay.org/gitbay/internal/lfs"
 	"gitbay.org/gitbay/internal/store"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 func gcCmd() *cobra.Command {
 				if aggressive {
 					gcArgs = append(gcArgs, "--aggressive")
 				}
-				if out, err := exec.Command("git", gcArgs...).CombinedOutput(); err != nil {
+				if out, err := exec.Command(toolpath.Look("git"), gcArgs...).CombinedOutput(); err != nil {
 					fmt.Fprintf(os.Stderr, "%s: gc failed: %v\n%s", r.Path(), err, out)
 					continue
 				}

internal/gitd/gitd.go +2 −1

 	"gitbay.org/gitbay/internal/config"
 	"gitbay.org/gitbay/internal/control"
 	"gitbay.org/gitbay/internal/store"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 type Server struct {
 	}
 	dir := control.RepoDir(s.cfg.Server.Root, repo.OwnerName, repo.Name)
-	cmd := exec.Command("git", "upload-pack", dir)
+	cmd := exec.Command(toolpath.Look("git"), "upload-pack", dir)
 	cmd.Env = append(os.Environ(), protoEnv...)
 	cmd.Stdin = conn
 	cmd.Stdout = conn

internal/gitutil/blame.go +3 −1

 	"os/exec"
 	"strconv"
 	"strings"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 // BlameHunk is a run of consecutive lines attributed to one commit.
 	if err != nil {
 		return nil, err
 	}
-	cmd := exec.Command("git", "-C", dir, "blame", "--porcelain",
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "blame", "--porcelain",
 		fmt.Sprintf("-L%d,%d", start, end), sha, "--", path)
 	out, err := cmd.Output()
 	if err != nil {

internal/gitutil/facts.go +5 −3

 	"sort"
 	"strconv"
 	"strings"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 // CountCommits returns the number of commits reachable from ref, or 0 when
 // the ref does not resolve (an empty repository).
 func CountCommits(dir, ref string) int {
-	out, err := exec.Command("git", "-C", dir, "rev-list", "--count", "--end-of-options", ref).Output()
+	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "rev-list", "--count", "--end-of-options", ref).Output()
 	if err != nil {
 		return 0
 	}
 // tie back to an account, after the repository's own .mailmap has had its
 // say — a bare repo resolves that from HEAD:.mailmap with no config.
 func Contributors(dir, ref string) []Contributor {
-	out, err := exec.Command("git", "-C", dir, "log",
+	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "log",
 		"--use-mailmap", "--format=%aN%x01%aE", "--end-of-options", ref).Output()
 	if err != nil {
 		return nil
 // largest first, keyed by the extension map the caller supplies. Only
 // blobs count; git's own metadata does not.
 func Languages(dir, ref string, lang func(path string) string) []Language {
-	out, err := exec.Command("git", "-C", dir, "ls-tree", "-r", "-l", "--full-name", "--end-of-options", ref).Output()
+	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "ls-tree", "-r", "-l", "--full-name", "--end-of-options", ref).Output()
 	if err != nil {
 		return nil
 	}

internal/gitutil/gitutil.go +14 −12

 	"os/exec"
 	"path/filepath"
 	"strings"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 // InitBare creates a bare repository with the shared hooks directory wired
 	if err := os.MkdirAll(filepath.Dir(path), 0o750); err != nil {
 		return err
 	}
-	cmd := exec.Command("git", "init", "--bare", "--initial-branch="+defaultBranch, path)
+	cmd := exec.Command(toolpath.Look("git"), "init", "--bare", "--initial-branch="+defaultBranch, path)
 	if out, err := cmd.CombinedOutput(); err != nil {
 		return fmt.Errorf("git init: %v\n%s", err, out)
 	}
 	// An empty hooksPath leaves the bare repo with no hooks — used for
 	// companion repos (wikis) that carry no ref policy.
 	if hooksPath != "" {
-		cmd = exec.Command("git", "-C", path, "config", "core.hooksPath", hooksPath)
+		cmd = exec.Command(toolpath.Look("git"), "-C", path, "config", "core.hooksPath", hooksPath)
 		if out, err := cmd.CombinedOutput(); err != nil {
 			return fmt.Errorf("git config core.hooksPath: %v\n%s", err, out)
 		}
 	default:
 		return fmt.Errorf("unknown service %q", service)
 	}
-	cmd := exec.Command("git", args...)
+	cmd := exec.Command(toolpath.Look("git"), args...)
 	cmd.Env = append(os.Environ(), extraEnv...)
 	cmd.Stdin = stdin
 	cmd.Stdout = stdout
 // dir. It must run with the caller's environment intact so that quarantined
 // objects during pre-receive remain visible.
 func IsAncestor(dir, old, new string) (bool, error) {
-	cmd := exec.Command("git", "-C", dir, "merge-base", "--is-ancestor", old, new)
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "merge-base", "--is-ancestor", old, new)
 	err := cmd.Run()
 	if err == nil {
 		return true, nil
 // RevList returns up to limit commit SHAs reachable from ref, newest first.
 func RevList(dir, ref string, limit int) ([]string, error) {
-	cmd := exec.Command("git", "-C", dir, "rev-list", fmt.Sprintf("--max-count=%d", limit), "--end-of-options", ref)
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "rev-list", fmt.Sprintf("--max-count=%d", limit), "--end-of-options", ref)
 	out, err := cmd.Output()
 	if err != nil {
 		return nil, fmt.Errorf("rev-list %s: %w", ref, err)
 // touch filePath, newest first. The "--" keeps the path from ever being
 // read as an option or ref.
 func RevListPath(dir, ref, filePath string, limit int) ([]string, error) {
-	cmd := exec.Command("git", "-C", dir, "rev-list",
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "rev-list",
 		fmt.Sprintf("--max-count=%d", limit), "--end-of-options", ref, "--", filePath)
 	out, err := cmd.Output()
 	if err != nil {
 // PeelToCommit resolves a ref or object to its commit — annotated tags
 // peel to the commit they point at.
 func PeelToCommit(dir, ref string) (string, error) {
-	out, err := exec.Command("git", "-C", dir, "rev-parse", "--verify", "--end-of-options", ref+"^{commit}").Output()
+	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "rev-parse", "--verify", "--end-of-options", ref+"^{commit}").Output()
 	if err != nil {
 		return "", fmt.Errorf("rev-parse %s^{commit}: %w", ref, err)
 	}
 // ReadCommit returns the raw commit object bytes.
 func ReadCommit(dir, sha string) ([]byte, error) {
-	cmd := exec.Command("git", "-C", dir, "cat-file", "commit", "--end-of-options", sha)
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "cat-file", "commit", "--end-of-options", sha)
 	out, err := cmd.Output()
 	if err != nil {
 		return nil, fmt.Errorf("cat-file commit %s: %w", sha, err)
 // an interactive caller can watch. extraEnv carries credentials via
 // GIT_ASKPASS; the URL itself must never contain them.
 func FetchMirror(ctx context.Context, dir, url string, errW io.Writer, extraEnv []string) error {
-	cmd := exec.CommandContext(ctx, "git", "-C", dir, "fetch", "--progress", "--no-write-fetch-head", url,
+	cmd := exec.CommandContext(ctx, toolpath.Look("git"), "-C", dir, "fetch", "--progress", "--no-write-fetch-head", url,
 		"+refs/heads/*:refs/heads/*",
 		"+refs/tags/*:refs/tags/*",
 		"+refs/notes/*:refs/notes/*")
 // handshakes. extraEnv carries credentials via GIT_ASKPASS; the URL must
 // never contain them.
 func FetchPullHeads(ctx context.Context, dir, url string, errW io.Writer, extraEnv []string) error {
-	cmd := exec.CommandContext(ctx, "git", "-C", dir, "fetch", "--no-write-fetch-head", "--no-tags",
+	cmd := exec.CommandContext(ctx, toolpath.Look("git"), "-C", dir, "fetch", "--no-write-fetch-head", "--no-tags",
 		url, "+refs/pull/*/head:refs/gh-pull/*")
 	cmd.Env = append(os.Environ(), extraEnv...)
 	cmd.Stderr = errW
 // RemoteDefaultBranch asks the remote which branch HEAD points at.
 func RemoteDefaultBranch(ctx context.Context, url string, extraEnv []string) (string, error) {
-	cmd := exec.CommandContext(ctx, "git", "ls-remote", "--symref", url, "HEAD")
+	cmd := exec.CommandContext(ctx, toolpath.Look("git"), "ls-remote", "--symref", url, "HEAD")
 	cmd.Env = append(os.Environ(), extraEnv...)
 	out, err := cmd.Output()
 	if err != nil {
 // SetHead points the bare repo's HEAD at a branch.
 func SetHead(dir, branch string) error {
-	cmd := exec.Command("git", "-C", dir, "symbolic-ref", "HEAD", "refs/heads/"+branch)
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "symbolic-ref", "HEAD", "refs/heads/"+branch)
 	if out, err := cmd.CombinedOutput(); err != nil {
 		return fmt.Errorf("symbolic-ref: %v\n%s", err, out)
 	}

internal/gitutil/grep.go +3 −1

 	"strconv"
 	"strings"
 	"time"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 type GrepMatch struct {
 	defer cancel()
 	// -z: NUL after the path and the line number, so paths containing
 	// ':' parse unambiguously (format: "ref:path\0line\0text\n").
-	cmd := exec.CommandContext(ctx, "git", "-C", dir, "grep", "-nIiF", "-z", "-e", query, "--end-of-options", ref)
+	cmd := exec.CommandContext(ctx, toolpath.Look("git"), "-C", dir, "grep", "-nIiF", "-z", "-e", query, "--end-of-options", ref)
 	out, err := cmd.Output()
 	if err != nil {
 		if ee, ok := err.(*exec.ExitError); ok && ee.ExitCode() == 1 {

internal/gitutil/lastcommit.go +5 −3

 	"strconv"
 	"strings"
 	"time"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 // EntryCommit is the newest commit touching one entry of a tree listing.
 	if prefix != "" {
 		args = append(args, "--", strings.TrimSuffix(prefix, "/"))
 	}
-	cmd := exec.Command("git", args...)
+	cmd := exec.Command(toolpath.Look("git"), args...)
 	stdout, err := cmd.StdoutPipe()
 	if err != nil {
 		return nil
 // TipCommit is the commit at ref, for the bar above a tree listing that
 // answers "who touched this repository last".
 func TipCommit(dir, ref string) EntryCommit {
-	out, err := exec.Command("git", "-C", dir, "log", "-1",
+	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "log", "-1",
 		"--format=%H%x1f%ct%x1f%an%x1f%ae%x1f%s", "--end-of-options", ref).Output()
 	if err != nil {
 		return EntryCommit{}
 // page can report the facts the file listing no longer carries: its size,
 // and whether it is executable or a symlink.
 func StatPath(dir, ref, path string) (TreeEntry, bool) {
-	out, err := exec.Command("git", "-C", dir, "ls-tree", "-l", "--end-of-options", ref, "--", path).Output()
+	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "ls-tree", "-l", "--end-of-options", ref, "--", path).Output()
 	if err != nil {
 		return TreeEntry{}, false
 	}

internal/gitutil/lfs.go +4 −2

 	"regexp"
 	"strconv"
 	"strings"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 // lfsPointerMax bounds a pointer file; real ones are around 130 bytes.
 // anywhere in the repository: every object, not just the reachable ones,
 // since an unreachable blob is still an object gc has not removed.
 func LFSPointerOIDs(dir string) ([]string, error) {
-	list := exec.Command("git", "-C", dir, "cat-file", "--batch-all-objects",
+	list := exec.Command(toolpath.Look("git"), "-C", dir, "cat-file", "--batch-all-objects",
 		"--batch-check=%(objecttype) %(objectsize) %(objectname)")
 	out, err := list.Output()
 	if err != nil {
 	if len(small) == 0 {
 		return nil, nil
 	}
-	cat := exec.Command("git", "-C", dir, "cat-file", "--batch")
+	cat := exec.Command(toolpath.Look("git"), "-C", dir, "cat-file", "--batch")
 	cat.Stdin = strings.NewReader(strings.Join(small, "\n") + "\n")
 	out, err = cat.Output()
 	if err != nil {

internal/gitutil/merge.go +22 −20

 	"os"
 	"os/exec"
 	"strings"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 // FetchInto copies srcRef from srcDir into dstDir as dstRef, forcing the
 // update. Objects are copied, not shared — the destination owns everything
 // afterward, which is what keeps MRs alive when their fork is deleted.
 func FetchInto(dstDir, srcDir, srcRef, dstRef string) error {
-	cmd := exec.Command("git", "-C", dstDir, "fetch", "--quiet", "--no-write-fetch-head",
+	cmd := exec.Command(toolpath.Look("git"), "-C", dstDir, "fetch", "--quiet", "--no-write-fetch-head",
 		srcDir, "+"+srcRef+":"+dstRef)
 	if out, err := cmd.CombinedOutput(); err != nil {
 		return fmt.Errorf("fetch %s from %s: %v\n%s", srcRef, srcDir, err, out)
 	if oldSHA != "" {
 		args = append(args, oldSHA)
 	}
-	cmd := exec.Command("git", args...)
+	cmd := exec.Command(toolpath.Look("git"), args...)
 	if out, err := cmd.CombinedOutput(); err != nil {
 		return fmt.Errorf("update-ref %s: %v\n%s", ref, err, out)
 	}
 }
 func DeleteRef(dir, ref string) error {
-	cmd := exec.Command("git", "-C", dir, "update-ref", "-d", ref)
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "update-ref", "-d", ref)
 	if out, err := cmd.CombinedOutput(); err != nil {
 		return fmt.Errorf("delete-ref %s: %v\n%s", ref, err, out)
 	}
 // RevListRange returns commits in old..new, newest first.
 func RevListRange(dir, old, new string) ([]string, error) {
-	cmd := exec.Command("git", "-C", dir, "rev-list", "--end-of-options", new, "^"+old)
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "rev-list", "--end-of-options", new, "^"+old)
 	out, err := cmd.Output()
 	if err != nil {
 		return nil, fmt.Errorf("rev-list %s..%s: %w", old, new, err)
 // MergeTree performs a real merge of ours and theirs, returning the merged
 // tree id. conflict=true means the merge cannot be done automatically.
 func MergeTree(dir, ours, theirs string) (tree string, conflict bool, err error) {
-	cmd := exec.Command("git", "-C", dir, "merge-tree", "--write-tree", "--end-of-options", ours, theirs)
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "merge-tree", "--write-tree", "--end-of-options", ours, theirs)
 	out, runErr := cmd.Output()
 	tree = strings.TrimSpace(strings.SplitN(string(out), "\n", 2)[0])
 	if runErr != nil {
 	for _, p := range parents {
 		args = append(args, "-p", p)
 	}
-	cmd := exec.Command("git", args...)
+	cmd := exec.Command(toolpath.Look("git"), args...)
 	cmd.Env = append(os.Environ(),
 		"GIT_AUTHOR_NAME="+name, "GIT_AUTHOR_EMAIL="+email,
 		"GIT_COMMITTER_NAME="+name, "GIT_COMMITTER_EMAIL="+email,
 // truncated says whether it was cut, so the caller can say so instead of
 // rendering a hunk that ends mid-line (#117).
 func Diff(dir, old, new string, limit int64) (patch string, truncated bool, err error) {
-	cmd := exec.Command("git", "-C", dir, "diff", "--stat", "--patch", "--end-of-options", old, new)
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "diff", "--stat", "--patch", "--end-of-options", old, new)
 	out, err := cmd.Output()
 	if err != nil {
 		return "", false, fmt.Errorf("diff: %w", err)
 // MergeBase returns the best common ancestor, or an error if none exists.
 func MergeBase(dir, a, b string) (string, error) {
-	cmd := exec.Command("git", "-C", dir, "merge-base", "--end-of-options", a, b)
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "merge-base", "--end-of-options", a, b)
 	out, err := cmd.Output()
 	if err != nil {
 		return "", fmt.Errorf("no common history between %s and %s", a, b)
 	}
 	// Hash the new blob.
-	hb := exec.Command("git", "-C", dir, "hash-object", "-w", "--stdin")
+	hb := exec.Command(toolpath.Look("git"), "-C", dir, "hash-object", "-w", "--stdin")
 	hb.Stdin = strings.NewReader(string(content))
 	out, err := hb.Output()
 	if err != nil {
 	defer os.Remove(idx.Name())
 	env := append(os.Environ(), "GIT_INDEX_FILE="+idx.Name())
-	rt := exec.Command("git", "-C", dir, "read-tree", parent+"^{tree}")
+	rt := exec.Command(toolpath.Look("git"), "-C", dir, "read-tree", parent+"^{tree}")
 	rt.Env = env
 	if out, err := rt.CombinedOutput(); err != nil {
 		return "", fmt.Errorf("read-tree: %v\n%s", err, out)
 	}
-	ui := exec.Command("git", "-C", dir, "update-index", "--add", "--cacheinfo", "100644,"+blob+","+path)
+	ui := exec.Command(toolpath.Look("git"), "-C", dir, "update-index", "--add", "--cacheinfo", "100644,"+blob+","+path)
 	ui.Env = env
 	if out, err := ui.CombinedOutput(); err != nil {
 		return "", fmt.Errorf("update-index: %v\n%s", err, out)
 	}
-	wt := exec.Command("git", "-C", dir, "write-tree")
+	wt := exec.Command(toolpath.Look("git"), "-C", dir, "write-tree")
 	wt.Env = env
 	out, err = wt.Output()
 	if err != nil {
 // CommitParents returns the parent SHAs of a commit.
 func CommitParents(dir, sha string) ([]string, error) {
-	out, err := exec.Command("git", "-C", dir, "rev-list", "--parents", "-n1", "--end-of-options", sha).Output()
+	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "rev-list", "--parents", "-n1", "--end-of-options", sha).Output()
 	if err != nil {
 		return nil, fmt.Errorf("rev-list --parents %s: %w", sha, err)
 	}
 // AuthorIdent returns a commit's author name, email, and ISO date.
 func AuthorIdent(dir, sha string) (name, email, date string, err error) {
-	out, err := exec.Command("git", "-C", dir, "log", "-1", "--format=%an%x1f%ae%x1f%aI", "--end-of-options", sha).Output()
+	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "log", "-1", "--format=%an%x1f%ae%x1f%aI", "--end-of-options", sha).Output()
 	if err != nil {
 		return "", "", "", fmt.Errorf("log %s: %w", sha, err)
 	}
 // CommitMessage returns a commit's full message.
 func CommitMessage(dir, sha string) (string, error) {
-	out, err := exec.Command("git", "-C", dir, "log", "-1", "--format=%B", "--end-of-options", sha).Output()
+	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "log", "-1", "--format=%B", "--end-of-options", sha).Output()
 	if err != nil {
 		return "", fmt.Errorf("log %s: %w", sha, err)
 	}
 // MergeTreeOnto replays commit's changes (relative to base) onto onto,
 // returning the resulting tree. conflict=true when it cannot apply cleanly.
 func MergeTreeOnto(dir, base, onto, commit string) (tree string, conflict bool, err error) {
-	cmd := exec.Command("git", "-C", dir, "merge-tree", "--write-tree", "--merge-base="+base, "--end-of-options", onto, commit)
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "merge-tree", "--write-tree", "--merge-base="+base, "--end-of-options", onto, commit)
 	out, runErr := cmd.Output()
 	tree = strings.TrimSpace(strings.SplitN(string(out), "\n", 2)[0])
 	if runErr != nil {
 	for _, p := range parents {
 		args = append(args, "-p", p)
 	}
-	cmd := exec.Command("git", args...)
+	cmd := exec.Command(toolpath.Look("git"), args...)
 	env := append(os.Environ(),
 		"GIT_AUTHOR_NAME="+authorName, "GIT_AUTHOR_EMAIL="+authorEmail,
 		"GIT_COMMITTER_NAME="+committerName, "GIT_COMMITTER_EMAIL="+committerEmail,
 // ResolveTree returns the tree id of a commit.
 func ResolveTree(dir, sha string) (string, error) {
-	out, err := exec.Command("git", "-C", dir, "rev-parse", "--verify", "--end-of-options", sha+"^{tree}").Output()
+	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "rev-parse", "--verify", "--end-of-options", sha+"^{tree}").Output()
 	if err != nil {
 		return "", fmt.Errorf("rev-parse %s^{tree}: %w", sha, err)
 	}
 // DiffFiles lists the paths changed between old and new.
 func DiffFiles(dir, old, new string) ([]string, error) {
-	out, err := exec.Command("git", "-C", dir, "diff", "--name-only", "--end-of-options", old, new).Output()
+	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "diff", "--name-only", "--end-of-options", old, new).Output()
 	if err != nil {
 		return nil, fmt.Errorf("diff --name-only: %w", err)
 	}
 // tells a reviewer nothing. It pairs at 80, and two genuinely unrelated
 // commits are still left unpaired there; both measured.
 func RangeDiff(dir, oldBase, oldHead, newBase, newHead string, limit int64) (patch string, truncated bool, err error) {
-	cmd := exec.Command("git", "-C", dir, "range-diff", "--creation-factor=80", "--end-of-options",
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "range-diff", "--creation-factor=80", "--end-of-options",
 		oldBase+".."+oldHead, newBase+".."+newHead)
 	out, err := cmd.Output()
 	if err != nil {

internal/gitutil/messages.go +7 −5

 	"fmt"
 	"os/exec"
 	"strings"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 const zeroSHA = "0000000000000000000000000000000000000000"
 	if old != "" && old != zeroSHA {
 		args = append(args, "^"+old)
 	}
-	out, err := exec.Command("git", args...).Output()
+	out, err := exec.Command(toolpath.Look("git"), args...).Output()
 	if err != nil {
 		return nil, fmt.Errorf("rev-list authors: %w", err)
 	}
 // Parents returns a commit's parent shas.
 func Parents(dir, sha string) []string {
-	out, err := exec.Command("git", "-C", dir, "log", "-1", "--format=%P", sha).Output()
+	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "log", "-1", "--format=%P", sha).Output()
 	if err != nil {
 		return nil
 	}
 // LastCommitDate returns the committer date (YYYY-MM-DD) of the ref tip,
 // or "" for empty repos.
 func LastCommitDate(dir, ref string) string {
-	out, err := exec.Command("git", "-C", dir, "log", "-1", "--format=%cs", ref).Output()
+	out, err := exec.Command(toolpath.Look("git"), "-C", dir, "log", "-1", "--format=%cs", ref).Output()
 	if err != nil {
 		return ""
 	}
 // HasCommit reports whether sha names a commit object present in dir.
 func HasCommit(dir, sha string) bool {
-	return exec.Command("git", "-C", dir, "cat-file", "-e", sha+"^{commit}").Run() == nil
+	return exec.Command(toolpath.Look("git"), "-C", dir, "cat-file", "-e", sha+"^{commit}").Run() == nil
 }
 type CommitMsg struct {
 	if old != "" && old != zeroSHA {
 		args = append(args, "^"+old)
 	}
-	out, err := exec.Command("git", args...).Output()
+	out, err := exec.Command(toolpath.Look("git"), args...).Output()
 	if err != nil {
 		return nil, fmt.Errorf("rev-list messages: %w", err)
 	}

internal/gitutil/read.go +8 −6

 	"strconv"
 	"strings"
 	"time"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 type TreeEntry struct {
 	if path != "" {
 		spec = ref + ":" + path
 	}
-	cmd := exec.Command("git", "-C", dir, "ls-tree", "-l", "--end-of-options", spec)
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "ls-tree", "-l", "--end-of-options", spec)
 	out, err := cmd.Output()
 	if err != nil {
 		return nil, fmt.Errorf("ls-tree %s: %w", spec, err)
 // ReadBlob returns the contents of ref:path, capped at limit bytes.
 func ReadBlob(dir, ref, path string, limit int64) ([]byte, error) {
-	cmd := exec.Command("git", "-C", dir, "cat-file", "blob", "--end-of-options", ref+":"+path)
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "cat-file", "blob", "--end-of-options", ref+":"+path)
 	stdout, err := cmd.StdoutPipe()
 	if err != nil {
 		return nil, err
 // ResolveRef resolves a ref or sha to a full commit sha; errors if absent.
 func ResolveRef(dir, ref string) (string, error) {
-	cmd := exec.Command("git", "-C", dir, "rev-parse", "--verify", "--quiet", "--end-of-options", ref+"^{commit}")
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "rev-parse", "--verify", "--quiet", "--end-of-options", ref+"^{commit}")
 	out, err := cmd.Output()
 	if err != nil {
 		return "", fmt.Errorf("unknown ref %q", ref)
 // Refs lists branches or tags; kind is "heads" or "tags".
 func Refs(dir, kind string) ([]Ref, error) {
-	cmd := exec.Command("git", "-C", dir, "for-each-ref",
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "for-each-ref",
 		"--format=%(refname:short) %(objectname)", "refs/"+kind)
 	out, err := cmd.Output()
 	if err != nil {
 func Archive(dir, ref, prefix string, w io.Writer) error {
 	ctx, cancel := context.WithTimeout(context.Background(), archiveTimeout)
 	defer cancel()
-	cmd := exec.CommandContext(ctx, "git", "-C", dir, "archive", "--format=tar.gz", "--prefix="+prefix+"/", "--end-of-options", ref)
+	cmd := exec.CommandContext(ctx, toolpath.Look("git"), "-C", dir, "archive", "--format=tar.gz", "--prefix="+prefix+"/", "--end-of-options", ref)
 	lw := &cappedWriter{w: w, left: MaxArchiveBytes, stop: cancel}
 	cmd.Stdout = lw
 	err := cmd.Run()
 // ShowPatch returns the stat+patch text for one commit.
 func ShowPatch(dir, sha string, limit int64) (patch string, truncated bool, err error) {
-	cmd := exec.Command("git", "-C", dir, "show", "--stat", "--patch", "--format=", "--end-of-options", sha)
+	cmd := exec.Command(toolpath.Look("git"), "-C", dir, "show", "--stat", "--patch", "--format=", "--end-of-options", sha)
 	stdout, err := cmd.StdoutPipe()
 	if err != nil {
 		return "", false, err

internal/mirror/mirror.go +2 −1

 	"gitbay.org/gitbay/internal/config"
 	"gitbay.org/gitbay/internal/control"
 	"gitbay.org/gitbay/internal/store"
+	"gitbay.org/gitbay/internal/toolpath"
 )
 const askpassScript = `#!/bin/sh
 		args = []string{"-C", dir, "fetch", "--prune", m.URL,
 			"+refs/heads/*:refs/heads/*", "+refs/tags/*:refs/tags/*"}
 	}
-	cmd := exec.CommandContext(ctx, "git", args...)
+	cmd := exec.CommandContext(ctx, toolpath.Look("git"), args...)
 	cmd.Env = env
 	if out, err := cmd.CombinedOutput(); err != nil {
 		return fmt.Errorf("git %s: %v: %.300s", m.Direction, err, out)

internal/toolpath/toolpath.go added +64

@@ -0,0 +1,64 @@
	1	// Package toolpath resolves the external programs gitbay runs — git, ssh,
	2	// sh — to absolute paths once, when the process starts, instead of
	3	// letting the kernel search PATH on every spawn.
	4	//
	5	// Three things it buys, in the order they matter.
	6	//
	7	// A missing tool becomes one legible failure at start-up rather than an
	8	// opaque one at the first push, on whichever request happened to need it.
	9	//
	10	// The command a long-lived daemon runs is then fixed for its lifetime,
	11	// decided from the environment it was started with rather than resolved
	12	// afresh each time. gitbayd and gitbay-runner both run under systemd with
	13	// a root-owned PATH and a read-only /usr, so a search was never
	14	// attacker-influenced in a shipped configuration — but a spawn that
	15	// cannot be redirected is one fewer thing to reason about, and it is what
	16	// the scanner asks for (go:S4036).
	17	//
	18	// And the lookup leaves the hot path: a repository page can spawn several
	19	// git processes, and each was searching PATH from scratch.
	20	package toolpath
	21
	22	import (
	23	"fmt"
	24	"os/exec"
	25	"strings"
	26	"sync"
	27	)
	28
	29	var (
	30	mu sync.Mutex
	31	cache = map[string]string{}
	32	missing []string
	33	)
	34
	35	// Look returns the absolute path to name, or name itself when it is not
	36	// on PATH. Returning the bare name keeps the failure where it already
	37	// was — exec reporting it — for anything that runs before Verify, and for
	38	// a tool a particular binary never actually uses.
	39	func Look(name string) string {
	40	mu.Lock()
	41	defer mu.Unlock()
	42	if p, ok := cache[name]; ok {
	43	return p
	44	}
	45	p, err := exec.LookPath(name)
	46	if err != nil {
	47	p = name
	48	missing = append(missing, name)
	49	}
	50	cache[name] = p
	51	return p
	52	}
	53
	54	// Verify reports the tools that were asked for and not found, so a daemon
	55	// can refuse to start rather than fail on its first request. Call it after
	56	// the packages that need tools are initialised.
	57	func Verify() error {
	58	mu.Lock()
	59	defer mu.Unlock()
	60	if len(missing) == 0 {
	61	return nil
	62	}
	63	return fmt.Errorf("not found on PATH: %s", strings.Join(missing, ", "))
	64	}

internal/toolpath/toolpath_test.go added +47

@@ -0,0 +1,47 @@
	1	package toolpath
	2
	3	import (
	4	"os/exec"
	5	"path/filepath"
	6	"strings"
	7	"testing"
	8	)
	9
	10	func TestLookResolvesToAnAbsolutePath(t *testing.T) {
	11	got := Look("go")
	12	if !filepath.IsAbs(got) {
	13	t.Fatalf("Look(go) = %q, want an absolute path", got)
	14	}
	15	want, err := exec.LookPath("go")
	16	if err != nil {
	17	t.Fatal(err)
	18	}
	19	if got != want {
	20	t.Errorf("Look(go) = %q, want %q", got, want)
	21	}
	22	}
	23
	24	// A second call must not search again: resolving once is the point, and a
	25	// daemon that re-resolved would follow a PATH that changed under it.
	26	func TestLookIsResolvedOnce(t *testing.T) {
	27	first := Look("go")
	28	if second := Look("go"); second != first {
	29	t.Errorf("Look(go) returned %q then %q", first, second)
	30	}
	31	}
	32
	33	// An absent tool falls back to the bare name so exec reports it the way
	34	// it always did, and Verify names it.
	35	func TestMissingToolFallsBackAndIsReported(t *testing.T) {
	36	const name = "gitbay-no-such-tool-exists"
	37	if got := Look(name); got != name {
	38	t.Errorf("Look(%q) = %q, want the bare name back", name, got)
	39	}
	40	err := Verify()
	41	if err == nil {
	42	t.Fatal("Verify found nothing missing after an unresolvable lookup")
	43	}
	44	if !strings.Contains(err.Error(), name) {
	45	t.Errorf("Verify error %q does not name the missing tool", err)
	46	}
	47	}