#57 repo.git publishes local filesystem path in config
dist/repo.git/config is published and contains the builder's absolute filesystem path.
$ curl -s http://127.0.0.1:39313/repo.git/config
[core]
repositoryformatversion = 0
filemode = true
bare = true
[remote "origin"]
url = ~/src/code/gl0w-w0rld/hu13
git clone records remote.origin.url pointing at the source path, and every file under repo.git/ is served verbatim. That leaks the deploy host's directory layout and username (/home/<user>/src/...) to the public.
Also published and useless: description (the "Unnamed repository" stub) and 14 hooks/*.sample files.
Fix, after the clone:
git --git-dir=<dest> config --remove-section remote.origin(or build the export from the bundle without a named remote and never clone from the path)- delete
description,hooks/,info/excludebeforeupdate-server-info
Acceptance:
-
built
repo.git/configcontains noremotesection and no absolute path -
test: build fixture in a temp dir, assert
configdoes not contain the temp dir path -
hooks/anddescriptionare absent from the export
Uunknown ·
Fixed in e2792258-fd01-4be6-83ca-c68ef435cfed: export now clones from repo.bundle (one pack, no loose/dangling objects), remote.origin removed, sample hooks removed, single run_git_opt runner with OsStr paths + 120s export budget, content-type anchored to .git/HEAD+info/, docs updated. tests/clone_export.rs asserts all of it.