Merge pull request #321 from pjbgf/libgit2-130

Update libgit2 to 1.3.0

Author: Paulo Gomes

ATTRIBUTIONS.md

@@ -1203,6 +1203,18 @@ STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 OF THE POSSIBILITY OF SUCH DAMAGE.
 
+----------------------------------------------------------------------
+
+The xoroshiro256** implementation is licensed in the public domain:
+
+Written in 2018 by David Blackman and Sebastiano Vigna ([email protected])
+
+To the extent possible under law, the author has dedicated all copyright
+and related and neighboring rights to this software to the public domain
+worldwide. This software is distributed without any warranty.
+
+See <http://creativecommons.org/publicdomain/zero/1.0/>.
+
 ***
 
 ## zlib

Dockerfile

@@ -3,7 +3,7 @@ ARG GO_VERSION=1.17
 ARG XX_VERSION=1.1.0
 
 ARG LIBGIT2_IMG=ghcr.io/fluxcd/golang-with-libgit2
-ARG LIBGIT2_TAG=libgit2-1.1.1-7
+ARG LIBGIT2_TAG=libgit2-1.3.0-2
 
 FROM ${LIBGIT2_IMG}:${LIBGIT2_TAG} AS libgit2-libs
 

Makefile

@@ -8,7 +8,7 @@ CRD_OPTIONS ?= crd:crdVersions=v1
 
 # Base image used to build the Go binary
 LIBGIT2_IMG ?= ghcr.io/fluxcd/golang-with-libgit2
-LIBGIT2_TAG ?= libgit2-1.1.1-7
+LIBGIT2_TAG ?= libgit2-1.3.0-2
 
 # Allows for defining additional Docker buildx arguments,
 # e.g. '--push'.
@@ -144,8 +144,7 @@ test-api:	## Run api tests
 	cd api; go test ./... -coverprofile cover.out
 
 manager: $(LIBGIT2) generate fmt vet	## Build manager binary
-	go run ./main.go
-
+	go build ./main.go
 
 run: $(LIBGIT2) generate fmt vet manifests	# Run against the configured Kubernetes cluster in ~/.kube/config
 	go run $(GO_STATIC_FLAGS) ./main.go --log-level=${LOG_LEVEL} --log-encoding=console
@@ -272,6 +271,19 @@ update-attributions:
 	./hack/update-attributions.sh
 
 verify: update-attributions fmt
+ifneq ($(shell grep -o 'LIBGIT2_IMG ?= \w.*' Makefile | cut -d ' ' -f 3):$(shell grep -o 'LIBGIT2_TAG ?= \w.*' Makefile | cut -d ' ' -f 3), \
+		$(shell grep -o "LIBGIT2_IMG=\w.*" Dockerfile | cut -d'=' -f2):$(shell grep -o "LIBGIT2_TAG=\w.*" Dockerfile | cut -d'=' -f2))
+	@{ \
+	echo "LIBGIT2_IMG and LIBGIT2_TAG must match in both Makefile and Dockerfile"; \
+	exit 1; \
+	}
+endif
+ifneq ($(shell grep -o 'LIBGIT2_TAG ?= \w.*' Makefile | cut -d ' ' -f 3), $(shell grep -o "LIBGIT2_TAG=.*" tests/fuzz/oss_fuzz_build.sh | sed 's;LIBGIT2_TAG="$${LIBGIT2_TAG:-;;g' | sed 's;}";;g'))
+	@{ \
+	echo "LIBGIT2_TAG must match in both Makefile and tests/fuzz/oss_fuzz_build.sh"; \
+	exit 1; \
+	}
+endif
 ifneq (, $(shell git status --porcelain --untracked-files=no))
 	@{ \
 	echo "working directory is dirty:"; \

controllers/git_test.go

@@ -2,14 +2,14 @@ package controllers
 
 import (
 	"context"
+	"fmt"
 	"os"
 	"path/filepath"
 	"testing"
 	"time"
 
 	"github.com/go-git/go-billy/v5/memfs"
 	gogit "github.com/go-git/go-git/v5"
-	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/object"
 	"github.com/go-git/go-git/v5/storage/memory"
 	"github.com/go-logr/logr"
@@ -144,18 +144,11 @@ func TestPushRejected(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	tmp, err := os.MkdirTemp("", "gotest-imageauto-git")
-	if err != nil {
-		t.Fatal(err)
-	}
-	repoURL := gitServer.HTTPAddress() + "/appconfig.git"
-	repo, err := gogit.PlainClone(tmp, false, &gogit.CloneOptions{
-		URL:           repoURL,
-		ReferenceName: plumbing.NewBranchReferenceName("main"),
-	})
+	repoURL := gitServer.HTTPAddressWithCredentials() + "/appconfig.git"
+	repo, err := clone(repoURL, "origin", "main")
 
 	// This is here to guard against push in general being broken
-	err = push(context.TODO(), tmp, "main", repoAccess{
+	err = push(context.TODO(), repo.Workdir(), "main", repoAccess{
 		url:  repoURL,
 		auth: nil,
 	})
@@ -164,13 +157,13 @@ func TestPushRejected(t *testing.T) {
 	}
 
 	// This is not under test, but needed for the next bit
-	if err = switchBranch(repo, branch); err != nil {
+	if err = repo.SetHead(fmt.Sprintf("refs/heads/%s", branch)); err != nil {
 		t.Fatal(err)
 	}
 
 	// This is supposed to fail, because the hook rejects the branch
 	// pushed to.
-	err = push(context.TODO(), tmp, branch, repoAccess{
+	err = push(context.TODO(), repo.Workdir(), branch, repoAccess{
 		url:  repoURL,
 		auth: nil,
 	})

controllers/imageupdateautomation_controller.go

@@ -30,7 +30,7 @@ import (
 
 	"github.com/Masterminds/sprig/v3"
 	gogit "github.com/go-git/go-git/v5"
-	libgit2 "github.com/libgit2/git2go/v31"
+	libgit2 "github.com/libgit2/git2go/v33"
 
 	"github.com/ProtonMail/go-crypto/openpgp"
 	securejoin "github.com/cyphar/filepath-securejoin"
@@ -702,11 +702,11 @@ func push(ctx context.Context, path, branch string, access repoAccess) error {
 	// calling repo.Push will succeed even if a reference update is
 	// rejected; to detect this case, this callback is supplied.
 	var callbackErr error
-	callbacks.PushUpdateReferenceCallback = func(refname, status string) libgit2.ErrorCode {
+	callbacks.PushUpdateReferenceCallback = func(refname, status string) error {
 		if status != "" {
 			callbackErr = fmt.Errorf("ref %s rejected: %s", refname, status)
 		}
-		return libgit2.ErrorCodeOK
+		return nil
 	}
 	err = origin.Push([]string{fmt.Sprintf("refs/heads/%s:refs/heads/%s", branch, branch)}, &libgit2.PushOptions{
 		RemoteCallbacks: callbacks,