Allow git for snmp config file by i3149 · Pull Request #877 · kentik/ktranslate

i3149 · 2026-02-17T05:19:52Z

KT_GIT_ACCESS_USERNAME=$USERNAME KT_GIT_ACCESS_TOKEN=$PERSONAL_ACCESS_TOKEN ./bin/ktranslate -snmp git://Users/pye/src/configtest/foo/snmp.yaml

Allow a system like this where the snmp.yaml file is pulled from a remote git repo. No need to have KT_GIT_ACCESS_TOKEN and KT_GIT_ACCESS_USERNAME defined if not needed.

Also allows KT_GIT_ACCESS_TOKEN to be defined when pulling snmp profiles from a private repo.

Closes #875 #869

New env vars to think about:

	KT_GIT_ACCESS_TOKEN  
	KT_GIT_ACCESS_USERNAME 
	KT_GIT_PULL_BRANCH     
	KT_GIT_PUSH_BRANCH 
        KT_GIT_COMMIT_EMAIL
        KT_GIT_COMMIT_NAME

Full use:

KT_GIT_PULL_BRANCH=pullbranch KT_GIT_PUSH_BRANCH=pushbranch KT_GIT_ACCESS_USERNAME=foo KT_GIT_ACCESS_TOKEN=XXX ./bin/ktranslate -snmp git://github.com/i3149/configtest/snmp.yaml -snmp_discovery

You can use these for the -snmp flag, -config flag and also the profile_git_url line in the snmp config file.

When KT_GIT_PULL_BRANCH is defined, this branch will be used to pull the config files from.
When KT_GIT_PUSH_BRANCH is defined, this branch will be used to push an updated snmp.yaml file on snmp discovery. NOTE This branch must exist on the remote repo. It will not be created.

KT_GIT_COMMIT_EMAIL defines the commiter email to use.
KT_GIT_COMMIT_NAME defines the commiter name.

Copilot

Pull request overview

Adds support for loading SNMP config (and MIB profiles) from git-backed sources, including optional GitHub token auth via KT_GITHUB_ACCESS_TOKEN.

Changes:

Add git:// scheme handling to SNMP util LoadFile/WriteFile.
Add BasicAuth support for cloning MIB profiles from git when a token is present.
Update Go module dependencies (notably introducing go-git/v6 and related transitive bumps).

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 8 comments.

File	Description
pkg/inputs/snmp/util/file.go	Adds `git` scheme support for config load/write via cloning a repo and reading a file.
pkg/inputs/snmp/mibs/git.go	Adds token-based auth for cloning profile repositories.
go.mod	Adds go-git/v6 and updates several dependency versions.
go.sum	Updates dependency checksums in line with go.mod changes.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

pkg/inputs/snmp/util/file.go

pkg/inputs/snmp/mibs/git.go

go.mod

pkg/inputs/snmp/util/file.go

Copilot

Pull request overview

Copilot reviewed 3 out of 4 changed files in this pull request and generated 6 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

pkg/inputs/snmp/util/file.go

Copilot

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 8 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

config.go

pkg/inputs/snmp/util/file.go

pkg/inputs/snmp/mibs/git.go

pkg/inputs/snmp/util/file.go

config.go

pkg/inputs/snmp/util/file.go

Copilot

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 9 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

pkg/inputs/snmp/util/file.go

Copilot · 2026-02-18T19:28:36Z

pkg/inputs/snmp/util/file.go

+	case "git":
+		return loadFromGit(ctx, u)


The new git:// scheme functionality in LoadFile and WriteFile is not covered by tests in file_test.go. Consider adding test cases for the git:// scheme to ensure the functionality works correctly and to prevent regressions. The test should verify URL parsing, authentication setup, and successful file retrieval.

pkg/inputs/snmp/mibs/git.go

pkg/inputs/snmp/util/file.go

pkg/inputs/snmp/mibs/git.go

Copilot

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 11 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

pkg/inputs/snmp/util/file.go

pkg/inputs/snmp/mibs/git.go

pkg/inputs/snmp/util/file.go

Copilot

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 10 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

pkg/inputs/snmp/util/file.go

pkg/inputs/snmp/mibs/git.go

pkg/inputs/snmp/util/file.go

pkg/inputs/snmp/mibs/git.go

pkg/inputs/snmp/util/file.go

Copilot

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 8 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-22T06:28:26Z

pkg/inputs/snmp/util/file.go

+		return "", nil, err
+	}
+
+	return filePath, r, err


The error path on line 263 returns 'err' without context about which operation failed. While the gitClone function will fail at PlainCloneContext, it would be more helpful to wrap this error with additional context about the URL being cloned. Consider wrapping the error similar to the other error returns in this function.

Suggested change

return "", nil, err

}

return filePath, r, err

return "", nil, fmt.Errorf("failed to clone git repository %s: %w", gitRepo, err)

}

return filePath, r, nil

Copilot · 2026-02-22T06:28:26Z

pkg/inputs/snmp/util/file.go

+	// Push repo.
+	return r.Push(&git.PushOptions{
+		Auth:     GetGitCreds(),
+		Force:    true,


Using Force: true in the PushOptions (line 209) is potentially dangerous as it will overwrite remote changes without regard to conflicts. This could cause data loss if multiple instances of ktranslate are running and trying to update the same file, or if manual changes were made to the repository.

Consider either:

Removing Force: true and handling push conflicts gracefully

Implementing a merge strategy to preserve remote changes

At minimum, adding prominent documentation warning about this behavior and recommending that only one instance should have write access

This is particularly risky given the SNMP discovery use case where updates might happen automatically.

Suggested change

// Push repo.

return r.Push(&git.PushOptions{

Auth: GetGitCreds(),

Force: true,

// Push repo without forcing, to avoid overwriting remote changes unintentionally.

return r.Push(&git.PushOptions{

Auth: GetGitCreds(),

Copilot · 2026-02-22T06:28:26Z

pkg/inputs/snmp/util/file.go

+	dir, err := os.MkdirTemp("", "ktrans")
+	if err != nil {
+		return err
+	}
+	defer os.RemoveAll(dir) // clean up


If the Git clone operation succeeds but a subsequent operation fails (e.g., reading the file, creating worktree, etc.), the deferred os.RemoveAll will still execute. However, if os.MkdirTemp itself fails and returns early, or if there's a panic before the defer is set up, the cleanup won't happen. While this is generally acceptable for temp directories, consider whether there are scenarios where credentials or sensitive data might remain in the temp directory that should be more aggressively cleaned up.

Copilot · 2026-02-22T06:28:27Z

pkg/inputs/snmp/util/file.go

+	cloneOpts := &git.CloneOptions{
+		URL:      gitRepo,
+		Auth:     GetGitCreds(),
+		Progress: io.Discard,
+	}
+	// If a branch is specified, clone that branch directly instead of
+	// cloning the default branch and manually rewriting references.
+	if branch != "" {
+		cloneOpts.ReferenceName = branch
+		cloneOpts.SingleBranch = true
+	}
+	r, err := git.PlainCloneContext(ctx, dir, cloneOpts)


The temporary directory is created for each git operation but there's no timeout or size limit on the clone operation. A malicious or very large repository could potentially:

Consume significant disk space in the temp directory

Take a very long time to clone, blocking the operation

Consider adding:

A timeout on the clone context (derived from the passed ctx or with a reasonable default)

Size/depth limits in CloneOptions (e.g., Depth: 1 for shallow clone if only the latest version is needed)

This would improve resilience against denial-of-service scenarios and reduce resource consumption.

Copilot · 2026-02-22T06:28:27Z

pkg/inputs/snmp/util/file.go

+func GetGitCreds() *githttp.BasicAuth {
+	token := os.Getenv(KT_GIT_ACCESS_TOKEN)
+	if token == "" {
+		return nil
+	}
+	username := os.Getenv(KT_GIT_ACCESS_USERNAME)
+	if username == "" {
+		// Many Git hosting services require a non-empty username when using personal access tokens.
+		// Default to a conventional placeholder username if none is provided via environment.
+		username = "git"
+	}
+	return &githttp.BasicAuth{
+		Username: username,
+		Password: token,
+	}


Security concern: The Git credentials (password/token) will be exposed in memory as plain strings throughout the authentication process. Consider adding a security note in the documentation warning users that:

Tokens should have minimal necessary permissions (read-only for pulling, write for pushing)

Tokens should be rotated regularly

Environment variables containing tokens should be properly secured in the deployment environment

While this is a common pattern for Git authentication, it's important to document the security implications for users.

Copilot · 2026-02-22T06:28:27Z

pkg/inputs/snmp/util/file.go

+		repo = strings.TrimSuffix(repo, ".git")
+	}
+	gitRepo := "https://" + path.Join(url.Host, owner, repo) + ".git"
+	filePath := filepath.Clean(path.Join(segments[2:]...))


Security: The filepath.Clean call on line 245 helps prevent path traversal, but it doesn't fully protect against malicious paths. An attacker could craft a URL with segments like "../../../etc/passwd" which, after joining segments[2:], could potentially escape the intended directory. Consider validating that the resulting filePath doesn't contain ".." segments after cleaning, or ensure it stays within the cloned repository directory bounds.

Suggested change

filePath := filepath.Clean(path.Join(segments[2:]...))

filePath := filepath.Clean(path.Join(segments[2:]...))

// Security: ensure the cleaned filePath does not contain any path traversal components.

for _, seg := range strings.Split(filePath, string(os.PathSeparator)) {

if seg == ".." {

return "", nil, fmt.Errorf("invalid file path in git url (path traversal detected): %s", url.String())

}

}

Copilot · 2026-02-22T06:28:27Z

pkg/inputs/snmp/util/file.go

+	if strings.HasSuffix(repo, ".git") {
+		repo = strings.TrimSuffix(repo, ".git")
+	}
+	gitRepo := "https://" + path.Join(url.Host, owner, repo) + ".git"


The gitClone function constructs an HTTPS URL by joining path segments, but path.Join will clean the path and potentially remove important elements. For example, if url.Host contains a port (e.g., "github.com:443"), path.Join may not handle it correctly. Additionally, if the host contains special characters, they might not be properly escaped.

Consider using url.URL struct methods to build the Git URL more safely, or at minimum add validation that url.Host doesn't contain unexpected characters like slashes or ports.

Suggested change

gitRepo := "https://" + path.Join(url.Host, owner, repo) + ".git"

gitURL := &url.URL{

Scheme: "https",

Host: url.Host,

Path: path.Join("/", owner, repo) + ".git",

}

gitRepo := gitURL.String()

Copilot · 2026-02-22T06:28:28Z

config.go

 // LoadConfig returns a ktranslate configuration from the specified path
-func LoadConfig(configPath string) (*Config, error) {
-	f, err := os.Open(configPath)
+func LoadConfig(ctx context.Context, configPath string) (*Config, error) {


The LoadConfig function signature has changed from LoadConfig(configPath string) to LoadConfig(ctx context.Context, configPath string). This is a breaking API change that will affect any external code that calls this function.

While the change is necessary to support context propagation for Git operations, this should be documented in release notes or migration guide. The PR correctly updates the main caller in cmd/ktranslate/main.go, but any external consumers of this package would need to update their code.

i3149 · 2026-02-23T22:52:04Z

New env vars to think about:

KT_GIT_ACCESS_TOKEN  
KT_GIT_ACCESS_USERNAME 
KT_GIT_PULL_BRANCH     
KT_GIT_PUSH_BRANCH 
    KT_GIT_COMMIT_EMAIL
    KT_GIT_COMMIT_NAME

Full use:

KT_GIT_PULL_BRANCH=pullbranch KT_GIT_PUSH_BRANCH=pushbranch KT_GIT_ACCESS_USERNAME=foo KT_GIT_ACCESS_TOKEN=XXX ./bin/ktranslate -snmp git://github.com/i3149/configtest/snmp.yaml -snmp_discovery
You can use these for the -snmp flag, -config flag and also the profile_git_url line in the snmp config file.

When KT_GIT_PULL_BRANCH is defined, this branch will be used to pull the config files from.
When KT_GIT_PUSH_BRANCH is defined, this branch will be used to push an updated snmp.yaml file on snmp discovery. NOTE This branch must exist on the remote repo. It will not be created.

KT_GIT_COMMIT_EMAIL defines the commiter email to use.
KT_GIT_COMMIT_NAME defines the commiter name.

Allow git for snmp config file

05ac863

i3149 requested a review from Copilot February 17, 2026 05:19

Copilot started reviewing on behalf of i3149 February 17, 2026 05:20 View session

Copilot AI reviewed Feb 17, 2026

View reviewed changes

Moving go git to all v6

64e9cbf

i3149 requested a review from Copilot February 17, 2026 15:58

Copilot started reviewing on behalf of i3149 February 17, 2026 15:59 View session

Copilot AI reviewed Feb 17, 2026

View reviewed changes

Allow ktrans config to be loaded remotely also

c7cfdbc

i3149 requested a review from Copilot February 17, 2026 21:39

Copilot started reviewing on behalf of i3149 February 17, 2026 21:40 View session

Copilot AI reviewed Feb 17, 2026

View reviewed changes

i3149 added 2 commits February 18, 2026 11:07

Allow username for auth for git access

5abbd6e

Better string parsing

b19e5a2

i3149 requested a review from Copilot February 18, 2026 19:21

Copilot started reviewing on behalf of i3149 February 18, 2026 19:21 View session

Copilot AI reviewed Feb 18, 2026

View reviewed changes

i3149 added 4 commits February 18, 2026 13:48

cleaning up some

c241838

wip for allowing disco on git configs

1b844e7

Refactor to pull out common code

4eed64c

now supports pull and push to branchs

068745b

i3149 requested a review from Copilot February 21, 2026 21:18

Copilot started reviewing on behalf of i3149 February 21, 2026 21:19 View session

Copilot AI reviewed Feb 21, 2026

View reviewed changes

allow envs for git profiles, fix a typo

c042cf9

i3149 requested a review from Copilot February 21, 2026 22:18

Copilot started reviewing on behalf of i3149 February 21, 2026 22:18 View session

Copilot AI reviewed Feb 21, 2026

View reviewed changes

i3149 added 2 commits February 21, 2026 14:39

re factor

c9de4cc

Setting a better git branch system

0cd41e0

i3149 requested a review from Copilot February 22, 2026 06:21

Copilot started reviewing on behalf of i3149 February 22, 2026 06:22 View session

Copilot AI reviewed Feb 22, 2026

View reviewed changes

Cleaning up some

c218d1c

i3149 merged commit c7b9c7f into main Feb 23, 2026
1 check passed

i3149 deleted the allow-git-clone-ssh branch February 23, 2026 22:52

-	filePath := filepath.Clean(path.Join(segments[2:]...))
+	filePath := filepath.Clean(path.Join(segments[2:]...))
+	// Security: ensure the cleaned filePath does not contain any path traversal components.
+	for _, seg := range strings.Split(filePath, string(os.PathSeparator)) {
+		if seg == ".." {
+			return "", nil, fmt.Errorf("invalid file path in git url (path traversal detected): %s", url.String())
+		}
+	}

-	gitRepo := "https://" + path.Join(url.Host, owner, repo) + ".git"
+	gitURL := &url.URL{
+		Scheme: "https",
+		Host:   url.Host,
+		Path:   path.Join("/", owner, repo) + ".git",
+	}
+	gitRepo := gitURL.String()

Conversation

i3149 commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

i3149 commented Feb 17, 2026 •

edited

Loading