Repository navigation
Go: Pass proxy certificate to git via GIT_SSL_CAINFO - #22897
Conversation
The extractor ran `git config --global http.sslCAInfo <temp cert>` when private `git_source` registries were configured. That permanently modified the user's global git configuration, and on non-ephemeral (e.g. self-hosted) runners it kept pointing at a temporary certificate file after the job finished, breaking later git HTTPS operations. Instead, set `GIT_SSL_CAINFO` alongside `SSL_CERT_FILE` in the environment that `ApplyProxyEnvVars` applies to `go` commands. This is picked up by the `git` processes `go` spawns, and is scoped to those subprocesses. Co-authored-by: Copilot <[email protected]>
Document the proxy certificate behavior without referring to the previous global Git configuration, and add a change note. Co-authored-by: Copilot <[email protected]>
ab0398d to
18094d8
Compare
There was a problem hiding this comment.
🔵 Needs a closer look
The broader Git certificate-trust scope needs human validation, and dependency-loading paths still omit the proxy CA environment.
1 open issue
What changed in this PR
This PR moves the Go extractor’s registry-proxy certificate configuration from global Git settings to subprocess environment variables, avoiding persistent changes to the user’s Git configuration.
Changes:
- Pass the proxy CA through
GIT_SSL_CAINFOalongsideSSL_CERT_FILE. - Add a unit test checking both certificate environment variables.
- Add a Go library change note.
| File | Description |
|---|---|
go/ql/lib/change-notes/2026-10-26-registry-proxy-certificate.md |
Documents proxy certificate handling. |
go/extractor/registries/registryproxy.go |
Replaces global Git configuration with an environment variable. |
go/extractor/registries/registryproxy_test.go |
Checks that both certificate variables reference the temporary file. |
Review effort: Max
| result = append( | ||
| result, | ||
| fmt.Sprintf("SSL_CERT_FILE=%s", proxy_cert_file), | ||
| fmt.Sprintf("GIT_SSL_CAINFO=%s", proxy_cert_file), |
There was a problem hiding this comment.
I think this was already the case for SSL_CERT_FILE. So this seems out-of-scope of this PR?
There was a problem hiding this comment.
ListWithEnvreplaces the environment configured byGoCommand(go/extractor/toolchain/toolchain.go:226–227), andpackages.Loadreceives no proxy environment (go/extractor/extractor.go:176–185).
These are existing (potential) issues unrelated to the change in this PR.
Removing the global
http.sslCAInfosetting therefore leaves Git fetches from these paths without the proxy CA, so uncached private modules can fail certificate verification. Preserve the configured environment inListWithEnv, pass it throughpackages.Config.Env, and add regression coverage for both paths.
This is logically disconnected from the previous part. If we don't configure the proxy for the above commands, then the certificate is also not needed. We either need everything at once or nothing.
I don't think we should address that some commands don't get the proxy environment in this PR. We haven't received any indications that this is a problem right now.
The behavioural change here is that we now always set GIT_SSL_CAINFO if the proxy is running, even if there are no git_source registries configured. Previously, we'd only run git config if there was at least one git_source.
This change makes sense though, because we previously also set the HTTP(S)_PROXY environment variables regardless of whether there was a git_source or not. The new behaviour for GIT_SSL_CAINFO makes sense with respect to that.
mbg
left a comment
mbg
left a comment
There was a problem hiding this comment.
The changes here look good to me. I don't think Copilot's comment is about the change in this PR. While there is a slight behavioural change in when we set GIT_SSL_CAINFO compared to when we called git config before, that makes sense to me since we also always set the proxy vars as long as the proxy is running.
| result = append( | ||
| result, | ||
| fmt.Sprintf("SSL_CERT_FILE=%s", proxy_cert_file), | ||
| fmt.Sprintf("GIT_SSL_CAINFO=%s", proxy_cert_file), |
There was a problem hiding this comment.
ListWithEnvreplaces the environment configured byGoCommand(go/extractor/toolchain/toolchain.go:226–227), andpackages.Loadreceives no proxy environment (go/extractor/extractor.go:176–185).
These are existing (potential) issues unrelated to the change in this PR.
Removing the global
http.sslCAInfosetting therefore leaves Git fetches from these paths without the proxy CA, so uncached private modules can fail certificate verification. Preserve the configured environment inListWithEnv, pass it throughpackages.Config.Env, and add regression coverage for both paths.
This is logically disconnected from the previous part. If we don't configure the proxy for the above commands, then the certificate is also not needed. We either need everything at once or nothing.
I don't think we should address that some commands don't get the proxy environment in this PR. We haven't received any indications that this is a problem right now.
The behavioural change here is that we now always set GIT_SSL_CAINFO if the proxy is running, even if there are no git_source registries configured. Previously, we'd only run git config if there was at least one git_source.
This change makes sense though, because we previously also set the HTTP(S)_PROXY environment variables regardless of whether there was a git_source or not. The new behaviour for GIT_SSL_CAINFO makes sense with respect to that.
Summary
GIT_SSL_CAINFOin the Go command environment.Validation
go test ./registries