Repository: containers/buildah

Issue #4032: FR: Support ssh:// protocol
Created: 2022-06-03T13:31:36Z
Currently, it is possible to build an image from a git repository by prefixing the context argument with git:// or postfixing with .git. Sadly, this uses the raw git protocol without authentication. Most users want the https protocol or git over ssh (git+ssh).
Since the clone is delegated to the git command, you need to specify either ssh:// or git+ssh:// to use that protocol. Neither of those prefixes is recognized by buildah.
I have added the relevant lines in the code (types.go, strings.HasPrefix(url, "git+ssh://") in the two places required), but I'm not able to comprehend the code further. It looks from my testing like the cloning happens in an isolated namespace which doesn't have access either to ~/.ssh or to the SSH_AUTH_SOCK, whether --ssh is used or not.
Would love to hear what others think about this and whether it would be possible to allow building images from ssh repositories.
> buildah build --debug 'git+ssh://git@github.com/containers/buildah.git'
DEBU[0000] cloning "git+ssh://git@github.com/containers/buildah.git" to "/var/tmp/buildah1505040640"
error prepping temporary context directory: cloning "git+ssh://git@github.com/containers/buildah.git" to "/var/tmp/buildah1505040640":
Cloning into '/var/tmp/buildah1505040640'...
Bad owner or permissions on /etc/ssh/ssh_config.d/05-redhat.conf
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
: exit status 128
DEBU[0000] exit status 128

Version:         1.27.0-dev
Go Version:      go1.17.7
Image Spec:      1.0.2-dev
Runtime Spec:    1.0.2-dev
CNI Spec:        1.0.0
libcni Version:  v1.1.1
image Version:   5.21.2-dev
Git Commit:      fb28761c
Built:           Fri Jun  3 14:31:44 2022
OS/Arch:         linux/amd64
BuildPlatform:   linux/amd64

Duplicate issue #4103: regression building from `git://` URL
Created: 2022-07-11T14:11:46Z
BUG REPORT INFORMATION
Description
podman build regressed in building from git://
For a while now I've got a build that runs that builds from a git:// url. This started failing earlier this year,  but I didn't realize it until recently. Here is how it fails today:
[runner@dustymabe ~]$ podman build --pull-always -t localhost/dustymabecom:latest git://github.com/dustymabe/dustymabe.com#main                              
Error: error prepping temporary context directory: cloning "git://github.com/dustymabe/dustymabe.com#main" to "/var/tmp/buildah3856140366":                  
Cloning into '/var/tmp/buildah3856140366'...                                                                                                                 
fatal: unable to connect to github.com:                                                                                                                      
github.com[0: 140.82.112.4]: errno=Connection timed out                                                                                                      
                                                                                                                                                             
: exit status 128

On this node this worked up until March. Inspecting the last container image that was built successfully using this model I see:
[runner@dustymabe ~]$ podman inspect cc76ed6eef3e | jq ".[].Created"
"2022-03-09T23:14:46.382232815Z"
[runner@dustymabe ~]$ podman inspect cc76ed6eef3e | jq ".[].Labels"
{
  "io.buildah.version": "1.23.1",
  "license": "MIT",
  "name": "fedora",
  "vendor": "Fedora Project",
  "version": "35"
}

So this worked up until March of this year with Buildah 1.23.1. So I started to go back to older versions of Fedora CoreOS to try to find where this broke. What I found is that it now doesn't work even on the older versions. My only explanation for this is that something changed on the remote server (GitHub). Still I think it's worth reporting here so we can try to get to the bottom of the issue.
Workaround: I worked around this issue by switching the URL to this form: https://github.com/dustymabe/dustymabe.com.git#main
Steps to reproduce the issue:

run podman build -t localhost/dustymabecom:latest git://github.com/dustymabe/dustymabe.com#main

Describe the results you received:
Failed build unable to connect to github.com
Describe the results you expected:
Successful build
Output of rpm -q buildah or apt list buildah:
podman-4.1.1-1.fc36.aarch64

Output of buildah version:
$ podman info | grep -i buildah
  buildahVersion: 1.26.1

Output of podman version if reporting a podman build issue:
$ podman version
Client:       Podman Engine
Version:      4.1.1
API Version:  4.1.1
Go Version:   go1.18.3
Built:        Wed Jun 15 14:33:05 2022
OS/Arch:      linux/arm64

Output of cat /etc/*release:
$ cat /etc/*release
Fedora release 36 (Thirty Six)
NAME="Fedora Linux"
VERSION="36.20220703.1.1 (CoreOS)"
ID=fedora
VERSION_ID=36
VERSION_CODENAME=""
PLATFORM_ID="platform:f36"
PRETTY_NAME="Fedora CoreOS 36.20220703.1.1"
ANSI_COLOR="0;38;2;60;110;180"
LOGO=fedora-logo-icon
CPE_NAME="cpe:/o:fedoraproject:fedora:36"
HOME_URL="https://getfedora.org/coreos/"
DOCUMENTATION_URL="https://docs.fedoraproject.org/en-US/fedora-coreos/"
SUPPORT_URL="https://github.com/coreos/fedora-coreos-tracker/"
BUG_REPORT_URL="https://github.com/coreos/fedora-coreos-tracker/"
REDHAT_BUGZILLA_PRODUCT="Fedora"
REDHAT_BUGZILLA_PRODUCT_VERSION=36
REDHAT_SUPPORT_PRODUCT="Fedora"
REDHAT_SUPPORT_PRODUCT_VERSION=36
PRIVACY_POLICY_URL="https://fedoraproject.org/wiki/Legal:PrivacyPolicy"
VARIANT="CoreOS"
VARIANT_ID=coreos
OSTREE_VERSION='36.20220703.1.1'
DEFAULT_HOSTNAME=localhost
Fedora release 36 (Thirty Six)
Fedora release 36 (Thirty Six)

Output of uname -a:
$ uname -a
Linux dustymabe.com 5.18.7-200.fc36.aarch64 #1 SMP PREEMPT_DYNAMIC Sat Jun 25 19:48:53 UTC 2022 aarch64 aarch64 aarch64 GNU/Linux

Output of cat /etc/containers/storage.conf:
$ ls -l /etc/containers/storage.conf /var/home/$USER/.config/containers/storage.conf
ls: cannot access '/etc/containers/storage.conf': No such file or directory
ls: cannot access '/var/home/runner/.config/containers/storage.conf': No such file or directory

Closing comment (2022-08-17T13:34:57Z): Also related to #4032. Using git:// should issue a warning, it is insecure and users probably want either https:// for public repos ro ssh:// for private repos.