Skip to content

fix: handle go-git extension validation errors gracefully#2970

Merged
migmartri merged 3 commits intochainloop-dev:mainfrom
migmartri:fix/revert-go-git-worktreeconfig
Mar 30, 2026
Merged

fix: handle go-git extension validation errors gracefully#2970
migmartri merged 3 commits intochainloop-dev:mainfrom
migmartri:fix/revert-go-git-worktreeconfig

Conversation

@migmartri
Copy link
Copy Markdown
Member

@migmartri migmartri commented Mar 30, 2026

Summary

  • Handle go-git v5.17.x extension validation errors gracefully in gracefulGitRepoHead so attestation init doesn't fail in repos using git worktree
  • Keeps go-git at v5.17.1 for its security fixes; the worktreeConfig incompatibility is worked around on our side until upstream fixes the case-sensitivity bug in their extension validation (go-git/go-git#1861)

Closes #2966

go-git v5.17.0 introduced strict repository extension validation
(go-git/go-git#1861) with a case-sensitivity bug that rejects the
worktreeConfig extension, breaking attestation init in repos using
git worktree.

Reverts to v5.16.5 and adds defensive handling in gracefulGitRepoHead
so unsupported extension errors degrade gracefully instead of failing
the attestation.

Closes chainloop-dev#2966

Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>
Copy link
Copy Markdown

@cubic-dev-ai cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 4 files

Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>
@kusari-inspector
Copy link
Copy Markdown

kusari-inspector bot commented Mar 30, 2026

Kusari Inspector

Kusari Analysis Results:

Proceed with these changes

✅ No Flagged Issues Detected
All values appear to be within acceptable risk parameters.

No pinned version dependency changes, code issues or exposed secrets detected!

Note

View full detailed analysis result for more information on the output and the checks that were run.


@kusari-inspector rerun - Trigger a re-analysis of this PR
@kusari-inspector feedback [your message] - Send feedback to our AI and team
See Kusari's documentation for setup and configuration.
Commit: 64e9bef, performed at: 2026-03-30T22:22:09Z

Found this helpful? Give it a 👍 or 👎 reaction!

@migmartri migmartri requested a review from a team March 30, 2026 22:18
Copy link
Copy Markdown
Contributor

@matiasinsaurralde matiasinsaurralde left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense

@kusari-inspector
Copy link
Copy Markdown

Kusari PR Analysis rerun based on - 73b801d performed at: 2026-03-30T22:20:44Z - link to updated analysis

Switches from string-based error matching to using go-git's exported
error variables now that we stay on v5.17.1.

Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>
@migmartri migmartri changed the title fix: revert go-git to v5.16.5 and handle extension errors gracefully fix: handle go-git extension validation errors gracefully Mar 30, 2026
@kusari-inspector
Copy link
Copy Markdown

Kusari PR Analysis rerun based on - 64e9bef performed at: 2026-03-30T22:22:09Z - link to updated analysis

@migmartri migmartri merged commit 8a3e6e7 into chainloop-dev:main Mar 30, 2026
14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Attestation init fails: go-git v5.17.1 does not support worktreeconfig extension

2 participants