Do not expose dead git-ssh.wikimedia.org service as repo Clone URLs (defined in diffusion.ssh-host setting)
Closed, DeclinedPublic
Actions

Assigned To

None

Authored By

	Aklapper
	Sep 26 2023, 3:23 PM

Description

https://phabricator.wikimedia.org/config/edit/diffusion.ssh-host/ is still set to git-ssh.wikimedia.org which got killed in T296022: Deprecate git-ssh service on phabricator.wikimedia.org:

aklapper@phab1004:~$ sudo /srv/phab/phabricator/bin/config get diffusion.ssh-host
{
  "config": [
    {
      "key": "diffusion.ssh-host",
      "source": "local",
      "value": "git-ssh.wikimedia.org",
      "status": "set",
      "errorInfo": null
    },
    {
      "key": "diffusion.ssh-host",
      "source": "database",
      "value": null,
      "status": "unset",
      "errorInfo": null
    }
  ]
}

It's visible in many Diffusion repositories when you click the green Clone button, e.g. on https://phabricator.wikimedia.org/diffusion/EMMV/

It adds to confusion where potential contributors are supposed to get their code to hack.

Details

Related Changes in GitLab:

	Title	Reference	Author	Source Branch	Dest Branch
	Draft: Do not expose defunct git-ssh.wikimedia.org as repo Clone URL	repos/phabricator/phabricator!21	aklapper	T347408-hide-gitssh-clone-uri	wmf/stable

Customize query in GitLab

Related Objects
Search...

Status	Subtype	Assigned	Task
Declined		None	T244907 Reduce the number of six default URIs in Diffusion
Declined		None	T347408 Do not expose dead git-ssh.wikimedia.org service as repo Clone URLs (defined in diffusion.ssh-host setting)
Resolved	Feature	Aklapper	T361997 Expose only canonical Clone URI in Diffusion when repo hosted externally and Differential disabled

Event Timeline

Aklapper created this task.Sep 26 2023, 3:23 PM

Aklapper triaged this task as Low priority.

Aklapper mentioned this in T347476: Set security.require-https to true.Sep 27 2023, 11:35 AM

thcipriani edited projects, added Release-Engineering-Team (Seen); removed Release-Engineering-Team.Sep 27 2023, 4:54 PM

Aklapper mentioned this in T347577: Understand which repositories we mirror, observe, host in Diffusion (and fix some findings).Oct 24 2023, 8:03 PM

Aklapper renamed this task from Replace dead git-ssh.wikimedia.org service in diffusion.ssh-host setting to Do not expose dead git-ssh.wikimedia.org service as repo Clone URLs (defined in diffusion.ssh-host setting).Oct 24 2023, 11:24 PM

As a mitigation for the time being, I quickly edited those ~2650 ssh://vcs@git-ssh.wikimedia.org URIs to not be exposed when clicking the green Clone button on a Diffusion repo browsing page in the web browser.

#!/bin/bash
# SELECT u.phid, CONCAT("https://phabricator.wikimedia.org/diffusion/", r.id, "/manage/uris/"), r.name, u.uri, u.displayType FROM phabricator_repository.repository_uri u INNER JOIN phabricator_repository.repository r ON r.phid = u.repositoryPHID WHERE u.builtinProtocol = "ssh" AND u.displayType != "never" AND u.uri = "ssh://callsign";
INFILE=/home/acko/diffusionuris
while read -r URI
do
  echo '{"objectIdentifier":"'$URI'", "transactions": [{"type": "display", "value":"never"}]}' | /var/www/html/phorge/arcanist/bin/arc call-conduit --conduit-uri https://phabricator.wikimedia.org --conduit-token api-xxxxxxxxxxxxxxxxxxxxxxxxxxxx diffusion.uri.edit --
  sleep 5
done < "$INFILE"