Fix git auth

[roberth]

Motivation

Private repos should work, as they did.

Done

• integration test
• test manually with github

Follow-up:

• add shallow fetching back in
  • Not sure what to do because shallow fetching had some issues
  • See comment

Context

• Thank you @DavHau for helping with the tests

  • initialize test suite for git fetchers #9676

• I've looked at reimplementing the git credentials protocol, but I'm not eager to maintain a custom, security sensitive component in a place where it won't find contributors. That, and we have more important things to do!

Priorities and Process

Add 👍 to pull requests you find important.

The Nix maintainer team uses a GitHub project board to schedule and track reviews.

[roberth]

• Tracking git command dependency blockers in Remove runtime dependency on git package #9807

[DavHau]

[ ] add shallow fetching back in?

* Not sure what to do because shallow fetching had some issues

It shouldn't be an issue to add it back. The only problem was, that in order to reliably fetch shallowly nix would have to ignore any ref passed by the user. But the nix team decided that loosening that check isn't an issue.

Another problem to fix: never share the same cache between shallow and non-shallow clones of the same repo, otherwise we will trip into certain issues which computing revCounts etc.

Other than that I don't see any blockers. It should be easy to enable it.

[DavHau]

@roberth I re-implemented the shallow fetching via 674354c
It includes several tests ensuring correct behavior
Feel free to cherry-pick and modify as you wish

[thufschmitt]

It's quite sad that we can't have that on top of libgit2. But Fixing the bug is the priority here, so 👍

[DavHau]

I opened a separate PR with the shallow changes, just in case you want to deal with it separately: #9811

[edolstra]

The PR title "Fix git auth" is a bit misleading when what it actually does is "reintroduce the git dependency".

Rather than rip out the libgit code entirely, I would have preferred an #if 0 (as we had before 21bb180), or even better, make it runtime configurable (e.g. use libgit if git doesn't exist in $PATH).

[roberth]

what it actually does is "reintroduce the git dependency".

... is a bit misleading, because that dependency was never removed.

This topic can be discussed constructively at #9807.

#if 0

I did consider this, but I removed it because it would bitrot.

make it runtime configurable (e.g. use libgit if git doesn't exist in $PATH)

This increases the maintenance burden, and requires that we always ask in bug reports whether the user's Nix uses the git CLI or not, which is a non-obvious question, and in some cases hard to answer. We could try engineer the error messages for this, but I'd rather solve a domain problem than spend resources on such extrinsic complexity. However, even then, it is not a complete solution because of the other work on #9807. I'd suggest to work on more relevant problems.