wrolpi/modules/repos
Roland 2dd8e908c2
repos: check submodule URLs where git resolves them
A relative submodule URL is resolved by git against the repo's remote,
and can climb to another host: with the remote
https://git.example.com/owner/repo, `../../../10.0.0.5/x` is
https://10.0.0.5/x.  Relative URLs were allowed unchecked.

git now resolves the URLs first (`submodule init` + `sync` write them to
the repo's config), and those resolved URLs, the ones git fetches, are
checked.  A relative URL is never allowed by the check itself.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-06 16:56:10 -06:00
..
test repos: check submodule URLs where git resolves them 2026-10-06 16:56:10 -06:00
__init__.py Add a Repos module that mirrors git repositories (backend) 2026-10-06 16:56:09 -06:00
api.py repos: history, Download ZIP, and submodules 2026-10-06 16:56:09 -06:00
conftest.py repos: never fetch submodules from WROLPi's own network 2026-10-06 16:56:09 -06:00
downloader.py repos: check submodule URLs where git resolves them 2026-10-06 16:56:10 -06:00
errors.py Add a Repos module that mirrors git repositories (backend) 2026-10-06 16:56:09 -06:00
lib.py repos: check submodule URLs where git resolves them 2026-10-06 16:56:10 -06:00
models.py repos: history, Download ZIP, and submodules 2026-10-06 16:56:09 -06:00
schema.py repos: history, Download ZIP, and submodules 2026-10-06 16:56:09 -06:00