Cloning from sourcehut (and non-git)

[VorpalBlade]

Cloning https://sr.ht/~icefox/oorandom/
Couldn't clone https://sr.ht/~icefox/oorandom/ repo status=exit status: 128

Well:

$ git clone 'https://sr.ht/~icefox/oorandom/'
Cloning into 'oorandom'...
fatal: remote error: 

You have tried to clone a project from sourcehut, but you probably meant to
clone a specific git repository for this project instead. A single project on
sourcehut often has more than one git repository.



To browse all of the available repositories for this project, visit this URL:

  https://sr.ht/~icefox/oorandom/sources

Digging further into this apparently the correct download link is https://hg.sr.ht/~icefox/oorandom (using hg!). This seems like such a rare edge case that I don't know if you want to bother with it.

1. Suspect repo link to begin with
2. Not git, and how are you supposed to even know that?

Thought I open a case for awareness still. Feel free to close if it is out of scope.

[paolobarbolini]

Well I'll start from the fact I don't even know how that stuff works. Does it have tags or some way of finding the code from a release? 😅

[VorpalBlade]

So, hg (that is the command line program name, the full name is Mercurial) is another version control system, just like git, Subversion and many others. For the most part git won. Mercurial is distributed (just like git, unlike subversion).

We used to use mercurial at work (about a decade ago) before switching to git. I'm trying to remember how to use it. I believe it does have tags and branches (though branches are more than just the automatically moving tags they are in git). Unfortunately it seems this particular project did not use tags, so it wouldn't have helped anyway.

[link2xt]

This should be reported to oorandom maintainers so they fix the repository URL to https://hg.sr.ht/~icefox/oorandom
https://sr.ht/~icefox/oorandom/ should go into homepage, not repository.
I submitted similar fix to RustCrypto/formats#1373, but cargo-goggles (this project) has a workaround for the RustCrypto case.

[link2xt]

As for hg support, this bug should be upstreamed to cargo because it does not support hg in .cargo_vcs_info.json and we don't know the commit which should be checked out for the crate.

[paolobarbolini]

I submitted similar fix to RustCrypto/formats#1373, but cargo-goggles (this project) has a workaround for the RustCrypto case.

I like this idea. We could as part of #11 make a list of crates that need their repo links adjusted. I think the workaround will have to stay in place for a while. Fortunately there doesn't seem to be a way of exploiting it as a vulnerability.