Re: Secure Vcs-Git on alioth

[Jakub Wilk <jwilk@debian.org>]

* Yuri D'Elia <wavexx@thregr.org>, 2016-07-17, 14:15:
> Regarding Lintian's informational warning about insecure git:// URIs in 
> the Vcs-Git field:
>
> https://lintian.debian.org/tags/vcs-field-uses-insecure-uri.html
>
> I can switch easily from:
>
>  git://anonscm.debian.org/collab-maint/trend.git
>
> to
>
>  https://anonscm.debian.org/git/collab-maint/trend.git
>
> however shallow cloning (which I use regularly), breaks.

Are you sure it's about git:// vs https://? Shallow cloning has never 
worked for me reliably:

$ git clone -v --depth=10 git://anonscm.debian.org/collab-maint/trend.git
Cloning into 'trend'...
Looking up anonscm.debian.org ... done.
Connecting to anonscm.debian.org (port 9418) ... 5.153.231.21 done.
fatal: The remote end hung up unexpectedly
fatal: early EOF
fatal: index-pack failed

$ git clone -v --depth=10 https://anonscm.debian.org/git/collab-maint/trend.git
Cloning into 'trend'...
POST git-upload-pack (156 bytes)
POST git-upload-pack (165 bytes)
fatal: The remote end hung up unexpectedly
fatal: protocol error: bad pack header

--
Jakub Wilk