figure out a way to test libgit2 host verification

[StefanKarpinski]

This applies to both TLS and SSH transports.

• We need a way to mock up an HTTPS server and an SSH server.
• We want to be able to simulate both valid and invalid hosts for each.
• For SSH we need to be able to do this on both port 22 and some other non-standard port.

Not urgent, but it would be good to test that this stuff actually works.

[Amval]

Hi, not sure if it relates to this, but I think host verification error doesn't work properly (See this issue I opened). Is this a known issue and what this issue refers to?

From what I have read here, the libgit2 seems to cause a lot of issues :/

[StefanKarpinski]

Yes, libgit2 is a train wreck. I'm very keen on ditching it.

[DilumAluthge]

If we make https://github.com/JuliaVersionControl/Git.jl a stdlib, then it won't be hard to add command-line Git support to Pkg.

https://github.com/JuliaVersionControl/Git.jl depends on Git_jll.jl, so we'd also need to make Git_jll.jl (and all of its dependencies, recursively) into stdlibs.

[giordano]

Git is fat though, about 50 MiB on Windows. Libgit2 is less than 1 MiB for all platforms. In principle a shared library to call into is better, especially if you want to do things programmatically (parsing git output isn't fun, nor fast). If only libgit2 hadn't a fair share of quirks...

[DilumAluthge]

Git is fat though, about 50 MiB on Windows.

Yeah, that is definitely non-trivial.

Out of curiosity, what is the size on Linux and macOS? Roughly similar, I assume?

[giordano]

Out of curiosity, what is the size on Linux and macOS? Roughly similar, I assume?

13 on macOS, ~40 on Linux: https://github.com/JuliaBinaryWrappers/Git_jll.jl/releases/tag/Git-v2.31.0%2B0. Windows is larger because git is a collection of some dozens of identical applications with different names which simply symlinks to git: on Windows we can't have symlinks, and we must concretize them into copies