[ ] Before git runs, the mirror code (src/…/git-mirror.ts) vets the clone URL's host with vetHost. A private answer ends the sync with one sentence in the mirror's status.
[ ] git runs with http.curloptResolve=<host>:<port>:<vetted ip>, http.followRedirects=false and GIT_ALLOW_PROTOCOL=https:http (the same environment migrate uses, shared from one function, not copied).
[ ] Tests: a mirror whose remote resolves to 127.0.0.1 is refused without git starting, and the git environment carries the three settings.
Files: git-mirror.ts, the shared git-env helper, test/mirror*.test.ts.
Last third of #2921.
Done looks like:
vetHost. A private answer ends the sync with one sentence in the mirror's status.http.curloptResolve=<host>:<port>:<vetted ip>,http.followRedirects=falseandGIT_ALLOW_PROTOCOL=https:http(the same environment migrate uses, shared from one function, not copied).Files: git-mirror.ts, the shared git-env helper, test/mirror*.test.ts.