ci: enforce canonical issue metadata policy

Dockerfile.gateway

@@ -66,25 +66,11 @@ RUN pip install --no-cache-dir mitmproxy==11.1.3
 # would pin us to that image's cadence). python (already present) does the
 # download so we add no curl/wget. trixie apt also ships gitleaks, but an
 # older 8.16; the pinned download keeps the verified 8.30.1.
-#
-# Arch-aware: the asset + SHA are picked from the build's target
-# architecture so an arm64 host (Apple Silicon) gets the arm64 binary
-# rather than an x86_64 one that dies with "Exec format error" the first
-# time the pre-receive hook runs it. TARGETARCH is auto-populated by
-# BuildKit; the dpkg fallback keeps it correct under a legacy builder.
 ARG GITLEAKS_VERSION=8.30.1
-ARG GITLEAKS_SHA256_AMD64=551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
-ARG GITLEAKS_SHA256_ARM64=e4a487ee7ccd7d3a7f7ec08657610aa3606637dab924210b3aee62570fb4b080
-ARG TARGETARCH
-RUN arch="${TARGETARCH:-$(dpkg --print-architecture)}" \
- && case "$arch" in \
-      amd64) asset="linux_x64";   sha="${GITLEAKS_SHA256_AMD64}" ;; \
-      arm64) asset="linux_arm64"; sha="${GITLEAKS_SHA256_ARM64}" ;; \
-      *) echo "unsupported gitleaks target arch: $arch" >&2; exit 1 ;; \
-    esac \
- && url="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_${asset}.tar.gz" \
+ARG GITLEAKS_SHA256=551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
+RUN url="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
  && python3 -c "import sys,urllib.request; urllib.request.urlretrieve(sys.argv[1], '/tmp/gitleaks.tar.gz')" "$url" \
- && echo "${sha}  /tmp/gitleaks.tar.gz" | sha256sum -c - \
+ && echo "${GITLEAKS_SHA256}  /tmp/gitleaks.tar.gz" | sha256sum -c - \
  && tar -xzf /tmp/gitleaks.tar.gz -C /usr/bin gitleaks \
  && rm /tmp/gitleaks.tar.gz
 

bot_bottle/backend/docker/gateway_provision.py

@@ -94,12 +94,6 @@ def provision_git_gate(
     transport.exec(["mkdir", "-p", "/etc/git-gate"])
     transport.cp_into(str(plan.hook_script), "/etc/git-gate/pre-receive")
     transport.cp_into(str(plan.access_hook_script), "/etc/git-gate/access-hook")
-    # The access-hook is exec'd directly (not via `sh`), so it needs the x bit.
-    # Set it here rather than trusting the copy to carry the staged 0o700:
-    # `docker cp` preserves source mode, but the Apple `container cp` does not,
-    # landing the hook 0o644 → EACCES when the git-http handler tries to exec it.
-    # chmod on the gateway side is backend-neutral and fixes every transport.
-    transport.exec(["chmod", "+x", "/etc/git-gate/access-hook"])
     creds = _creds_dir(bottle_id)
     transport.exec(["mkdir", "-p", creds])
     for u in plan.upstreams:

bot_bottle/git_gate.py

@@ -112,10 +112,8 @@ class GitGate(ABC):
         access_hook = stage_dir / "git_gate_access_hook.sh"
         access_hook.write_text(git_gate_render_access_hook())
         # 0o700 (not 0o600): git daemon execs --access-hook directly,
-        # not via `sh`, so the script needs the x bit. The gateway copy
-        # does not necessarily preserve this mode (`docker cp` does, the
-        # Apple `container cp` does not), so provision_git_gate re-applies
-        # +x on the gateway side — see backend/docker/gateway_provision.py.
+        # not via `sh`, so the script needs the x bit. docker cp
+        # preserves source mode into the container.
         access_hook.chmod(0o700)
         upstreams_with_files: list[GitGateUpstream] = []
         for u in upstreams:

bot_bottle/git_http_backend.py

@@ -148,24 +148,12 @@ class GitHttpHandler(BaseHTTPRequestHandler):
                 "GIT_GATE_ACCESS_HOOK", "/etc/git-gate/access-hook",
             )
             peer = self.client_address[0]
-            try:
-                hook = subprocess.run(
-                    [hook_path, "upload-pack", str(repo_dir), peer, peer],
-                    capture_output=True,
-                    check=False,
-                    timeout=GIT_GATE_TIMEOUT_SECS,
-                )
-            except (OSError, subprocess.SubprocessError) as exc:
-                # The access-hook couldn't be run (missing, not executable,
-                # timed out, …). Fail closed with a real HTTP error rather
-                # than letting the exception kill the handler thread — an
-                # unhandled exception closes the socket with no response, which
-                # the client sees as an opaque "empty reply from server".
-                self.log_message(
-                    "access-hook could not run for %s: %s", parsed.path, exc,
-                )
-                self.send_error(503, "git-gate access-hook unavailable")
-                return
+            hook = subprocess.run(
+                [hook_path, "upload-pack", str(repo_dir), peer, peer],
+                capture_output=True,
+                check=False,
+                timeout=GIT_GATE_TIMEOUT_SECS,
+            )
             if hook.returncode != 0:
                 detail = (hook.stderr or hook.stdout).decode(
                     "utf-8", errors="replace",

tests/unit/test_gateway_provision.py

@@ -69,18 +69,6 @@ class TestProvisionGitGate(unittest.TestCase):
         self.assertEqual(1, len(exec_scripts))
         self.assertIn("repo=/git/bottle1/${name}.git", exec_scripts[0][-1])
 
-    def test_makes_access_hook_executable_on_the_gateway(self) -> None:
-        # Regression: the access-hook is exec'd directly, so it needs the x
-        # bit. The copy alone can't be trusted to carry the staged 0o700
-        # (`docker cp` preserves mode, the Apple `container cp` does not),
-        # so provisioning must re-apply +x on the gateway side.
-        calls: list[list[str]] = []
-        with patch(_RUN, side_effect=_recorder(calls)):
-            provision_git_gate(DockerGatewayTransport("gw"), "bottle1", _plan(_up("foo")))
-        self.assertIn(
-            ["docker", "exec", "gw", "chmod", "+x", "/etc/git-gate/access-hook"], calls,
-        )
-
     def test_omits_known_hosts_copy_when_absent(self) -> None:
         calls: list[list[str]] = []
         with patch(_RUN, side_effect=_recorder(calls)):

tests/unit/test_git_http_backend.py

@@ -364,48 +364,6 @@ class TestGitHttpBackend(unittest.TestCase):
                 self.assertIn("access-hook denied", logged)
                 self.assertIn("exit=2", logged)
 
-    def test_access_hook_that_cannot_run_fails_closed_503(self):
-        """Regression: when the access-hook can't be exec'd (missing / not
-        executable — a PermissionError from subprocess.run), the handler must
-        fail closed with a real HTTP status instead of letting the exception
-        kill the thread, which closes the socket with no response and the
-        client sees an opaque "empty reply from server"."""
-        from http.server import ThreadingHTTPServer
-        import io
-        import sys
-
-        with tempfile.TemporaryDirectory() as tmp:
-            root = Path(tmp)
-            (root / "repo.git").mkdir()
-            old_root = os.environ.get("GIT_PROJECT_ROOT")
-            os.environ["GIT_PROJECT_ROOT"] = str(root)
-            self.addCleanup(self._restore_env, old_root)
-
-            server = ThreadingHTTPServer(("127.0.0.1", 0), GitHttpHandler)
-            thread = threading.Thread(target=server.serve_forever, daemon=True)
-            thread.start()
-            self.addCleanup(server.shutdown)
-            self.addCleanup(server.server_close)
-
-            with mock.patch(
-                "bot_bottle.git_http_backend.subprocess.run",
-                side_effect=PermissionError(13, "Permission denied"),
-            ):
-                buf = io.StringIO()
-                with mock.patch.object(sys, "stdout", buf):
-                    req = urllib.request.Request(
-                        f"http://127.0.0.1:{server.server_port}"
-                        "/repo.git/info/refs?service=git-upload-pack",
-                        method="GET",
-                    )
-                    try:
-                        urllib.request.urlopen(req, timeout=5)
-                        self.fail("expected HTTPError 503")
-                    except urllib.error.HTTPError as e:  # type: ignore
-                        self.assertEqual(503, e.code)
-
-                self.assertIn("access-hook could not run", buf.getvalue())
-
     @staticmethod
     def _restore_env(value: str | None) -> None:
         if value is None: