git-gate clone fails with empty reply on Apple-container backend (access-hook not executable) #404

New Issue

2026-07-17T21:53:38-04:00

didericis-claude commented

2026-07-17 21:53:38 -04:00

Summary

Cloning/fetching from the per-agent git-gate on the Apple-container backend fails with git clone reporting "empty reply from server" (curl exit 52). It presents as an auth/network failure but is neither — attribution and routing work; the gateway's git-http handler crashes on every upload-pack:

File "/app/git_http_backend.py", line 151, in _run_backend
    hook = subprocess.run([hook_path, "upload-pack", ...])
PermissionError: [Errno 13] Permission denied: '/etc/git-gate/access-hook'

Root cause

The access-hook is exec'd directly, so it needs the x bit. git_gate.prepare() stages it 0o700 and trusts the gateway copy to carry that mode. docker cp preserves source mode; the Apple container cp (AppleGatewayTransport.cp_into) does not, landing the hook 0o644 → EACCES. The unhandled exception kills the handler thread, closing the socket with no HTTP response — the opaque "empty reply."

Only fetch/clone breaks: the pre-receive (push) hook is run via sh <script>, so it doesn't need the x bit.

Impact

git-gate clone/fetch is fully broken on the Apple-container backend. A live agent bottle could not clone the repo.

Fix

provision_git_gate should chmod +x the access-hook gateway-side after the copy (backend-neutral).
git-http handler should fail closed (503) on an un-execable/timed-out hook instead of crashing into an empty reply.

Fixed in #403.

## Summary Cloning/fetching from the per-agent git-gate on the **Apple-container backend** fails with `git clone` reporting "empty reply from server" (curl exit 52). It presents as an auth/network failure but is neither — attribution and routing work; the gateway's git-http handler crashes on every upload-pack: ``` File "/app/git_http_backend.py", line 151, in _run_backend hook = subprocess.run([hook_path, "upload-pack", ...]) PermissionError: [Errno 13] Permission denied: '/etc/git-gate/access-hook' ``` ## Root cause The access-hook is exec'd directly, so it needs the x bit. `git_gate.prepare()` stages it `0o700` and trusts the gateway copy to carry that mode. `docker cp` preserves source mode; the Apple `container cp` (`AppleGatewayTransport.cp_into`) does **not**, landing the hook `0o644` → `EACCES`. The unhandled exception kills the handler thread, closing the socket with no HTTP response — the opaque "empty reply." Only fetch/clone breaks: the pre-receive (push) hook is run via `sh <script>`, so it doesn't need the x bit. ## Impact git-gate clone/fetch is fully broken on the Apple-container backend. A live agent bottle could not clone the repo. ## Fix - `provision_git_gate` should `chmod +x` the access-hook gateway-side after the copy (backend-neutral). - git-http handler should fail closed (503) on an un-execable/timed-out hook instead of crashing into an empty reply. Fixed in #403.

didericis-claude added the Kind/Bug label 2026-07-17 21:53:38 -04:00

didericis-claude referenced a pull request that will close this issue

2026-07-17 21:54:26 -04:00

fix(git-gate): make the gateway access-hook executable regardless of copy transport #403

didericis closed this issue

2026-07-17 22:00:58 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: didericis/bot-bottle#404