dogged / dogged

Git repository management; a managed .NET Core wrapper for libgit2.

Dogged and is a .NET wrapper around libgit2. It was inspired by the LibGit2Sharp project.

LibGit2Sharp remains the more mature option for .NET development of Git repository management tasks. This library is in early development; Dogged differs from LibGit2Sharp in a number of ways:

• Providing direct native access and a higher-level wrapper
  LibGit2Sharp hides the PInvoke bindings as private methods; Dogged exposes them in the Dogged.Natives package. A number of users want to avoid any managed layer and call the native code directly; with Dogged.Native they can do so.
• More direct native access with minimal caching or pre-loading
  A number of LibGit2Sharp APIs try to "pre-load" data from the underlying native bindings. This allows LibGit2Sharp to offer an API that has few IDisposable types at the expense of always loading data that may go unused. In contrast, Dogged attempts to only load data when necessary.
• A more direct mapping to libgit2
  LibGit2Sharp includes a number of classes that attempt to emulate parts of the Git command-line. Dogged attempts to more directly map libgit2, believing that innovation should occur in the shared native library so that all consumers can benefit, not just the .NET users.

Dogged is available under the MIT license, see the included file LICENSE for details.

dogged's Issues

[Security] Workflow ci.yml is using vulnerable action actions/checkout

The workflow ci.yml is referencing action actions/checkout using references v1. However this reference is missing the commit a6747255bd19d7a757dbdda8c654a9f84db19839 which may contain fix to the some vulnerability.
The vulnerability fix that is missing by actions version could be related to:
(1) CVE fix
(2) upgrade of vulnerable dependency
(3) fix to secret leak and others.
Please consider to update the reference to the action.

Workflows are referencing vulnerable actions

Hello, there!

As part of the university research we are currently doing regarding the security of Github Actions, we noticed that one or many of the workflows that are part of this repository are referencing vulnerable versions of the third-party actions. As part of a disclosure process, we decided to open issues to notify GitHub Community.

Please note that there are could be some false positives in our methodology, thus not all of the open issues could be valid. If that is the case, please let us know, so that we can improve on our approach. You can contact me directly using an email: ikoishy [at] ncsu.edu

Thanks in advance

1. The workflow ci.yml is referencing action gittools/actions/gitversion/setup using references v0.9.6. However this reference is missing the commit 90150b4 which may contain fix to the vulnerability.

The vulnerability fix that is missing by actions' versions could be related to:
(1) CVE fix
(2) upgrade of vulnerable dependency
(3) fix to secret leak and others.
Please consider updating the reference to the action.

If you end up updating the reference, please let us know. We need the stats for the paper :-)

Workflows are referencing vulnerable actions

Hello, there!

As part of the university research we are currently doing regarding the security of Github Actions, we noticed that one or many of the workflows that are part of this repository are referencing vulnerable versions of the third-party actions. As part of a disclosure process, we decided to open issues to notify GitHub Community.

Please note that there are could be some false positives in our methodology, thus not all of the open issues could be valid. If that is the case, please let us know, so that we can improve on our approach. You can contact me directly using an email: ikoishy [at] ncsu.edu

Thanks in advance

1. The workflow ci.yml is referencing action gittools/actions/gitversion/setup using references v0.9.6. However this reference is missing the commit 90150b4 which may contain fix to the vulnerability.

The vulnerability fix that is missing by actions' versions could be related to:
(1) CVE fix
(2) upgrade of vulnerable dependency
(3) fix to secret leak and others.
Please consider updating the reference to the action.

If you end up updating the reference, please let us know. We need the stats for the paper :-)

Missing git_clone_options on low level and higher level to allow authentication

The missing git_clone_options makes the library unusable for most cases. While all options in this struct would be valuable the most crucial part is the remote_cb_payload and the corresponding git_remote_callbacks. Without all these things available authenticating against remote repos with HTTP seems impossible.

Overall plans on completing the Dogged.Native layer

In follow up of #25 I was wondering what your plans are to complete the Dogged.Native layer to really provide a full 1:1 mapping of the libgit2. While some basics seem to be there, I would say most of the essentials are fully missing.

If you think of a workflow like:

1. Cloning a repo from GitHub.
2. Changing a branch
3. Creating a new branch from it
4. Making changes and staging them
5. Commiting them
6. Pushing them
7. Deleting the local branch

Many things on the path are missing because respective functions and structs are not ported over. The lib seem to have big potential but with this state it is rather a PoC level codebase than a real library. 😞

[Security] Workflow ci.yml is using vulnerable action actions/checkout

The workflow ci.yml is referencing action actions/checkout using references v1. However this reference is missing the commit a6747255bd19d7a757dbdda8c654a9f84db19839 which may contain fix to the some vulnerability.
The vulnerability fix that is missing by actions version could be related to:
(1) CVE fix
(2) upgrade of vulnerable dependency
(3) fix to secret leak and others.
Please consider to update the reference to the action.