Attestation init fails: go-git v5.17.1 does not support worktreeconfig extension #2966

Activity

1. linear

   added

   component/CLI

   bugSomething isn't workingSomething isn't working

   User Bug

   on Mar 30, 2026
2. migmartri commented on Mar 30, 2026

   

   migmartri

   on Mar 30, 2026

   MemberAuthor

   More actions

   Root Cause Analysis

   The go-git v5.17.0 release introduced strict extension validation in go-git/go-git#1861. This validation has a case-sensitivity bug that causes it to reject the worktreeConfig extension.

   The bug in go-git

   In repository_extensions.go:

   1. The extensions() function lowercases all extension names via strings.ToLower(opt.Key) → produces "worktreeconfig"
   2. The extensionsValidForV0 allowlist uses mixed case: "worktreeConfig"
   3. Go map lookups are case-sensitive, so extensionsValidForV0["worktreeconfig"] misses the "worktreeConfig" entry → extension appears unsupported

   For repos with repositoryFormatVersion=1 (standard when using git worktree), worktreeConfig also isn't in builtinExtensions at all, so it fails via the ErrUnknownExtension path regardless.

   The chain in Chainloop

   • pkg/attestation/crafter/crafter.go:318 — gracefulGitRepoHead calls git.PlainOpenWithOptions
   • go-git now calls verifyExtensions during open, which rejects worktreeConfig
   • The error propagates up as a hard failure, breaking attestation init

   Fix options

   1. Chainloop-side (short-term): Handle extension errors gracefully in gracefulGitRepoHead — it already degrades gracefully for missing repos/refs (returns nil). The unknown/unsupported extension errors should get the same treatment so attestation can proceed without git metadata.
   2. Upstream (go-git): File a bug about the case-sensitivity issue in extensionsValidForV0 and the missing worktreeConfig support in builtinExtensions.
   3. Pin go-git: Revert to v5.16.5 until upstream is fixed (loses the security fixes from the bump).
3. migmartri

   added a commit that references this issue on Mar 30, 2026

   fix: revert go-git to v5.16.5 and handle extension errors gracefully

   ...

   This issue will close once commit 134c3aa is merged into the 'main' branch.

   134c3aa
4. migmartri

   closed this as completedin #2970on Mar 30, 2026