Restrict SSH auth to SSH/git URL schemes in setGitAuth

go-git's HTTP transport does not accept *ssh.PublicKeys, so applying
SSH auth to an https:// URL causes the clone to fail with a confusing
transport error. Guard the SSH auth path with an isSSH check.

If ?sshkey= is explicitly provided for an HTTP(S) URL, return a clear
error. If Auth.SSHPrivateKey is set alongside an HTTP(S) URL, silently
ignore it and fall through to HTTP basic auth.

Author: thardeck

internal/bundlereader/gitclone.go

@@ -127,12 +127,26 @@ func gitDownload(ctx context.Context, dst, rawURL string, auth Auth) error {
 // sshKeyPEM (from the URL ?sshkey= param) takes precedence over auth.SSHPrivateKey.
 // For HTTPS, credentials are taken from the URL userinfo first, then from auth.
 func setGitAuth(opts *gogit.CloneOptions, u *url.URL, sshKeyPEM []byte, auth Auth) error {
+	isSSH := u.Scheme == "ssh" || u.Scheme == "git"
+
 	// Prefer the key from the URL query param over auth.SSHPrivateKey.
 	keyPEM := sshKeyPEM
 	if len(keyPEM) == 0 {
 		keyPEM = auth.SSHPrivateKey
 	}
 
+	if len(keyPEM) > 0 {
+		if !isSSH {
+			// ?sshkey= in an HTTP(S) URL is a misconfiguration.
+			if len(sshKeyPEM) > 0 {
+				return fmt.Errorf("?sshkey= is not supported for %s URLs", u.Scheme)
+			}
+			// Auth.SSHPrivateKey alongside an HTTP(S) URL: ignore and fall
+			// through to HTTP basic auth below.
+			keyPEM = nil
+		}
+	}
+
 	if len(keyPEM) > 0 {
 		user := "git"
 		if u.User != nil && u.User.Username() != "" {

internal/bundlereader/gitclone_test.go

@@ -13,9 +13,11 @@ import (
 	"net"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"testing"
 	"time"
 
+	gogit "github.com/go-git/go-git/v5"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -117,3 +119,72 @@ func TestGitDownloadCABundle(t *testing.T) {
 		assert.Contains(t, err.Error(), "no valid PEM certificates")
 	})
 }
+
+// generateEd25519PEM returns a PEM-encoded Ed25519 private key for use in tests.
+func generateEd25519PEM(t *testing.T) []byte {
+	t.Helper()
+
+	// Use ECDSA since crypto/ed25519 and go-git's SSH key parsing both work,
+	// but PEM encoding of Ed25519 requires the x/crypto package. ECDSA P-256
+	// is simpler to produce inline.
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	require.NoError(t, err)
+	der, err := x509.MarshalECPrivateKey(key)
+	require.NoError(t, err)
+	return pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: der})
+}
+
+// TestSetGitAuth verifies that setGitAuth respects URL scheme when choosing
+// which auth type to configure.
+func TestSetGitAuth(t *testing.T) {
+	t.Parallel()
+
+	keyPEM := generateEd25519PEM(t)
+
+	t.Run("sshKey in URL for HTTPS URL returns error", func(t *testing.T) {
+		t.Parallel()
+		u, _ := url.Parse("https://example.com/repo.git")
+		opts := &gogit.CloneOptions{}
+		err := setGitAuth(opts, u, keyPEM, Auth{})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "?sshkey= is not supported")
+		assert.Nil(t, opts.Auth)
+	})
+
+	t.Run("Auth.SSHPrivateKey alongside HTTPS URL is ignored", func(t *testing.T) {
+		t.Parallel()
+		u, _ := url.Parse("https://example.com/repo.git")
+		opts := &gogit.CloneOptions{}
+		err := setGitAuth(opts, u, nil, Auth{SSHPrivateKey: keyPEM})
+		require.NoError(t, err)
+		// No auth configured: callers that need basic auth supply URL credentials.
+		assert.Nil(t, opts.Auth)
+	})
+
+	t.Run("sshKey in URL for SSH URL configures SSH auth", func(t *testing.T) {
+		t.Parallel()
+		u, _ := url.Parse("ssh://git@example.com/repo.git")
+		opts := &gogit.CloneOptions{}
+		err := setGitAuth(opts, u, keyPEM, Auth{})
+		require.NoError(t, err)
+		assert.NotNil(t, opts.Auth)
+	})
+
+	t.Run("Auth.SSHPrivateKey for SSH URL configures SSH auth", func(t *testing.T) {
+		t.Parallel()
+		u, _ := url.Parse("ssh://git@example.com/repo.git")
+		opts := &gogit.CloneOptions{}
+		err := setGitAuth(opts, u, nil, Auth{SSHPrivateKey: keyPEM})
+		require.NoError(t, err)
+		assert.NotNil(t, opts.Auth)
+	})
+
+	t.Run("basic auth from URL userinfo for HTTPS URL", func(t *testing.T) {
+		t.Parallel()
+		u, _ := url.Parse("https://user:pass@example.com/repo.git")
+		opts := &gogit.CloneOptions{}
+		err := setGitAuth(opts, u, nil, Auth{})
+		require.NoError(t, err)
+		assert.NotNil(t, opts.Auth)
+	})
+}