Repository navigation
全面审查修复:push 直连/重装死锁/网络预检/CI,移除 Access 步骤 - #1
Conversation
- GitHub 代理补 pushInsteadOf 反向规则,git push 不再被只读代理拦截 - 安装守卫补检 /etc/cf-ssh-tunnel 残留;同名 Tunnel 冲突给出明确处置指引 - 代理下载 deb 时限 90s -> 600s(首KB探测不反映吞吐) - status 不再隐式触发 cloudflared 安装 - TCP/7844 预检与协议联动:QUIC 模式降为告警交由 cloudflared 回退 - mainland 模式固定 --edge-ip-version 4(大陆 IPv6 出口常见半残) - HUP/INT/TERM 信号同样清理账户级授权证书 - uninstall 非交互输入时给出明确的取消提示 - 测试新增毫秒换算/名称确定性/代理规则清理行为测试(隔离 HOME),58 -> 68 项
- 部署/研究文档删除 Access 步骤,保留公开可达与 sshd 认证的安全事实 - 文档说明 push 经反向规则保持直连 GitHub - LICENSE 版权人 Manus AI -> buyi06
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cabd6bee2d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| remove_known_github_proxies | ||
| git config --global "url.${best_proxy}${GITHUB_PREFIX}.insteadOf" "$GITHUB_PREFIX" | ||
| # insteadOf 会同时劫持 push，而加速代理只支持下载；pushInsteadOf 把推送改回直连 GitHub。 | ||
| git config --global "url.${GITHUB_PREFIX}.pushInsteadOf" "${best_proxy}${GITHUB_PREFIX}" |
There was a problem hiding this comment.
For the normal case where a remote is stored as https://github.com/owner/repo.git, this value never matches: Git's docs define url.<base>.pushInsteadOf as rewriting URLs that start with the configured value to <base> (https://git-scm.com/docs/git-config#Documentation/git-config.txt-urlltbasegtpushInsteadOf), and git remote get-url --push with these two new settings still returns https://gh-proxy.org/https://github.com/owner/repo.git. As a result, users who enable the proxy still push to the read-only proxy instead of GitHub; the match value needs to be the original GitHub prefix (or an explicit pushurl needs to be set).
Useful? React with 👍 / 👎.
| require_root | ||
| require_systemd | ||
| [[ ! -e "$UNIT_FILE" && ! -e "$META_FILE" ]] || die "已存在 ${SERVICE_NAME} 配置。请使用 status、diagnose、update 或先 uninstall。" | ||
| [[ ! -e "$UNIT_FILE" && ! -e "$META_FILE" && ! -e "$SERVICE_DIR" ]] || die "已存在 ${SERVICE_NAME} 配置或残留文件（可能是上次未完成的安装）。请先执行 'sudo bash $0 uninstall' 清理后重试。" |
There was a problem hiding this comment.
When a user runs the standalone github-proxy command before installing, write_github_proxy_state creates /etc/cf-ssh-tunnel/github-proxy.env under SERVICE_DIR; after this new guard, that harmless proxy state (and even the empty directory left by github-proxy --disable) makes a first install abort as if a tunnel install were already present. This blocks the documented proxy workflow until the user runs uninstall, so the guard should distinguish actual tunnel artifacts from proxy-only state.
Useful? React with 👍 / 👎.
1 participant
修复(代码审查结论)
高优先级
url.<github>.pushInsteadOf反向规则,推送保持直连;清理逻辑同步移除两条规则,且只在值确属本脚本写入时才删,不误删用户配置/etc/cf-ssh-tunnel残留目录;同名 Tunnel 冲突(上次半途安装)时给出"先 uninstall + 控制台删旧 Tunnel"的明确指引,不再误导为权限问题中优先级
status命令不再隐式触发 cloudflared 安装(查看命令零副作用)--quic/--auto时降为告警,由 cloudflared 自行回退,不再误杀纯 UDP 环境--mainland固定--edge-ip-version 4(大陆 IPv6 出口常见半残)低优先级
文档
测试与 CI
本地验证:68/68 测试通过,
bash -n通过。