You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@maka.apache.org by "Joob1n (via GitHub)" <gi...@apache.org> on 2026/08/21 13:37:19 UTC
[I] Desktop artifacts ship Git Credential Manager and its .NET runtime, which Maka disables [maka]
Joob1n opened a new issue, #3428:
URL: https://github.com/apache/maka/issues/3428
## Problem
The bundled Git distribution ships Git Credential Manager and the .NET runtime it needs. Maka cannot reach either: every git invocation sets `credential.helper=` explicitly — `packages/storage/src/git-workspace-service.ts:1257` and `:2873` — so the helper is not merely unused, it is switched off at the call site. Credentials live in Maka's own `credentials.json` under the permission contract in SECURITY.md.
The entry point is 140 KB. What follows it is not:
| | |
| --- | ---: |
| `libSkiaSharp.dylib` — 2D graphics, for a login window that never opens | 14.4 MB |
| `System.Private.CoreLib.dll` | 13.5 MB |
| `System.Private.Xml.dll` | 8.8 MB |
| `libcoreclr.dylib` | 6.1 MB |
| …216 `.dll` and 16 `.dylib` in total | |
| **Total** | **223 files, 103.1 MiB** |
## Measured impact
Packaged `main` and a pruned build, both macOS arm64:
| | installed `.app` | **downloaded DMG** |
| --- | ---: | ---: |
| `main` | 781 MB | 279.6 MB |
| pruned | 648 MB | 235.0 MB |
| delta | **−133 MB** | **−44.6 MB (−16%)** |
The two differ because .NET assemblies are IL and compress well. Both are real: users download 45 MB less and reclaim 133 MB of disk.
## Verification that git still works
The exclusion has to be a name filter over `libexec/git-core`, which holds git's own commands interleaved with the .NET payload — there is no directory to drop, so over-matching is the risk worth testing rather than assuming. Against a pruned copy, every subcommand `git-workspace-service.ts` actually invokes:
```
init · config · add · commit (with credential.helper=) · status
rev-parse · cat-file · for-each-ref · worktree
```
All pass. `git --version` reports 2.53.0 and `share/git-core/templates` is intact.
## Scope
- Exclude the credential-manager runtime from `extraResources` in the electron-builder config. `.dll` and `.dylib` appear nowhere else in the distribution, and all 16 dylibs are .NET, Avalonia or Skia.
- Assert both halves in the packaged-artifact verifier: the payload is absent **and** the git commands Maka invokes are present. Checking only the absence would pass for an empty directory.
- macOS and Linux only as written. The Windows distribution has a different layout (`git/cmd/git.exe`, and its own `.dll` set that git itself loads); trimming it needs its own measurement first.
## Relationship to the other size items
Same origin as #3146: both are part of the 151 MB #2199 added when it bundled a hermetic Git runtime. #3146 explicitly scoped this payload out — *"The bundled Git runtime is a larger and separate finding … I will file that separately if it is wanted."* This is that separate filing, so the two do not overlap: #3146 / #3148 removes the renderer's duplicated dependency tree, this removes the credential-manager runtime.
Still unfiled from that same note: the 27 git builtins that lost their hardlinks, about 13 MB.
Supersedes the size half of #3202, which is closed — its packaging-time attribution did not survive measurement.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org
Re: [I] Desktop artifacts ship Git Credential Manager and its .NET runtime, which Maka disables [maka]
Posted by "Astro-Han (via GitHub)" <gi...@apache.org>.
Astro-Han closed issue #3428: Desktop artifacts ship Git Credential Manager and its .NET runtime, which Maka disables
URL: https://github.com/apache/maka/issues/3428
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org
Re: [I] Desktop artifacts ship Git Credential Manager and its .NET runtime, which Maka disables [maka]
Posted by "Joob1n (via GitHub)" <gi...@apache.org>.
Joob1n commented on issue #3428:
URL: https://github.com/apache/maka/issues/3428#issuecomment-5379106051
I am working on this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org