Automatic merge of gitlab-org/gitaly master

13 files changed, 65 insertions, 231 deletions

diff --git a/internal/gitaly/service/remote/find_remote_root_ref.go b/internal/gitaly/service/remote/find_remote_root_ref.go
index 40fdb2e32..c74d5007d 100644
--- a/internal/gitaly/service/remote/find_remote_root_ref.go
+++ b/internal/gitaly/service/remote/find_remote_root_ref.go
@@ -37,13 +37,6 @@ func (s *server) findRemoteRootRefCmd(ctx context.Context, request *gitalypb.Fin
 			Value: "Authorization: " + authHeader,
 		})
 	}
-	//nolint:staticcheck
-	if host := request.GetHttpHost(); host != "" {
-		config = append(config, git.ConfigPair{
-			Key:   fmt.Sprintf("http.%s.extraHeader", request.RemoteUrl),
-			Value: "Host: " + host,
-		})
-	}
 
 	return s.gitCmdFactory.New(ctx, request.Repository,
 		git.Command{
diff --git a/internal/gitaly/service/remote/find_remote_root_ref_test.go b/internal/gitaly/service/remote/find_remote_root_ref_test.go
index 196a8fabc..fedc49bea 100644
--- a/internal/gitaly/service/remote/find_remote_root_ref_test.go
+++ b/internal/gitaly/service/remote/find_remote_root_ref_test.go
@@ -2,7 +2,6 @@ package remote
 
 import (
 	"fmt"
-	"net/http"
 	"path/filepath"
 	"testing"
 
@@ -81,13 +80,12 @@ func TestFindRemoteRootRef(t *testing.T) {
 		{
 			desc: "successful",
 			setup: func(t *testing.T) setupData {
-				host := "example.com"
 				secret := "mysecret"
 
 				_, remoteRepoPath := gittest.CreateRepository(t, ctx, cfg)
 				gittest.WriteCommit(t, cfg, remoteRepoPath, gittest.WithBranch("main"))
 
-				port := gittest.HTTPServer(t, ctx, gitCmdFactory, remoteRepoPath, newGitRequestValidationMiddleware(host, secret))
+				port := gittest.HTTPServer(t, ctx, gitCmdFactory, remoteRepoPath, nil)
 				originURL := fmt.Sprintf("http://127.0.0.1:%d/%s", port, filepath.Base(remoteRepoPath))
 
 				return setupData{
@@ -95,7 +93,6 @@ func TestFindRemoteRootRef(t *testing.T) {
 						Repository:              localRepo,
 						RemoteUrl:               originURL,
 						HttpAuthorizationHeader: secret,
-						HttpHost:                host,
 					},
 					expectedResponse: &gitalypb.FindRemoteRootRefResponse{
 						Ref: "main",
@@ -144,21 +141,6 @@ func TestFindRemoteRootRef(t *testing.T) {
 	}
 }
 
-func newGitRequestValidationMiddleware(host, secret string) func(http.ResponseWriter, *http.Request, http.Handler) {
-	return func(w http.ResponseWriter, r *http.Request, next http.Handler) {
-		if r.Host != host {
-			http.Error(w, "No Host", http.StatusBadRequest)
-			return
-		}
-		if r.Header.Get("Authorization") != secret {
-			http.Error(w, "Unauthorized", http.StatusUnauthorized)
-			return
-		}
-
-		next.ServeHTTP(w, r)
-	}
-}
-
 func TestServer_findRemoteRootRefCmd(t *testing.T) {
 	t.Parallel()
 
diff --git a/internal/gitaly/service/remote/update_remote_mirror.go b/internal/gitaly/service/remote/update_remote_mirror.go
index 53ba17322..da1e8565e 100644
--- a/internal/gitaly/service/remote/update_remote_mirror.go
+++ b/internal/gitaly/service/remote/update_remote_mirror.go
@@ -95,13 +95,6 @@ func (s *server) updateRemoteMirror(stream gitalypb.RemoteService_UpdateRemoteMi
 			Value: "Authorization: " + authHeader,
 		})
 	}
-	//nolint:staticcheck
-	if host := remote.GetHttpHost(); host != "" {
-		remoteConfig = append(remoteConfig, git.ConfigPair{
-			Key:   fmt.Sprintf("http.%s.extraHeader", remote.GetUrl()),
-			Value: "Host: " + host,
-		})
-	}
 
 	sshCommand, clean, err := git.BuildSSHInvocation(ctx, firstRequest.GetSshKey(), firstRequest.GetKnownHosts())
 	if err != nil {
diff --git a/internal/gitaly/service/repository/create_repository_from_snapshot.go b/internal/gitaly/service/repository/create_repository_from_snapshot.go
index 0584d9a9a..0b39c5402 100644
--- a/internal/gitaly/service/repository/create_repository_from_snapshot.go
+++ b/internal/gitaly/service/repository/create_repository_from_snapshot.go
@@ -101,10 +101,6 @@ func untar(ctx context.Context, path string, in *gitalypb.CreateRepositoryFromSn
 	if in.HttpAuth != "" {
 		req.Header.Set("Authorization", in.HttpAuth)
 	}
-	//nolint:staticcheck
-	if httpHost := in.GetHttpHost(); httpHost != "" {
-		req.Host = httpHost
-	}
 
 	rsp, err := client.Do(req)
 	if err != nil {
diff --git a/internal/gitaly/service/repository/create_repository_from_snapshot_test.go b/internal/gitaly/service/repository/create_repository_from_snapshot_test.go
index 7f81bea0b..bef55949b 100644
--- a/internal/gitaly/service/repository/create_repository_from_snapshot_test.go
+++ b/internal/gitaly/service/repository/create_repository_from_snapshot_test.go
@@ -28,22 +28,16 @@ import (
 
 var (
 	secret       = "Magic secret"
-	host         = "example.com"
 	redirectPath = "/redirecting-snapshot.tar"
 	tarPath      = "/snapshot.tar"
 )
 
 type tarTesthandler struct {
 	tarData io.Reader
-	host    string
 	secret  string
 }
 
 func (h *tarTesthandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
-	if h.host != "" && r.Host != h.host {
-		http.Error(w, "No Host", http.StatusBadRequest)
-		return
-	}
 	if r.Header.Get("Authorization") != h.secret {
 		http.Error(w, "Unauthorized", http.StatusUnauthorized)
 		return
@@ -96,7 +90,7 @@ func TestCreateRepositoryFromSnapshot_success(t *testing.T) {
 	data, entries := generateTarFile(t, sourceRepoPath)
 
 	// Create a HTTP server that serves a given tar file
-	srv := httptest.NewServer(&tarTesthandler{tarData: bytes.NewReader(data), secret: secret, host: host})
+	srv := httptest.NewServer(&tarTesthandler{tarData: bytes.NewReader(data), secret: secret})
 	defer srv.Close()
 
 	repoRelativePath := filepath.Join("non-existing-parent", "repository")
@@ -109,7 +103,6 @@ func TestCreateRepositoryFromSnapshot_success(t *testing.T) {
 		Repository: repo,
 		HttpUrl:    srv.URL + tarPath,
 		HttpAuth:   secret,
-		HttpHost:   host,
 	}
 
 	rsp, err := client.CreateRepositoryFromSnapshot(ctx, req)
@@ -222,7 +215,7 @@ func TestCreateRepositoryFromSnapshot_invalidArguments(t *testing.T) {
 		},
 	}
 
-	srv := httptest.NewServer(&tarTesthandler{secret: secret, host: host})
+	srv := httptest.NewServer(&tarTesthandler{secret: secret})
 	defer srv.Close()
 
 	for _, tc := range testCases {
@@ -238,7 +231,6 @@ func TestCreateRepositoryFromSnapshot_invalidArguments(t *testing.T) {
 				},
 				HttpUrl:         srv.URL + tc.url,
 				HttpAuth:        tc.auth,
-				HttpHost:        host,
 				ResolvedAddress: tc.resolvedAddress,
 			}
 
@@ -269,7 +261,7 @@ func TestCreateRepositoryFromSnapshot_malformedResponse(t *testing.T) {
 	// Only serve half of the tar file
 	dataReader := io.LimitReader(bytes.NewReader(data), int64(len(data)/2))
 
-	srv := httptest.NewServer(&tarTesthandler{tarData: dataReader, secret: secret, host: host})
+	srv := httptest.NewServer(&tarTesthandler{tarData: dataReader, secret: secret})
 	defer srv.Close()
 
 	// Delete the repository so we can re-use the path
@@ -279,7 +271,6 @@ func TestCreateRepositoryFromSnapshot_malformedResponse(t *testing.T) {
 		Repository: repo,
 		HttpUrl:    srv.URL + tarPath,
 		HttpAuth:   secret,
-		HttpHost:   host,
 	}
 
 	rsp, err := client.CreateRepositoryFromSnapshot(ctx, req)
@@ -308,7 +299,7 @@ func TestCreateRepositoryFromSnapshot_resolvedAddressSuccess(t *testing.T) {
 	data, entries := generateTarFile(t, sourceRepoPath)
 
 	// Create a HTTP server that serves a given tar file
-	srv := httptest.NewServer(&tarTesthandler{tarData: bytes.NewReader(data), secret: secret, host: host})
+	srv := httptest.NewServer(&tarTesthandler{tarData: bytes.NewReader(data), secret: secret})
 	defer srv.Close()
 
 	repoRelativePath := gittest.NewRepositoryName(t)
@@ -325,14 +316,13 @@ func TestCreateRepositoryFromSnapshot_resolvedAddressSuccess(t *testing.T) {
 	u, err := url.Parse(srv.URL)
 	require.NoError(t, err)
 
-	randomHostname := fmt.Sprintf("http://www.example.com:%s%s", u.Port(), tarPath)
+	randomHostname := fmt.Sprintf("http://localhost:%s%s", u.Port(), tarPath)
 
 	req := &gitalypb.CreateRepositoryFromSnapshotRequest{
 		Repository:      repo,
 		HttpUrl:         randomHostname,
 		HttpAuth:        secret,
 		ResolvedAddress: u.Hostname(),
-		HttpHost:        host,
 	}
 
 	rsp, err := client.CreateRepositoryFromSnapshot(ctx, req)
diff --git a/internal/gitaly/service/repository/create_repository_from_url.go b/internal/gitaly/service/repository/create_repository_from_url.go
index 46c421104..a4fc84a75 100644
--- a/internal/gitaly/service/repository/create_repository_from_url.go
+++ b/internal/gitaly/service/repository/create_repository_from_url.go
@@ -17,7 +17,7 @@ import (
 
 func (s *server) cloneFromURLCommand(
 	ctx context.Context,
-	repoURL, repoHost, resolvedAddress, repositoryFullPath, authorizationToken string, mirror bool,
+	repoURL, resolvedAddress, repositoryFullPath, authorizationToken string, mirror bool,
 	opts ...git.CmdOpt,
 ) (*command.Command, error) {
 	cloneFlags := []git.Option{
@@ -66,13 +66,6 @@ func (s *server) cloneFromURLCommand(
 		config = append(config, resolveConfig...)
 	}
 
-	if repoHost != "" {
-		config = append(config, git.ConfigPair{
-			Key:   "http.extraHeader",
-			Value: "Host: " + repoHost,
-		})
-	}
-
 	return s.gitCmdFactory.NewWithoutRepo(ctx,
 		git.Command{
 			Name:  "clone",
@@ -97,8 +90,6 @@ func (s *server) CreateRepositoryFromURL(ctx context.Context, req *gitalypb.Crea
 		var stderr bytes.Buffer
 		cmd, err := s.cloneFromURLCommand(ctx,
 			req.GetUrl(),
-			//nolint:staticcheck
-			req.GetHttpHost(),
 			req.GetResolvedAddress(),
 			targetPath,
 			req.GetHttpAuthorizationHeader(),
diff --git a/internal/gitaly/service/repository/create_repository_from_url_test.go b/internal/gitaly/service/repository/create_repository_from_url_test.go
index 63df6ae02..c3e05d72e 100644
--- a/internal/gitaly/service/repository/create_repository_from_url_test.go
+++ b/internal/gitaly/service/repository/create_repository_from_url_test.go
@@ -85,7 +85,6 @@ func TestCreateRepositoryFromURL_successfulWithOptionalParameters(t *testing.T)
 	_, err := client.CreateRepositoryFromURL(ctx, &gitalypb.CreateRepositoryFromURLRequest{
 		Repository:              importedRepo,
 		Url:                     fmt.Sprintf("http://%s:%s@localhost:%d/%s", user, password, port, filepath.Base(remoteRepoPath)),
-		HttpHost:                "www.example.com",
 		HttpAuthorizationHeader: "GL-Geo EhEhKSUk_385GSLnS7BI:eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkYXRhIjoie1wic2NvcGVcIjpcInJvb3QvZ2l0bGFiLWNlXCJ9IiwianRpIjoiNmQ4ZDM1NGQtZjUxYS00MDQ5LWExZjctMjUyMjk4YmQwMTI4IiwiaWF0IjoxNjQyMDk1MzY5LCJuYmYiOjE2NDIwOTUzNjQsImV4cCI6MTY0MjA5NTk2OX0.YEpfzg8305dUqkYOiB7_dhbL0FVSaUPgpSpMuKrgNrg",
 		Mirror:                  true,
 	})
@@ -267,7 +266,6 @@ func TestServer_CloneFromURLCommand(t *testing.T) {
 			cmd, err := s.cloneFromURLCommand(
 				ctx,
 				tc.url,
-				"www.example.com",
 				tc.resolvedAddress,
 				filepath.Join(testhelper.TempDir(t), "target"),
 				tc.token,
@@ -301,13 +299,6 @@ func TestServer_CloneFromURLCommand(t *testing.T) {
 				require.Subset(t, cmd.Env(), []string{
 					"GIT_CONFIG_KEY_1=http.curloptResolve",
 					"GIT_CONFIG_VALUE_1=" + tc.expectedCurloptResolveHeader,
-					"GIT_CONFIG_KEY_2=http.extraHeader",
-					"GIT_CONFIG_VALUE_2=Host: www.example.com",
-				})
-			} else {
-				require.Subset(t, cmd.Env(), []string{
-					"GIT_CONFIG_KEY_1=http.extraHeader",
-					"GIT_CONFIG_VALUE_1=Host: www.example.com",
 				})
 			}
 		})
@@ -323,7 +314,7 @@ func TestServer_CloneFromURLCommand_withMirror(t *testing.T) {
 
 	cfg := testcfg.Build(t)
 	s := server{cfg: cfg, gitCmdFactory: gittest.NewCommandFactory(t, cfg)}
-	cmd, err := s.cloneFromURLCommand(ctx, url, "", "", repositoryFullPath, "", true, git.WithDisabledHooks())
+	cmd, err := s.cloneFromURLCommand(ctx, url, "", repositoryFullPath, "", true, git.WithDisabledHooks())
 	require.NoError(t, err)
 
 	args := cmd.Args()
diff --git a/internal/gitaly/service/repository/fetch_remote.go b/internal/gitaly/service/repository/fetch_remote.go
index c0ad9293e..fd20156b2 100644
--- a/internal/gitaly/service/repository/fetch_remote.go
+++ b/internal/gitaly/service/repository/fetch_remote.go
@@ -66,14 +66,6 @@ func (s *server) FetchRemote(ctx context.Context, req *gitalypb.FetchRemoteReque
 		})
 	}
 
-	//nolint: staticcheck
-	if host := req.GetRemoteParams().GetHttpHost(); host != "" {
-		config = append(config, git.ConfigPair{
-			Key:   fmt.Sprintf("http.%s.extraHeader", req.GetRemoteParams().GetUrl()),
-			Value: "Host: " + host,
-		})
-	}
-
 	opts.CommandOptions = append(opts.CommandOptions, git.WithConfigEnv(config...))
 
 	sshCommand, cleanup, err := git.BuildSSHInvocation(ctx, req.GetSshKey(), req.GetKnownHosts())
diff --git a/internal/gitaly/service/repository/fetch_remote_test.go b/internal/gitaly/service/repository/fetch_remote_test.go
index 7551c2462..c53dec759 100644
--- a/internal/gitaly/service/repository/fetch_remote_test.go
+++ b/internal/gitaly/service/repository/fetch_remote_test.go
@@ -28,14 +28,9 @@ import (
 
 const (
 	httpToken = "ABCefg0999182"
-	httpHost  = "example.com"
 )
 
 func gitRequestValidation(w http.ResponseWriter, r *http.Request, next http.Handler) {
-	if r.Host != httpHost {
-		http.Error(w, "No Host", http.StatusBadRequest)
-		return
-	}
 	if r.Header.Get("Authorization") != httpToken {
 		http.Error(w, "Unauthorized", http.StatusUnauthorized)
 		return
@@ -784,7 +779,6 @@ func TestFetchRemote(t *testing.T) {
 						RemoteParams: &gitalypb.Remote{
 							Url:                     fmt.Sprintf("http://127.0.0.1:%d/%s", port, "invalid/repo/path.git"),
 							HttpAuthorizationHeader: httpToken,
-							HttpHost:                httpHost,
 						},
 					},
 					runs: []run{
@@ -813,7 +807,6 @@ func TestFetchRemote(t *testing.T) {
 						RemoteParams: &gitalypb.Remote{
 							Url:                     fmt.Sprintf("http://127.0.0.1:%d/%s", port, filepath.Base(remoteRepoPath)),
 							HttpAuthorizationHeader: httpToken,
-							HttpHost:                httpHost,
 						},
 					},
 					runs: []run{
@@ -841,8 +834,7 @@ func TestFetchRemote(t *testing.T) {
 					request: &gitalypb.FetchRemoteRequest{
 						Repository: repoProto,
 						RemoteParams: &gitalypb.Remote{
-							Url:      fmt.Sprintf("http://127.0.0.1:%d/%s", port, filepath.Base(remoteRepoPath)),
-							HttpHost: httpHost,
+							Url: fmt.Sprintf("http://127.0.0.1:%d/%s", port, filepath.Base(remoteRepoPath)),
 						},
 					},
 					runs: []run{
@@ -871,8 +863,7 @@ func TestFetchRemote(t *testing.T) {
 					request: &gitalypb.FetchRemoteRequest{
 						Repository: repoProto,
 						RemoteParams: &gitalypb.Remote{
-							Url:      fmt.Sprintf("http://127.0.0.1:%d/%s", port, filepath.Base(remoteRepoPath)),
-							HttpHost: httpHost,
+							Url: fmt.Sprintf("http://127.0.0.1:%d/%s", port, filepath.Base(remoteRepoPath)),
 						},
 					},
 					runs: []run{
@@ -905,7 +896,6 @@ func TestFetchRemote(t *testing.T) {
 						RemoteParams: &gitalypb.Remote{
 							Url:                     fmt.Sprintf("http://127.0.0.1:%d/%s", port, filepath.Base(remoteRepoPath)),
 							HttpAuthorizationHeader: httpToken,
-							HttpHost:                httpHost,
 						},
 						Timeout: 1,
 					},
diff --git a/proto/go/gitalypb/remote.pb.go b/proto/go/gitalypb/remote.pb.go
index 082191a8e..9b9491da3 100644
--- a/proto/go/gitalypb/remote.pb.go
+++ b/proto/go/gitalypb/remote.pb.go
@@ -299,13 +299,6 @@ type FindRemoteRootRefRequest struct {
 	// HttpAuthorizationHeader is the HTTP header which should be added to the
 	// request in order to authenticate against the repository.
 	HttpAuthorizationHeader string `protobuf:"bytes,4,opt,name=http_authorization_header,json=httpAuthorizationHeader,proto3" json:"http_authorization_header,omitempty"`
-	// HttpHost is the hostname of the remote repository. Use this when the
-	// URL hostname has already been resolved to an IP address to prevent DNS
-	// rebinding. This is deprecated as we will be using resolved_address
-	// going forward.
-	//
-	// Deprecated: Marked as deprecated in remote.proto.
-	HttpHost string `protobuf:"bytes,5,opt,name=http_host,json=httpHost,proto3" json:"http_host,omitempty"`
 	// ResolvedAddress holds the resolved IP address of the remote_url. This is
 	// used to avoid DNS rebinding by mapping the url to the resolved address.
 	// Only IPv4 dotted decimal ("192.0.2.1"), IPv6 ("2001:db8::68"), or IPv4-mapped
@@ -368,14 +361,6 @@ func (x *FindRemoteRootRefRequest) GetHttpAuthorizationHeader() string {
 	return ""
 }
 
-// Deprecated: Marked as deprecated in remote.proto.
-func (x *FindRemoteRootRefRequest) GetHttpHost() string {
-	if x != nil {
-		return x.HttpHost
-	}
-	return ""
-}
-
 func (x *FindRemoteRootRefRequest) GetResolvedAddress() string {
 	if x != nil {
 		return x.ResolvedAddress
@@ -444,13 +429,6 @@ type UpdateRemoteMirrorRequest_Remote struct {
 	// HTTPAuthorizationHeader is an optional HTTP header used for
 	// authenticating against the remote repository.
 	HttpAuthorizationHeader string `protobuf:"bytes,2,opt,name=http_authorization_header,json=httpAuthorizationHeader,proto3" json:"http_authorization_header,omitempty"`
-	// HttpHost is the hostname of the remote repository. Use this when the
-	// URL hostname has already been resolved to an IP address to prevent DNS
-	// rebinding. This is deprecated as we will be using resolved_address
-	// going forward.
-	//
-	// Deprecated: Marked as deprecated in remote.proto.
-	HttpHost string `protobuf:"bytes,3,opt,name=http_host,json=httpHost,proto3" json:"http_host,omitempty"`
 	// ResolvedAddress holds the resolved IP address of the remote_url. This is
 	// used to avoid DNS rebinding by mapping the url to the resolved address.
 	// Only IPv4 dotted decimal ("192.0.2.1"), IPv6 ("2001:db8::68"), or IPv4-mapped
@@ -506,14 +484,6 @@ func (x *UpdateRemoteMirrorRequest_Remote) GetHttpAuthorizationHeader() string {
 	return ""
 }
 
-// Deprecated: Marked as deprecated in remote.proto.
-func (x *UpdateRemoteMirrorRequest_Remote) GetHttpHost() string {
-	if x != nil {
-		return x.HttpHost
-	}
-	return ""
-}
-
 func (x *UpdateRemoteMirrorRequest_Remote) GetResolvedAddress() string {
 	if x != nil {
 		return x.ResolvedAddress
@@ -527,7 +497,7 @@ var file_remote_proto_rawDesc = []byte{
 	0x0a, 0x0c, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x06,
 	0x67, 0x69, 0x74, 0x61, 0x6c, 0x79, 0x1a, 0x0a, 0x6c, 0x69, 0x6e, 0x74, 0x2e, 0x70, 0x72, 0x6f,
 	0x74, 0x6f, 0x1a, 0x0c, 0x73, 0x68, 0x61, 0x72, 0x65, 0x64, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x22, 0xec, 0x03, 0x0a, 0x19, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x6d, 0x6f, 0x74,
+	0x22, 0xdc, 0x03, 0x0a, 0x19, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x6d, 0x6f, 0x74,
 	0x65, 0x4d, 0x69, 0x72, 0x72, 0x6f, 0x72, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x38,
 	0x0a, 0x0a, 0x72, 0x65, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x6f, 0x72, 0x79, 0x18, 0x01, 0x20, 0x01,
 	0x28, 0x0b, 0x32, 0x12, 0x2e, 0x67, 0x69, 0x74, 0x61, 0x6c, 0x79, 0x2e, 0x52, 0x65, 0x70, 0x6f,
@@ -546,17 +516,16 @@ var file_remote_proto_rawDesc = []byte{
 	0x6b, 0x6e, 0x6f, 0x77, 0x6e, 0x48, 0x6f, 0x73, 0x74, 0x73, 0x12, 0x2e, 0x0a, 0x13, 0x6b, 0x65,
 	0x65, 0x70, 0x5f, 0x64, 0x69, 0x76, 0x65, 0x72, 0x67, 0x65, 0x6e, 0x74, 0x5f, 0x72, 0x65, 0x66,
 	0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x11, 0x6b, 0x65, 0x65, 0x70, 0x44, 0x69, 0x76,
-	0x65, 0x72, 0x67, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x66, 0x73, 0x1a, 0xa2, 0x01, 0x0a, 0x06, 0x52,
+	0x65, 0x72, 0x67, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x66, 0x73, 0x1a, 0x92, 0x01, 0x0a, 0x06, 0x52,
 	0x65, 0x6d, 0x6f, 0x74, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01,
 	0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x12, 0x3a, 0x0a, 0x19, 0x68, 0x74, 0x74, 0x70, 0x5f,
 	0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x68, 0x65,
 	0x61, 0x64, 0x65, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x17, 0x68, 0x74, 0x74, 0x70,
 	0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x48, 0x65, 0x61,
-	0x64, 0x65, 0x72, 0x12, 0x1f, 0x0a, 0x09, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x68, 0x6f, 0x73, 0x74,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x42, 0x02, 0x18, 0x01, 0x52, 0x08, 0x68, 0x74, 0x74, 0x70,
-	0x48, 0x6f, 0x73, 0x74, 0x12, 0x29, 0x0a, 0x10, 0x72, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x64,
-	0x5f, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f,
-	0x72, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x64, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x4a,
+	0x64, 0x65, 0x72, 0x12, 0x29, 0x0a, 0x10, 0x72, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x64, 0x5f,
+	0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x72,
+	0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x64, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x4a, 0x04,
+	0x08, 0x03, 0x10, 0x04, 0x52, 0x09, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x68, 0x6f, 0x73, 0x74, 0x4a,
 	0x04, 0x08, 0x02, 0x10, 0x03, 0x52, 0x08, 0x72, 0x65, 0x66, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x22,
 	0x43, 0x0a, 0x1a, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x4d,
 	0x69, 0x72, 0x72, 0x6f, 0x72, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x25, 0x0a,
@@ -571,7 +540,7 @@ var file_remote_proto_rawDesc = []byte{
 	0x4e, 0x61, 0x6d, 0x65, 0x22, 0x36, 0x0a, 0x1c, 0x46, 0x69, 0x6e, 0x64, 0x52, 0x65, 0x6d, 0x6f,
 	0x74, 0x65, 0x52, 0x65, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x6f, 0x72, 0x79, 0x52, 0x65, 0x73, 0x70,
 	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x65, 0x78, 0x69, 0x73, 0x74, 0x73, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x65, 0x78, 0x69, 0x73, 0x74, 0x73, 0x22, 0x89, 0x02, 0x0a,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x65, 0x78, 0x69, 0x73, 0x74, 0x73, 0x22, 0xf9, 0x01, 0x0a,
 	0x18, 0x46, 0x69, 0x6e, 0x64, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x52, 0x6f, 0x6f, 0x74, 0x52,
 	0x65, 0x66, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x38, 0x0a, 0x0a, 0x72, 0x65, 0x70,
 	0x6f, 0x73, 0x69, 0x74, 0x6f, 0x72, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e,
@@ -582,13 +551,12 @@ var file_remote_proto_rawDesc = []byte{
 	0x72, 0x6c, 0x12, 0x3a, 0x0a, 0x19, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x6f,
 	0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x18,
 	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x17, 0x68, 0x74, 0x74, 0x70, 0x41, 0x75, 0x74, 0x68, 0x6f,
-	0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x12, 0x1f,
-	0x0a, 0x09, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28,
-	0x09, 0x42, 0x02, 0x18, 0x01, 0x52, 0x08, 0x68, 0x74, 0x74, 0x70, 0x48, 0x6f, 0x73, 0x74, 0x12,
-	0x29, 0x0a, 0x10, 0x72, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x64, 0x5f, 0x61, 0x64, 0x64, 0x72,
-	0x65, 0x73, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x72, 0x65, 0x73, 0x6f, 0x6c,
-	0x76, 0x65, 0x64, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x4a, 0x04, 0x08, 0x02, 0x10, 0x03,
-	0x52, 0x06, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x22, 0x2d, 0x0a, 0x19, 0x46, 0x69, 0x6e, 0x64,
+	0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x12, 0x29,
+	0x0a, 0x10, 0x72, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x64, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x65,
+	0x73, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x72, 0x65, 0x73, 0x6f, 0x6c, 0x76,
+	0x65, 0x64, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x4a, 0x04, 0x08, 0x02, 0x10, 0x03, 0x4a,
+	0x04, 0x08, 0x05, 0x10, 0x06, 0x52, 0x06, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x52, 0x09, 0x68,
+	0x74, 0x74, 0x70, 0x5f, 0x68, 0x6f, 0x73, 0x74, 0x22, 0x2d, 0x0a, 0x19, 0x46, 0x69, 0x6e, 0x64,
 	0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x52, 0x6f, 0x6f, 0x74, 0x52, 0x65, 0x66, 0x52, 0x65, 0x73,
 	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x72, 0x65, 0x66, 0x18, 0x01, 0x20, 0x01,
 	0x28, 0x09, 0x52, 0x03, 0x72, 0x65, 0x66, 0x32, 0xc5, 0x02, 0x0a, 0x0d, 0x52, 0x65, 0x6d, 0x6f,
diff --git a/proto/go/gitalypb/repository.pb.go b/proto/go/gitalypb/repository.pb.go
index 8d196456d..d12d5ee06 100644
--- a/proto/go/gitalypb/repository.pb.go
+++ b/proto/go/gitalypb/repository.pb.go
@@ -1936,13 +1936,6 @@ type CreateRepositoryFromURLRequest struct {
 	Repository *Repository `protobuf:"bytes,1,opt,name=repository,proto3" json:"repository,omitempty"`
 	// This comment is left unintentionally blank.
 	Url string `protobuf:"bytes,2,opt,name=url,proto3" json:"url,omitempty"`
-	// HttpHost is the hostname of the remote repository. Use this when the
-	// URL hostname has already been resolved to an IP address to prevent DNS
-	// rebinding. This is deprecated as we will be using resolved_address
-	// going forward.
-	//
-	// Deprecated: Marked as deprecated in repository.proto.
-	HttpHost string `protobuf:"bytes,3,opt,name=http_host,json=httpHost,proto3" json:"http_host,omitempty"`
 	// http_authorization_header is the HTTP header which can be added to
 	// the request in order to authenticate against the repository.
 	HttpAuthorizationHeader string `protobuf:"bytes,4,opt,name=http_authorization_header,json=httpAuthorizationHeader,proto3" json:"http_authorization_header,omitempty"`
@@ -2007,14 +2000,6 @@ func (x *CreateRepositoryFromURLRequest) GetUrl() string {
 	return ""
 }
 
-// Deprecated: Marked as deprecated in repository.proto.
-func (x *CreateRepositoryFromURLRequest) GetHttpHost() string {
-	if x != nil {
-		return x.HttpHost
-	}
-	return ""
-}
-
 func (x *CreateRepositoryFromURLRequest) GetHttpAuthorizationHeader() string {
 	if x != nil {
 		return x.HttpAuthorizationHeader
@@ -3315,13 +3300,6 @@ type CreateRepositoryFromSnapshotRequest struct {
 	HttpUrl string `protobuf:"bytes,2,opt,name=http_url,json=httpUrl,proto3" json:"http_url,omitempty"`
 	// This comment is left unintentionally blank.
 	HttpAuth string `protobuf:"bytes,3,opt,name=http_auth,json=httpAuth,proto3" json:"http_auth,omitempty"`
-	// HttpHost is the hostname of the remote snapshot. Use this when the
-	// URL hostname has already been resolved to an IP address to prevent DNS
-	// rebinding. This is deprecated as we will be using resolved_address
-	// going forward.
-	//
-	// Deprecated: Marked as deprecated in repository.proto.
-	HttpHost string `protobuf:"bytes,4,opt,name=http_host,json=httpHost,proto3" json:"http_host,omitempty"`
 	// ResolvedAddress holds the resolved IP address of the remote_url. This is
 	// used to avoid DNS rebinding by mapping the url to the resolved address.
 	// Only IPv4 dotted decimal ("192.0.2.1"), IPv6 ("2001:db8::68"), or IPv4-mapped
@@ -3384,14 +3362,6 @@ func (x *CreateRepositoryFromSnapshotRequest) GetHttpAuth() string {
 	return ""
 }
 
-// Deprecated: Marked as deprecated in repository.proto.
-func (x *CreateRepositoryFromSnapshotRequest) GetHttpHost() string {
-	if x != nil {
-		return x.HttpHost
-	}
-	return ""
-}
-
 func (x *CreateRepositoryFromSnapshotRequest) GetResolvedAddress() string {
 	if x != nil {
 		return x.ResolvedAddress
@@ -3869,12 +3839,6 @@ type Remote struct {
 	//
 	// If no refspecs are given, this defaults to "all_refs".
 	MirrorRefmaps []string `protobuf:"bytes,4,rep,name=mirror_refmaps,json=mirrorRefmaps,proto3" json:"mirror_refmaps,omitempty"`
-	// HttpHost is the hostname of the remote repository. Use this when the
-	// URL hostname has already been resolved to an IP address to prevent DNS
-	// rebinding. This is deprecated as this field is/was never used.
-	//
-	// Deprecated: Marked as deprecated in repository.proto.
-	HttpHost string `protobuf:"bytes,5,opt,name=http_host,json=httpHost,proto3" json:"http_host,omitempty"`
 	// ResolvedAddress holds the resolved IP address of the remote_url. This is
 	// used to avoid DNS rebinding by mapping the url to the resolved address.
 	// Only IPv4 dotted decimal ("192.0.2.1"), IPv6 ("2001:db8::68"), or IPv4-mapped
@@ -3937,14 +3901,6 @@ func (x *Remote) GetMirrorRefmaps() []string {
 	return nil
 }
 
-// Deprecated: Marked as deprecated in repository.proto.
-func (x *Remote) GetHttpHost() string {
-	if x != nil {
-		return x.HttpHost
-	}
-	return ""
-}
-
 func (x *Remote) GetResolvedAddress() string {
 	if x != nil {
 		return x.ResolvedAddress
@@ -5286,24 +5242,23 @@ var file_repository_proto_rawDesc = []byte{
 	0x67, 0x69, 0x74, 0x61, 0x6c, 0x79, 0x2e, 0x52, 0x65, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x6f, 0x72,
 	0x79, 0x52, 0x10, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x70, 0x6f, 0x73, 0x69, 0x74,
 	0x6f, 0x72, 0x79, 0x22, 0x14, 0x0a, 0x12, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x46, 0x6f, 0x72,
-	0x6b, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x8c, 0x02, 0x0a, 0x1e, 0x43, 0x72,
+	0x6b, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xfc, 0x01, 0x0a, 0x1e, 0x43, 0x72,
 	0x65, 0x61, 0x74, 0x65, 0x52, 0x65, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x6f, 0x72, 0x79, 0x46, 0x72,
 	0x6f, 0x6d, 0x55, 0x52, 0x4c, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x38, 0x0a, 0x0a,
 	0x72, 0x65, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x6f, 0x72, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
 	0x32, 0x12, 0x2e, 0x67, 0x69, 0x74, 0x61, 0x6c, 0x79, 0x2e, 0x52, 0x65, 0x70, 0x6f, 0x73, 0x69,
 	0x74, 0x6f, 0x72, 0x79, 0x42, 0x04, 0x98, 0xc6, 0x2c, 0x01, 0x52, 0x0a, 0x72, 0x65, 0x70, 0x6f,
 	0x73, 0x69, 0x74, 0x6f, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x12, 0x1f, 0x0a, 0x09, 0x68, 0x74, 0x74, 0x70,
-	0x5f, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x42, 0x02, 0x18, 0x01, 0x52,
-	0x08, 0x68, 0x74, 0x74, 0x70, 0x48, 0x6f, 0x73, 0x74, 0x12, 0x3a, 0x0a, 0x19, 0x68, 0x74, 0x74,
-	0x70, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f,
-	0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x17, 0x68, 0x74,
-	0x74, 0x70, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x48,
-	0x65, 0x61, 0x64, 0x65, 0x72, 0x12, 0x16, 0x0a, 0x06, 0x6d, 0x69, 0x72, 0x72, 0x6f, 0x72, 0x18,
-	0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x6d, 0x69, 0x72, 0x72, 0x6f, 0x72, 0x12, 0x29, 0x0a,
-	0x10, 0x72, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x64, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73,
-	0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x72, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65,
-	0x64, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x22, 0x21, 0x0a, 0x1f, 0x43, 0x72, 0x65, 0x61,
+	0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x12, 0x3a, 0x0a, 0x19, 0x68, 0x74, 0x74, 0x70,
+	0x5f, 0x61, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x68,
+	0x65, 0x61, 0x64, 0x65, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x17, 0x68, 0x74, 0x74,
+	0x70, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x48, 0x65,
+	0x61, 0x64, 0x65, 0x72, 0x12, 0x16, 0x0a, 0x06, 0x6d, 0x69, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x05,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x6d, 0x69, 0x72, 0x72, 0x6f, 0x72, 0x12, 0x29, 0x0a, 0x10,
+	0x72, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x64, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73,
+	0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x72, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x64,
+	0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x4a, 0x04, 0x08, 0x03, 0x10, 0x04, 0x52, 0x09, 0x68,
+	0x74, 0x74, 0x70, 0x5f, 0x68, 0x6f, 0x73, 0x74, 0x22, 0x21, 0x0a, 0x1f, 0x43, 0x72, 0x65, 0x61,
 	0x74, 0x65, 0x52, 0x65, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x6f, 0x72, 0x79, 0x46, 0x72, 0x6f, 0x6d,
 	0x55, 0x52, 0x4c, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x4f, 0x0a, 0x13, 0x43,
 	0x72, 0x65, 0x61, 0x74, 0x65, 0x42, 0x75, 0x6e, 0x64, 0x6c, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
@@ -5418,7 +5373,7 @@ var file_repository_proto_rawDesc = []byte{
 	0x79, 0x42, 0x04, 0x98, 0xc6, 0x2c, 0x01, 0x52, 0x0a, 0x72, 0x65, 0x70, 0x6f, 0x73, 0x69, 0x74,
 	0x6f, 0x72, 0x79, 0x22, 0x29, 0x0a, 0x13, 0x47, 0x65, 0x74, 0x53, 0x6e, 0x61, 0x70, 0x73, 0x68,
 	0x6f, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x64, 0x61,
-	0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x64, 0x61, 0x74, 0x61, 0x22, 0xe3,
+	0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x64, 0x61, 0x74, 0x61, 0x22, 0xd3,
 	0x01, 0x0a, 0x23, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x52, 0x65, 0x70, 0x6f, 0x73, 0x69, 0x74,
 	0x6f, 0x72, 0x79, 0x46, 0x72, 0x6f, 0x6d, 0x53, 0x6e, 0x61, 0x70, 0x73, 0x68, 0x6f, 0x74, 0x52,
 	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x38, 0x0a, 0x0a, 0x72, 0x65, 0x70, 0x6f, 0x73, 0x69,
@@ -5428,12 +5383,11 @@ var file_repository_proto_rawDesc = []byte{
 	0x12, 0x19, 0x0a, 0x08, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x02, 0x20, 0x01,
 	0x28, 0x09, 0x52, 0x07, 0x68, 0x74, 0x74, 0x70, 0x55, 0x72, 0x6c, 0x12, 0x1b, 0x0a, 0x09, 0x68,
 	0x74, 0x74, 0x70, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
-	0x68, 0x74, 0x74, 0x70, 0x41, 0x75, 0x74, 0x68, 0x12, 0x1f, 0x0a, 0x09, 0x68, 0x74, 0x74, 0x70,
-	0x5f, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x42, 0x02, 0x18, 0x01, 0x52,
-	0x08, 0x68, 0x74, 0x74, 0x70, 0x48, 0x6f, 0x73, 0x74, 0x12, 0x29, 0x0a, 0x10, 0x72, 0x65, 0x73,
-	0x6f, 0x6c, 0x76, 0x65, 0x64, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x05, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x0f, 0x72, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x64, 0x41, 0x64, 0x64,
-	0x72, 0x65, 0x73, 0x73, 0x22, 0x26, 0x0a, 0x24, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x52, 0x65,
+	0x68, 0x74, 0x74, 0x70, 0x41, 0x75, 0x74, 0x68, 0x12, 0x29, 0x0a, 0x10, 0x72, 0x65, 0x73, 0x6f,
+	0x6c, 0x76, 0x65, 0x64, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x05, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0f, 0x72, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x64, 0x41, 0x64, 0x64, 0x72,
+	0x65, 0x73, 0x73, 0x4a, 0x04, 0x08, 0x04, 0x10, 0x05, 0x52, 0x09, 0x68, 0x74, 0x74, 0x70, 0x5f,
+	0x68, 0x6f, 0x73, 0x74, 0x22, 0x26, 0x0a, 0x24, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x52, 0x65,
 	0x70, 0x6f, 0x73, 0x69, 0x74, 0x6f, 0x72, 0x79, 0x46, 0x72, 0x6f, 0x6d, 0x53, 0x6e, 0x61, 0x70,
 	0x73, 0x68, 0x6f, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x96, 0x01, 0x0a,
 	0x14, 0x47, 0x65, 0x74, 0x52, 0x61, 0x77, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x52, 0x65,
@@ -5513,7 +5467,7 @@ var file_repository_proto_rawDesc = []byte{
 	0x64, 0x61, 0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x09, 0x6d, 0x61, 0x74, 0x63,
 	0x68, 0x44, 0x61, 0x74, 0x61, 0x12, 0x20, 0x0a, 0x0c, 0x65, 0x6e, 0x64, 0x5f, 0x6f, 0x66, 0x5f,
 	0x6d, 0x61, 0x74, 0x63, 0x68, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x65, 0x6e, 0x64,
-	0x4f, 0x66, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x22, 0xd5, 0x01, 0x0a, 0x06, 0x52, 0x65, 0x6d, 0x6f,
+	0x4f, 0x66, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x22, 0xc5, 0x01, 0x0a, 0x06, 0x52, 0x65, 0x6d, 0x6f,
 	0x74, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
 	0x03, 0x75, 0x72, 0x6c, 0x12, 0x3a, 0x0a, 0x19, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x61, 0x75, 0x74,
 	0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x68, 0x65, 0x61, 0x64, 0x65,
@@ -5521,12 +5475,11 @@ var file_repository_proto_rawDesc = []byte{
 	0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72,
 	0x12, 0x25, 0x0a, 0x0e, 0x6d, 0x69, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x72, 0x65, 0x66, 0x6d, 0x61,
 	0x70, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0d, 0x6d, 0x69, 0x72, 0x72, 0x6f, 0x72,
-	0x52, 0x65, 0x66, 0x6d, 0x61, 0x70, 0x73, 0x12, 0x1f, 0x0a, 0x09, 0x68, 0x74, 0x74, 0x70, 0x5f,
-	0x68, 0x6f, 0x73, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x42, 0x02, 0x18, 0x01, 0x52, 0x08,
-	0x68, 0x74, 0x74, 0x70, 0x48, 0x6f, 0x73, 0x74, 0x12, 0x29, 0x0a, 0x10, 0x72, 0x65, 0x73, 0x6f,
-	0x6c, 0x76, 0x65, 0x64, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x06, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x0f, 0x72, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x64, 0x41, 0x64, 0x64, 0x72,
-	0x65, 0x73, 0x73, 0x4a, 0x04, 0x08, 0x02, 0x10, 0x03, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x22,
+	0x52, 0x65, 0x66, 0x6d, 0x61, 0x70, 0x73, 0x12, 0x29, 0x0a, 0x10, 0x72, 0x65, 0x73, 0x6f, 0x6c,
+	0x76, 0x65, 0x64, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0f, 0x72, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x64, 0x41, 0x64, 0x64, 0x72, 0x65,
+	0x73, 0x73, 0x4a, 0x04, 0x08, 0x02, 0x10, 0x03, 0x4a, 0x04, 0x08, 0x05, 0x10, 0x06, 0x52, 0x04,
+	0x6e, 0x61, 0x6d, 0x65, 0x52, 0x09, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x68, 0x6f, 0x73, 0x74, 0x22,
 	0x59, 0x0a, 0x1d, 0x47, 0x65, 0x74, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x44, 0x69, 0x72, 0x65,
 	0x63, 0x74, 0x6f, 0x72, 0x79, 0x53, 0x69, 0x7a, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
 	0x12, 0x38, 0x0a, 0x0a, 0x72, 0x65, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x6f, 0x72, 0x79, 0x18, 0x01,
diff --git a/proto/remote.proto b/proto/remote.proto
index 4b91efb18..a11e1ed22 100644
--- a/proto/remote.proto
+++ b/proto/remote.proto
@@ -51,11 +51,6 @@ message UpdateRemoteMirrorRequest {
     // HTTPAuthorizationHeader is an optional HTTP header used for
     // authenticating against the remote repository.
     string http_authorization_header = 2;
-    // HttpHost is the hostname of the remote repository. Use this when the
-    // URL hostname has already been resolved to an IP address to prevent DNS
-    // rebinding. This is deprecated as we will be using resolved_address
-    // going forward.
-    string http_host = 3 [deprecated=true];
     // ResolvedAddress holds the resolved IP address of the remote_url. This is
     // used to avoid DNS rebinding by mapping the url to the resolved address.
     // Only IPv4 dotted decimal ("192.0.2.1"), IPv6 ("2001:db8::68"), or IPv4-mapped
@@ -63,6 +58,10 @@ message UpdateRemoteMirrorRequest {
     // Works with HTTP/HTTPS/Git/SSH protocols.
     // Optional.
     string resolved_address = 4;
+
+    // HttpHost has been removed in favor of ResolvedAddress.
+    reserved 3;
+    reserved "http_host";
   }
 
   // Repository is the repository whose mirror repository to update.
@@ -127,11 +126,6 @@ message FindRemoteRootRefRequest {
   // HttpAuthorizationHeader is the HTTP header which should be added to the
   // request in order to authenticate against the repository.
   string http_authorization_header = 4;
-  // HttpHost is the hostname of the remote repository. Use this when the
-  // URL hostname has already been resolved to an IP address to prevent DNS
-  // rebinding. This is deprecated as we will be using resolved_address
-  // going forward.
-  string http_host = 5 [deprecated=true];
   // ResolvedAddress holds the resolved IP address of the remote_url. This is
   // used to avoid DNS rebinding by mapping the url to the resolved address.
   // Only IPv4 dotted decimal ("192.0.2.1"), IPv6 ("2001:db8::68"), or IPv4-mapped
@@ -142,6 +136,10 @@ message FindRemoteRootRefRequest {
 
   reserved 2;
   reserved "remote";
+
+  // HttpHost has been removed in favor of ResolvedAddress.
+  reserved 5;
+  reserved "http_host";
 }
 
 // FindRemoteRootRefResponse represents the response for the FindRemoteRootRef
diff --git a/proto/repository.proto b/proto/repository.proto
index 6723f119c..da8027c81 100644
--- a/proto/repository.proto
+++ b/proto/repository.proto
@@ -671,11 +671,6 @@ message CreateRepositoryFromURLRequest {
   Repository repository = 1 [(target_repository)=true];
   // This comment is left unintentionally blank.
   string url = 2;
-  // HttpHost is the hostname of the remote repository. Use this when the
-  // URL hostname has already been resolved to an IP address to prevent DNS
-  // rebinding. This is deprecated as we will be using resolved_address
-  // going forward.
-  string http_host = 3 [deprecated=true];
   // http_authorization_header is the HTTP header which can be added to
   // the request in order to authenticate against the repository.
   string http_authorization_header = 4;
@@ -692,6 +687,10 @@ message CreateRepositoryFromURLRequest {
   // Works with HTTP/HTTPS/Git/SSH protocols.
   // Optional.
   string resolved_address = 6;
+
+  // HttpHost has been removed in favor of ResolvedAddress.
+  reserved 3;
+  reserved "http_host";
 }
 
 // This comment is left unintentionally blank.
@@ -871,11 +870,6 @@ message CreateRepositoryFromSnapshotRequest {
   string http_url = 2;
   // This comment is left unintentionally blank.
   string http_auth = 3;
-  // HttpHost is the hostname of the remote snapshot. Use this when the
-  // URL hostname has already been resolved to an IP address to prevent DNS
-  // rebinding. This is deprecated as we will be using resolved_address
-  // going forward.
-  string http_host = 4 [deprecated=true];
   // ResolvedAddress holds the resolved IP address of the remote_url. This is
   // used to avoid DNS rebinding by mapping the url to the resolved address.
   // Only IPv4 dotted decimal ("192.0.2.1"), IPv6 ("2001:db8::68"), or IPv4-mapped
@@ -883,6 +877,10 @@ message CreateRepositoryFromSnapshotRequest {
   // Works with HTTP/HTTPS protocols.
   // Optional.
   string resolved_address = 5;
+
+  // HttpHost has been removed in favor of ResolvedAddress.
+  reserved 4;
+  reserved "http_host";
 }
 
 // This comment is left unintentionally blank.
@@ -1021,10 +1019,6 @@ message Remote {
   //
   // If no refspecs are given, this defaults to "all_refs".
   repeated string mirror_refmaps = 4;
-  // HttpHost is the hostname of the remote repository. Use this when the
-  // URL hostname has already been resolved to an IP address to prevent DNS
-  // rebinding. This is deprecated as this field is/was never used.
-  string http_host = 5 [deprecated=true];
   // ResolvedAddress holds the resolved IP address of the remote_url. This is
   // used to avoid DNS rebinding by mapping the url to the resolved address.
   // Only IPv4 dotted decimal ("192.0.2.1"), IPv6 ("2001:db8::68"), or IPv4-mapped
@@ -1041,6 +1035,9 @@ message Remote {
   // field was at best confusing and useless and at worst actively harmful.
   reserved 2;
   reserved "name";
+  // HttpHost has been removed in favor of ResolvedAddress.
+  reserved 5;
+  reserved "http_host";
 }
 
 // This comment is left unintentionally blank.