git: Verify that bundled Git binaries exist and are executable

We do not verify that all expected bundled Git binaries exist and are
executable when they have been configured by the administrator. As a
result, Gitaly will happly start up but then later fail at runtime when
trying to use the bundled Git execution environment in case any of the
binaries is missing.

Tighten our sanity checks to verify that the bundled Git environment is
set up correctly.

Changelog: fixed

2 files changed, 10 insertions, 7 deletions

diff --git a/internal/git/execution_environment.go b/internal/git/execution_environment.go
index 633b16cbe..d140c6f44 100644
--- a/internal/git/execution_environment.go
+++ b/internal/git/execution_environment.go
@@ -11,6 +11,7 @@ import (
 	"github.com/sirupsen/logrus"
 	"gitlab.com/gitlab-org/gitaly/v14/internal/gitaly/config"
 	"gitlab.com/gitlab-org/gitaly/v14/internal/metadata/featureflag"
+	"golang.org/x/sys/unix"
 )
 
 var (
@@ -197,9 +198,14 @@ func (c BundledGitEnvironmentConstructor) Construct(cfg config.Cfg) (_ Execution
 		"git-remote-ftps":    "gitaly-git-remote-http",
 	} {
 		target := target + c.Suffix
+		targetPath := filepath.Join(cfg.BinDir, target)
+
+		if err := unix.Access(targetPath, unix.X_OK); err != nil {
+			return ExecutionEnvironment{}, fmt.Errorf("checking bundled Git binary %q: %w", target, err)
+		}
 
 		if err := os.Symlink(
-			filepath.Join(cfg.BinDir, target),
+			targetPath,
 			filepath.Join(gitExecPath, executable),
 		); err != nil {
 			return ExecutionEnvironment{}, fmt.Errorf("linking Git executable %q: %w", executable, err)
diff --git a/internal/git/execution_environment_test.go b/internal/git/execution_environment_test.go
index 31b9221b4..e3775c113 100644
--- a/internal/git/execution_environment_test.go
+++ b/internal/git/execution_environment_test.go
@@ -91,17 +91,14 @@ func TestBundledGitEnvironmentConstructor(t *testing.T) {
 	})
 
 	t.Run("incomplete binary directory succeeds", func(t *testing.T) {
-		execEnv, err := constructor.Construct(config.Cfg{
+		_, err := constructor.Construct(config.Cfg{
 			BinDir: seedDirWithExecutables(t, "gitaly-git", "gitaly-git-remote-http"),
 			Git: config.Git{
 				UseBundledBinaries: true,
 			},
 		})
-
-		// It is a bug that this succeeds, we really should check that all expected binaries
-		// exist. We thus don't bother to check the generated execution environment.
-		require.NoError(t, err)
-		defer execEnv.Cleanup()
+		require.Error(t, err)
+		require.Equal(t, "checking bundled Git binary \"gitaly-git-http-backend\": no such file or directory", err.Error())
 	})
 
 	t.Run("complete binary directory succeeds", func(t *testing.T) {