HTTP 503 when cloning Git repository

[Luís Infante da Câmara]

In the last week, I tried to clone https://git.launchpad.net/ubuntu-cve-tracker over 20 times. Only 3-4 attempts succeeded, with the remaining attempts failing with the following error:

Cloning into 'ubuntu-cve-tracker'...
error: RPC failed; HTTP 503 curl 22 The requested URL returned error: 503
fatal: expected flush after ref listing

[Colin Watson (cjwatson)]

HTTPS clones of ubuntu-cve-tracker are deliberately throttled, because there are some vulnerability analysis tools that clone this large repository rather than using something more appropriate like OVAL exports, and before we started throttling it our service was being routinely killed (effectively DDoSed) by these.

Can you please explain your use case so that we can suggest an appropriate workaround?

[Luís Infante da Câmara (luis220413)]

I clone the ubuntu-cve-tracker repository for the following:
* Scanning my Ubuntu systems for vulnerabilities. Ubuntu OVAL data does not suffice for this purpose, as it only covers CVEs addressed in USNs, and several important CVEs are not addressed in USNs.
* Comparing vulnerabilities. For this case, wget suffices.

Only one clone of the repository is needed.

[Luís Infante da Câmara (luis220413)]

This also happens when running git pull with this URL. A workaround is to use git+ssh://git.launchpad.net/ubuntu-cve-tracker instead.

[Luís Infante da Câmara (luis220413)]

Pulls are deliberately throttled as well: https://bugs.launchpad.net/ubuntu-cve-tracker/+bug/1943825

I will set the status of this bug to Invalid.