Add Git to environment.yml

[MattF-NSIDC]

The version of Git that comes with Ubuntu 18 is pretty dated. My main concern is the lack of the modern switch and restore subcommands, which provide a more intuitive alternative to the checkout interface (I believe git checkout is unintuitive because it can both switch branches and restore files from another ref depending on invocation pattern). To avoid confusion, I prefer to avoid introducing new Git users to the checkout subcommand.

My other concern is the discovery of vulnerabilities in Git this past January. Based on this announcement, the fix was backported only to versions >= 2.30, whereas this image currently has 2.17.1.

This change is installing Git from conda-forge, but normally I'd use the git-core ppa for this. I don't think there's a way to do this without falling back to a custom Dockerfile.

[github-actions]

👈 Test this PR on Binder

[weiji14]

Yes, I'm a big fan of git switch as well! Could you write a comment below with just /condalock to regenerate the lockfile? Thanks!

[MattF-NSIDC]

/condalock

[MattF-NSIDC]

@weiji14 I accepted your suggestion, but after doing so the commit generated by GitHub shows up as "Partially Verified". Any idea how to get around this?

We cannot verify signatures from co-authors, and some of the co-authors attributed to this commit require their commits to be signed.

[weiji14]

@weiji14 I accepted your suggestion, but after doing so the commit generated by GitHub shows up as "Partially Verified". Any idea how to get around this?

We cannot verify signatures from co-authors, and some of the co-authors attributed to this commit require their commits to be signed.

Only way is if you can get my signing key 😝 I've got vigilant mode enabled (see https://docs.github.com/en/authentication/managing-commit-signature-verification/displaying-verification-statuses-for-all-of-your-commits#about-vigilant-mode), so any commits people do on my behalf (i.e. co-authored) will show up like that, which is fine.

[weiji14]

Thanks @MattF-NSIDC! Just a note that the dependency updates won't show up on the CryoCloud JupyterHub immediately. I think @tsnow03 will need to update some configuration following https://github.com/CryoInTheCloud/hub-image#updating-the-cryocloud-jupyterhub-to-use-a-new-image to point to the newly built docker image.

[MattF-NSIDC]

Awesome, thanks for your help getting this change out! ❤️