gl-compile-conf changed (see below) and "rc" file added
- factored out all the pathnames etc to an rc - taught it to create repos that dont exist but are mentioned - promoted user up one level (moving ref down) because gl-auth needs it - REPO_BASE no longer contains $HOME so that has to be added in manually - little bugs here and there, like in @refs
This commit is contained in:
Sitaram Chamarty
Sitaram Chamarty
parent
dc4193e633
commit
7d016908bd
14
example.gitosis-lite.rc
Normal file
14
example.gitosis-lite.rc
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
# this is meant to be pulled into a perl program using "do"
|
||||
|
||||
# gitosis-lite admin directory, files, etc
|
||||
$GL_ADMINDIR=$ENV{HOME} . "/.gitosis-lite";
|
||||
$GL_CONF="$GL_ADMINDIR/gitosis-lite.conf";
|
||||
$GL_KEYDIR="$GL_ADMINDIR/keydir";
|
||||
# this one has to agree with the other programs, watch out:
|
||||
$GL_CONF_COMPILED=$ENV{HOME} . "/.ssh/gitosis-lite.conf-compiled.pm";
|
||||
|
||||
# base directory for all the repos
|
||||
$REPO_BASE="repositories";
|
||||
|
||||
# this should be the last line in this file
|
||||
1;
|
||||
|
|
@ -16,15 +16,14 @@ use Data::Dumper;
|
|||
|
||||
# how run: manual, by GL admin
|
||||
# when:
|
||||
# - anytime a pubkey is added/deleted (i.e., contents of
|
||||
# ~/.gitosis-lite/keydir change)
|
||||
# - anytime a pubkey is added/deleted
|
||||
# - anytime gitosis-lite.conf is changed
|
||||
# input:
|
||||
# - ~/.gitosis-lite/gitosis-lite.conf
|
||||
# - ~/.gitosis-lite/keydir
|
||||
# - GL_CONF (default: ~/.gitosis-lite/gitosis-lite.conf)
|
||||
# - GL_KEYDIR (default: ~/.gitosis-lite/keydir)
|
||||
# output:
|
||||
# - ~/.ssh/authorized_keys
|
||||
# - ~/.ssh/gitosis-lite.conf-compiled.pm
|
||||
# - ~/.ssh/authorized_keys (dictated by sshd)
|
||||
# - GL_CONF_COMPILED (default: ~/.gitosis-lite/gitosis-lite.conf-compiled.pm)
|
||||
# security:
|
||||
# - touches a very critical system file that manages the restrictions on
|
||||
# incoming users. Be sure to audit AUTH_COMMAND and AUTH_OPTIONS (see
|
||||
|
|
@ -37,18 +36,39 @@ use Data::Dumper;
|
|||
# but we do have a "vim -d" popping up so you can see the changes being
|
||||
# made, just in case...
|
||||
|
||||
# other notes:
|
||||
# - keys are added/deleted from the keystore **manually**, and all keys
|
||||
# are named "name.pub". Keep the names simple.
|
||||
# ----------------------------------------------------------------------------
|
||||
# common definitions
|
||||
# ----------------------------------------------------------------------------
|
||||
|
||||
our $GL_ADMINDIR;
|
||||
our $GL_CONF;
|
||||
our $GL_KEYDIR;
|
||||
our $GL_CONF_COMPILED;
|
||||
our $REPO_BASE;
|
||||
|
||||
my $glrc = $ENV{HOME} . "/.gitosis-lite.rc";
|
||||
unless (my $ret = do $glrc)
|
||||
{
|
||||
die "parse $glrc failed: $@" if $@;
|
||||
die "couldn't do $glrc: $!" unless defined $ret;
|
||||
die "couldn't run $glrc" unless $ret;
|
||||
}
|
||||
|
||||
# ----------------------------------------------------------------------------
|
||||
# definitions specific to this program
|
||||
# ----------------------------------------------------------------------------
|
||||
|
||||
# command and options for authorized_keys
|
||||
our $AUTH_COMMAND=$ENV{HOME} . "/.gitosis-lite/gl-auth-command";
|
||||
our $AUTH_COMMAND="$GL_ADMINDIR/gl-auth-command";
|
||||
our $AUTH_OPTIONS="no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty";
|
||||
|
||||
our %groups = ();
|
||||
our %repos = ();
|
||||
|
||||
# quick subroutines
|
||||
# ----------------------------------------------------------------------------
|
||||
# subroutines
|
||||
# ----------------------------------------------------------------------------
|
||||
|
||||
sub my_chdir
|
||||
{
|
||||
chdir($_[0]) or die "chdir $_[0] failed: $!";
|
||||
|
|
@ -91,7 +111,7 @@ while (<INF>)
|
|||
# add our "start" line, each key on its own line (prefixed by command and
|
||||
# options, in the standard ssh authorized_keys format), then the "end" line.
|
||||
print OUT "# gitosis-lite start\n";
|
||||
my_chdir($ENV{HOME} . "/.gitosis-lite/keydir");
|
||||
my_chdir($GL_KEYDIR);
|
||||
for my $pubkey (glob("*.pub"))
|
||||
{
|
||||
my $user = $pubkey; $user =~ s/\.pub$//;
|
||||
|
|
@ -110,12 +130,12 @@ system("rm ~/.ssh/new_authkeys");
|
|||
|
||||
# if the gl admin directory (~/.gitosis-lite) is itself a git repo, do an
|
||||
# autocheckin. nothing fancy; this is a "just in case" type of thing.
|
||||
my_chdir($ENV{HOME} . "/.gitosis-lite");
|
||||
my_chdir($GL_ADMINDIR);
|
||||
if (-d ".git")
|
||||
{
|
||||
system("git add -A keydir"); # stage all changes in keydir
|
||||
if (! system("git diff --cached --quiet") )
|
||||
# and if there are any
|
||||
if (system("git diff --cached --quiet") )
|
||||
{
|
||||
open(COMMIT, "|-", "git commit -F -")
|
||||
or die "pipe commit failed: $!";
|
||||
|
|
@ -129,9 +149,9 @@ if (-d ".git")
|
|||
# "compile" GL conf
|
||||
# ----------------------------------------------------------------------------
|
||||
|
||||
open(INF, "<", $ENV{HOME} . "/.gitosis-lite/gitosis-lite.conf")
|
||||
open(INF, "<", $GL_CONF)
|
||||
or die "open GL conf failed: $!";
|
||||
open(OUT, ">", $ENV{HOME} . "/.ssh/gitosis-lite.conf-compiled.pm")
|
||||
open(OUT, ">", $GL_CONF_COMPILED)
|
||||
or die "open GL conf compiled failed: $!";
|
||||
|
||||
# the syntax is fairly simple, so we parse it inline
|
||||
|
|
@ -164,14 +184,14 @@ while (<INF>)
|
|||
elsif (/^(R|RW|RW\+) (.* )?= (.+)/)
|
||||
{
|
||||
my @perms = split //, $1;
|
||||
my @refs = split ' ', $2 if $2;
|
||||
my @refs; @refs = split(' ', $2) if $2;
|
||||
my @users = split ' ', $3;
|
||||
|
||||
# if no ref is given, this PERM applies to all refs
|
||||
@refs = qw(refs/.*) unless @refs;
|
||||
# fully qualify refs that dont start with "refs/"; prefix them with
|
||||
# "refs/heads/"
|
||||
@refs = map { m(^refs/) or s(^)(refs/heads/) } @refs;
|
||||
@refs = map { m(^refs/) or s(^)(refs/heads/); $_ } @refs;
|
||||
|
||||
# expand the user list, unless it is just "@all"
|
||||
@users = expand_userlist ( @users )
|
||||
|
|
@ -181,12 +201,12 @@ while (<INF>)
|
|||
for my $repo (@repos) # each repo in the current stanza
|
||||
{
|
||||
for my $perm (@perms)
|
||||
{
|
||||
for my $ref (@refs)
|
||||
{
|
||||
for my $user (@users)
|
||||
{
|
||||
$repos{$repo}{$perm}{$ref}{$user} = 1;
|
||||
for my $ref (@refs)
|
||||
{
|
||||
$repos{$repo}{$perm}{$user}{$ref} = 1;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -196,3 +216,23 @@ while (<INF>)
|
|||
|
||||
print OUT Data::Dumper->Dump([\%repos], [qw(*repos)]);
|
||||
close(OUT);
|
||||
|
||||
# ----------------------------------------------------------------------------
|
||||
# any new repos created?
|
||||
# ----------------------------------------------------------------------------
|
||||
|
||||
# modern gits allow cloning from an empty repo, so we just create it. Gitosis
|
||||
# did not have that luxury, so it was forced to detect the first push and
|
||||
# create it then
|
||||
|
||||
my_chdir("$ENV{HOME}/$REPO_BASE");
|
||||
for my $repo (keys %repos)
|
||||
{
|
||||
unless (-d "$repo.git")
|
||||
{
|
||||
mkdir("$repo.git") or die "mkdir $repo.git failed: $!";
|
||||
my_chdir("$repo.git");
|
||||
system("git init --bare");
|
||||
my_chdir("$ENV{HOME}/$REPO_BASE");
|
||||
}
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue