Commit graph

259 commits

Author SHA1 Message Date
John Keeping 4abadc2b54 Grant shell access to all keys for shell users
If a user has multiple keys, ssh-authkeys-shell-users will only add the
"-s" flag to the first key it finds.  Change the substitution to apply
to all matching lines and hence grant shell access to all of the user's
keys.

Signed-off-by: John Keeping <john@keeping.me.uk>
2012-06-03 13:00:38 +05:30
Sitaram Chamarty db70595b87 fixup to pushing wild repos permissions...
- fix docs to explicitly state that mirroring wild repos is a bad idea
    if the authentication data is not the same on the peers.

  - an important check against a malicious peer was missed out.  If
    people heed the warning above this check is not really needed but it
    is good for completeness.

  - warning about redirected pushes removed, thanks to Ronald Ip having
    tested it and reported it working.
2012-06-03 07:44:08 +05:30
Sitaram Chamarty 78866f6f28 (experimental code) push wild repos across a master slave connection
It creates the repo on the remote side (getting the creator name from
the gl-creator file and sending it across), as well as sending gl-perms
on subsequent connections.

This has only been minimally tested.  E.g., complex setups or asymmetric
configs on master and slave, etc. have NOT been tested.

This has also not been tested with redirected pushes.
2012-06-01 17:28:14 +05:30
Sitaram Chamarty 42e0bac48c 'perms' command learns to create repo if needed 2012-06-01 16:01:36 +05:30
Sitaram Chamarty d9df70a04f allow getting config settings for non-existant repos also
It's reasonable to want to see config items (for example, mirror
settings) that *would* apply if the repo existed.
2012-06-01 16:01:36 +05:30
Sitaram Chamarty 7170ad9124 allow pubkey filename as extra argument to command in authkeys 2012-05-30 15:02:35 +05:30
Sitaram Chamarty a64401bd9a (doc) document the INPUT trigger 2012-05-30 15:02:35 +05:30
Sitaram Chamarty 21dbe53d39 fix minor bug in handling 'desc = "some description"'
repo foo
        desc = "foo"
        RW  =   u1
        ...etc...

The order of the clauses was parsing this like the old 'reponame = "some
description"' and end up creating a repo called 'desc'!

It would also, as a side-effect, change the repo so what you thought
were access rules for 'foo' would become access rules for 'desc'.
2012-05-29 20:55:53 +05:30
Sitaram Chamarty 06d3398fb0 lock binary files... (manually tested)
Remember that true locking is not possible in a DVCS; see
doc/locking.mkd for details and limitations of what is offered here.
2012-05-27 19:06:46 +05:30
Sitaram Chamarty d623388c9f (BSD compat) apparently 'wc -l' on BSD adds spaces in front
Larry was right.  It's probably easier to port a shell than a shell
script!
2012-05-27 05:58:43 +05:30
Sitaram Chamarty 8595303c82 migrated symbolic-ref command 2012-05-27 05:58:43 +05:30
Sitaram Chamarty 6f740908bb (collected docfixes) 2012-05-27 05:58:43 +05:30
Sitaram Chamarty 84d123e124 add 2 new sections to "special features"...
- using pubkeys obtained from elsewhere
  - updating hooks via the admin repo
2012-05-25 15:53:30 +05:30
Sitaram Chamarty 17841e8208 gitolite setup learns --hooks-only option 2012-05-25 12:54:06 +05:30
Sitaram Chamarty e1d9aee98b delete the 'description' file for new repos 2012-05-25 12:54:06 +05:30
Sitaram Chamarty 37e97d29fe the 3 shipped post-create programs should exit when called on a normal repo creation 2012-05-25 12:47:12 +05:30
Sitaram Chamarty 0f3a09ce60 PRE_ and POST_CREATE should work for normal repos also 2012-05-25 12:47:12 +05:30
Sitaram Chamarty 04367af3e8 Revert "simulate POST_CREATE for newly created "normal" repos"
This reverts commit bc3eb34211.
2012-05-25 12:47:12 +05:30
Mike Kelly 62a66662be Properly migrate [gitosis] section 2012-05-23 05:08:22 +05:30
Sitaram Chamarty 75387fd6cb v3.03 2012-05-23 04:34:07 +05:30
Sitaram Chamarty 5298a79cb5 MAJOR BUGFIX: disallow "hooks" directory in admin repo
Although this is not a "hole" that allows a normal user to bypass
controls, I still consider this a hole in the sense that I want to
separate "admin push" rights from "shell access on server" rights.

(I realise that most people don't make this distinction, but I do, and
for me and most sites I consult for it is important).

Thanks to drue on #gitolite who pointed it out excitedly, and apologies
for killing what he thought of as a feature!
2012-05-23 04:33:54 +05:30
Sitaram Chamarty dd083085cf (fix bugly) info -ld should handle missing description files more gracefully
bugly = bug that makes the output ugly :)
2012-05-23 03:37:52 +05:30
Sitaram Chamarty 2907561529 (minor) solaris doesn't like "shift" when there are no arguments remaining 2012-05-22 13:17:10 +05:30
Sitaram Chamarty 55d64752ae fix repo alias to work when reponame has leading "/"
as in git@host:repo.git works but ssh://git@host/repo.git doesn't
2012-05-22 11:57:40 +05:30
Sitaram Chamarty b6ce11a19f (minor) permissions fixup -- sugar scripts do not need +x 2012-05-22 07:06:41 +05:30
Sitaram Chamarty b12a967272 update g2 compat and migr info
thanks to karihre on #gitolite for catching the first of the corrections
(GL_GET_MEMBERSHIPS_PGM) and so reminding me...
2012-05-22 07:05:33 +05:30
Sitaram Chamarty d04e79d291 (minor) single quotes around variables in error messages
(plus a couple of other minor fixups)
2012-05-21 17:44:30 +05:30
Sitaram Chamarty 20d2120ea5 move input command check so it works for non-ssh modes also 2012-05-21 15:24:40 +05:30
Sitaram Chamarty 3a59f5aff0 line up regexes for easier review 2012-05-21 15:24:40 +05:30
Sitaram Chamarty 8aba6ec2be v3.02 2012-05-20 16:42:43 +05:30
Sitaram Chamarty 72b6a54e0a test packaging instructions and make required changes 2012-05-20 14:21:23 +05:30
Sitaram Chamarty 27c0190b76 packaging instructions make analogy with git for better explanation 2012-05-20 06:38:18 +05:30
Sitaram Chamarty 8644690506 (ssh) make it easier to make give some users a full shell 2012-05-19 06:01:05 +05:30
Sitaram Chamarty 07169c37ec allow aliasing a repo to another name
all documentation is inside Alias.pm.
2012-05-19 06:01:05 +05:30
Sitaram Chamarty bc3eb34211 simulate POST_CREATE for newly created "normal" repos
See "background" in new program src/triggers/new-normal-repos
2012-05-16 18:55:06 +05:30
Sitaram Chamarty 17a680e0f6 (collected docfixes) 2012-05-16 18:54:52 +05:30
Sitaram Chamarty e511943a45 just for kicks, a VREF that allows voting on changes to a branch
(manually smoke tested; no test script)

I've been meaning to do this for a while, since someone told me that is
one of gerrit's features they like.

Of course, gitolite can't/won't do the whole "code review" thing (nor
the workflow enforcement that follows).

But voting is simple -- literally 2-3 lines of code in a VREF.  (The
rest is inline documentation).
2012-05-10 12:28:37 +05:30
Sitaram Chamarty fa2893be7c the dupkeys function was already in ssh-authkeys...
...so there's no need for the VREF.

Ironically, while I was arguing with Eli that I wouldn't do it and why,
the code was *already* there, and had been for over a month!  (It must
have been there for much longer for me to have forgotten!)

TODO: convert from using fingerprint compute to actual key strings when
the complaints about speed start appearing.

My own personal speed up loop [1] I guess :)

[1]: http://thedailywtf.com/Articles/Classic-WTF-The-Speedup-Loop.aspx
2012-05-07 15:08:46 +05:30
Sitaram Chamarty 699bafa096 (minor fixup to t/info.t) 2012-05-06 19:06:11 +05:30
Sitaram Chamarty e76be7ff11 move repo/user validity check deeper
(but change repo check to allow repoPATT instead of just repoNAME)

This is because there are/will be some situations where access() is
called without those two checks being done (i.e., it is not only from
src/commands/access that it is called).
2012-05-06 19:02:42 +05:30
Sitaram Chamarty 196706c145 bugfix: smart http mode wasn't running pre_ and post_ git triggers
(while we're about it, we also steal Michael Brown's idea (patch #2 in
[1] and get rid of GIT_HTTP_BACKEND).

[1]: http://groups.google.com/group/gitolite/msg/adfae758dd28f2a8
2012-05-05 18:07:15 +05:30
Sitaram Chamarty 6d057fb84c allow info to print description also 2012-05-04 18:13:42 +05:30
Sitaram Chamarty d8df4a9344 git-config bugfix + backward compat breakage in usage of 'config'
(1) the backward compat breakage: you can't create empty-valued config
    keys anymore.  That is, you can't do the eqvt of the following shell
    command using gitolite

        git config foo.bar ""

(2) fixed a bug where this:

        repo foo
            config foo.bar =

    when queried using

        gitolite git-config -r foo .

    would return even the empty valued ones, which -- remember! -- are
    not supposed to exist anymore.

    Fixing this bug allows situations like this to not show the admin
    repo in gitweb:

        repo [a-z].*
            config gitweb.owner = P-h B

        repo gitolite-admin
            config gitweb.owner =

----

background...

Somewhere in g3 (well actually in 057506b), we lost the ability to
distinguish
    config foo.bar  =   ""
from
    config foo.bar =

I decided that conflating them is more intuitive for most people,
because a survey [1] revealed that no one seemed to want the equivalent
of the following shell command:

----

[1] ...of a (small prime greater than 1) number of people on #git
2012-05-04 17:30:22 +05:30
Andreas Stenius 47a0c44540 migrated htpasswd command from g2.
(with some fixups by committer)
2012-05-03 11:04:22 +05:30
Sitaram Chamarty 49d132a969 minor fix to info command output under httpd...
when running under httpd, $ENV{USER} is not set, so we use a (hopefully
informative) default to print.

Thanks to Thomas Hager (duke at sigsegv dot at) for catching this.
2012-05-01 15:06:06 +05:30
Sitaram Chamarty c145528849 (minor typo fix) 2012-05-01 14:20:13 +05:30
Sitaram Chamarty 850882c1a6 allow VREF code to print to STDOUT...
Using a g2-style "chained update hook" as a VREF doesn't *quite* work:

  - all STDOUT from the hook is lost
  - worse, all lines get parsed as a ref followed by a message, and if
    the ref doesn't look like a ref it dies

So now we do all this only if the message starts with 'VREF/'.  Any
other output is just printed out as is.
2012-04-30 06:02:17 +05:30
Sitaram Chamarty 88c8d774d0 v3.01 2012-04-29 05:56:40 +05:30
Thomas Hager 88b4c86c38 Added instructions to make repositories available via http and ssh
This patch adds instructions for configuring Gitolite and Apache 2.x
to make repositories available to both ssh and http clients.

[minor fixups by committer]
2012-04-28 22:58:09 +05:30
Sitaram Chamarty 48ed4deb8f BSD compat changes
thanks to milki for all the efforts!

Details:

  - partial-copy fell afoul of BSD not having $RANDOM
  - test suite: fix bad GNU sort with good perl sort
  - test suite: fix md5sum dependency (which BSD doesn't have or can't
    easily have or requires extra options or whatever...), by doing it
    in perl.  (Requires Digest::MD5, which is probably available
    anyway, but since this is only for the test suite, meh!)
2012-04-28 22:58:09 +05:30