wrap_print() was written to create a new file and rename the old one to
avoid a partially written file being read by other processes. This has
only been reported for the 'projects.list' file, but I just did it for
all files as a matter of course.
list of files currently written via this function:
gl-creater, gl-perms, description, git-daemon-export-ok, projects.list
However, some people want to do the following:
- set REPO_UMASK tight (0077, default)
- manually change the perms to something looser (typically g+rX) for
specific repos
- set core.sharedRepository to 0750 (git is documented to honor that
config if available and to override umask)
Except that core.sharedRepository does not apply to files written by
gitolite and not git itself. So they would open up their description
files and the next compile would close them again!
This patch prevents this from happening. If the file already exists, it
maintains the same permissions after the rename.
previously, these two would produce different results
config aa.bb = 'true' # config file line includes single quotes
config aa.bb = "true" # config file line does not include any quotes
Now the former will also behave like the latter.
Without this, complex mirroring scenarios will be unpredictable. For
example (abbreviating "gitolite.mirror." to "gimo.") something as simple
as this will not give "foo" his different mirror setup
repo @all
config gimo.master = "frodo"
config gimo.slaves = "sam"
repo foo
config gimo.master = "sam"
config gimo.slaves = "frodo gollum"
repo foo bar
RW = u1
Even worse things happen when you have wild cards.
Now, however, they all come in the right sequence and the most recent
one takes effect (unlike ACL rules, where the first match wins, because
there you're trying to just find a match and get out, while here you're
just mindlessly applying config lines in the right order).
We previously said all mirroring features are disabled if GL_HOSTNAME is
not set.
But what if, after mirroring has been setup, and master/slaves defined
for a repo, a slave admin fat-fingers the RC file and accidentally
comments out GL_HOSTNAME? We might end up violating RULE NUMBER ONE!
- post-receive now just calls mirror-push
- mirror-push is a medium complex shell script (all that backgrounding
etc., can't be done so easily in God's first language!)
- mirror-shell is now a perl program that does a few different things
(receive mirror-pushes, command line re-sync, re-sync requests from a
slave, etc)
- auth-command changes to reject/redirect non-native pushes
Supporting git on DOS may be a fact of life, but it felt good to make
them use the "right" editor (hint: starts with v, ends with m, has three
letters), or at least something equivalent, to produce their setperms
input files.
I'd say "yes Fred I know. However, Unix doesn't work like that, and
when talking to a big, important, OS like Unix from your little
single-user workstation, you do have to go the extra mile. It's not
that different from going into a meeting with the CEO you know -- you
dress up a little for that meeting don't you?". And Fred would nod, a
little awed by the analogy. Maybe the awe was tinged with a wee bit of
anger but not much; he knows there's a hierarchy among OSs, just like
among people, and he knows where his OS stands in that hierarchy...
----
For the humour impaired, that was a joke. To start with, I don't know
anyone called Fred.
It *is* true that I tend to ignore DOS if at all possible, especially in
my *code*. But since I don't really use wildrepos at work, this issue
would never have come up for me, even in the DOS projects I manage.
In this case someone who's contributed a heck of a lot to the evolution
of gitolite asked, so here it is.
----
oh and in case you were wondering, DOS stands for "dominant operating
system" ;-)
Fix a problem with authkeys perms when REPO_UMASK is too loose.
(To duplicate it, run a fresh, non-root install, and when gl-setup pops
up an editor, change the REPO_UMASK to 0007 (from the default 0077).
You'll find that ~/.ssh/authorized_keys now has g+w set, causing sshd to
refuse key-based access.)
And before you ask, even though gl-setup does it, I won't fiddle with
the permissions of an existing file in *this* code. (gl-setup is run
manually by the admin, this one gets run on every push).
----
Side note: 9ad7ea4 was somewhat forced on me, and I didn't really agree
with parts of it. I have no idea why I gave in so easily, but it won't
happen again!
a warn/die may happen even before setup_environment() has been called,
so then log_it() tries to use uninitialised variables and it then adds
to the confusion complaining about *those*
make the arguments optional (with documented defaults) plus they need
not exist a priori, reducing one command (the silly mkdir!) that the
user has to run.
All this is preparatory to deprecating the from-client method. We've
even switched the test suite to 'non-root' method now
The KDE folks have a projects.list file that gets picked up by rsync and
sent elsewhere in some cron-ish manner. They noticed that occasionally
the file that went across was truncated, which indicates that maybe it
got picked up while it was still being written.
oh and this change also affects any files that get written using
wrap_print()
(thanks to yoonique dot net at gmail; he also tested that files with
some normal and some md5 passwords, such as would happen on an upgrade,
work fine)
git 1.7.4+ insists on these two being defined. So I reduce my support
load by forcing them if they were not set.
Much easier than explaining to people what should be obvious from the
error message.
$ENV{GL_REPO_BASE_ABS} is meant to point to the same directory as
$REPO_BASE, except it is meant to be passed to hooks, ADCs and other
child programs. And since you can't be sure where the child program
starts in, this became an absolute path.
Gradually, however, I started using it wherever I needed an absolute
path (mostly in code that jumps around various directories to do stuff).
Which is silly, because there's no reason $REPO_BASE cannot also be made
an absolute, even if the rc file has a relative path.
So that's what I did now: made $REPO_BASE absolute very early on, and
then systematically changed all uses of the longer form to the shorter
form when appropriate. And so the only thing we now use the longer one
for is to pass to child programs.
(Implementation note: The actual change is not very big, but while I was
about it I decided to make the test suite able to test with an absolute
REPO_BASE also, which is why the commit seems so large.)
----
This all started with a complaint from Damien Regad. He had an
extremely odd setup where his bashrc changed PWD to something other than
$HOME before anything else ran. This caused those two variables to
beceom inconsistent, and he had a 1-line fix he wanted me to apply.
I generally don't like making special fixes for for non-standard setups,
and anyway all he had to do was set the full path to REPO_BASE in the rc
file to get around this. Which is what I told him and he very politely
left it at that.
However, this did get me thinking, and I soon realised I was needlessly
conflating "relative versus absolute" with "able to be passed to child
programs". Fixing that solved his problem also, as a side-effect.
So I guess this is all thanks to Damien!
Technically this does not add any new information, but I'm hoping it
will help the folks just won't read what's on the screen otherwise.
The main impetus this time is git 1.7.4, which is strict about
user.email and user.name and rejects commits when those config variables
are not set. As a result, the number of times gl-easy-install hits a
fatal error and bombs out without completing its job, has increased
drastically.
The code that sets %projlist doesn't even run if GL_NO_DAEMON_NO_GITWEB
is set, so it doesn't make sense to then *use* that (empty) variable and
effectively wipe out the projects.list file.
Thanks to m0 for asking...
(suggested by cmyers and ryan_c on #gitolite)
Between wrap_print(), which now takes a list, and the new slurp(),
pretty much everything to do with 'cat' or 'echo' has been converted to
pure perl.
----
Personally, I consider these changes to be somewhat gratuitous, because
none of these had a security *or* a performance concern. But since the
amount of new perl code was not too high (just the slurp() function,
really), I figure it's not a big deal to do it.
with warns now being logged, it's nice to make sure that anything that
could even vaguely be considered someone playing with the system, *or*
is otherwise noteworthy, be emitted as a 'warn' instead of as a 'print
STDERR'. Similarly stuff that is clearly a syntactic warning or typo
should come from 'print STDERR', instead of from a 'warn'.
ryan-c on #gitolite (ryan.castellucci@gmail.com) found that if a user
types in
ssh git@server `echo -e "\033[2J"`
or eqvt, he can get raw ASCII control characters into gitolite's log
file. Then if a gitolite admin 'cat's the log file (instead of using a
pager, or uses a pager in raw mode like 'less -r'), those control
characters hit his screen and do stuff.
While clearing the screen etc is probably harmless and I would not have
bothered, we know that the old vt100 would allow the keyboard to be
remapped by the server sending control codes, and we're not really sure
which of the currently in use terminals emulate this.
And finally, I found somewhere that "PuTTY allows the server to send
control codes that let it take over the mouse". Scary...
(...of course, I hate putty/plink so I was sorely tempted to leave this
as is to punish people who use it <grin> but not really; I'd joke about
it but won't actually *do* it!)
Earlier, it wasn't as critical for gl-setup to be run with the full
path; the BINDIR deduction used to happen in almost every program. Now
it's a lot more important.
Apparently I never noticed that "/bin/bash -l gl-setup" does not set $0
to the correct, fq path. Adding a "-c" does, however...
[thanks to Jeff from the KDE team for finding this]
This shaves 3 seconds off of KDE's config compile time :-)
Yes, I know wrap_print has that extra print statement, but otherwise it
was lying around not earning its keep so I gave it a little side job :-)
you might wonder why these are different from all the other variables in
the rc file... it's just that I never thought people would want to
change these!
