Commit graph

600 commits

Author SHA1 Message Date
Sitaram Chamarty 76ae0268fa post-update learns to be quieter
apparently people run it from cron, so this causes a silly one-line
email saying just "Already on master"

thanks to shruggar on #git for pointing out to me that it is quite safe
to use --quiet and will not lose any actual error messages :)
2011-01-29 06:16:13 +05:30
Sitaram Chamarty 1fce051ea1 add -prune to find commands
Apparently it makes a huge difference with some kinds of network drives
(guess which company's software ;-)

http://groups.google.com/group/gitolite/browse_thread/thread/66b888f11dc5a365
2011-01-28 04:55:04 +05:30
Sitaram Chamarty dab35f3565 fixup all docs to allow URLs pointing to gh-pages 2011-01-26 08:08:18 +05:30
Sitaram Chamarty 12f75cdc41 (minor doc fixes for next commit) 2011-01-26 08:08:18 +05:30
Sitaram Chamarty 6bcb5c162d gitolite.conf gets its own document now 2011-01-24 06:21:00 +05:30
Richard Bateman 00a926bf48 Added perms PDC to supplement setperms/getperms
- Also added pygitolite.py as a helper library for python PDC apps
2011-01-21 14:14:09 +05:30
Richard Bateman 108f8e96a2 Added PDC set-head for setting the HEAD ref on a remote branch that you have write access to 2011-01-21 14:14:09 +05:30
Sitaram Chamarty 2cbe807b34 (doc) clarify GIT_HTTP_EXPORT_ALL is not mandatory for mixed ssh+http setups 2011-01-20 07:14:19 +05:30
Sitaram Chamarty 0360dc9f3f test smart http mode, update docs (including mob mode)
- allow a mob username to be defined; all unauthenticated access will
    look to gitolite like this user (if you setup apache also properly)

  - update doc with more details (some repeat stuff from `man
    git-http-backend` but it's probably worth having everything in one
    place
2011-01-17 22:04:10 +05:30
Jan Koprowski c8b1d8cc5b Document handling non-openssh but ssh2-compatible public keys by gitolite. 2011-01-16 20:20:14 +05:30
Sitaram Chamarty 3c1633c659 (minor) gl-setup learns "-q"
suppresses popping an editor when run for the first time
2011-01-16 14:42:11 +05:30
Sitaram Chamarty 692552d146 gitolite v2.0rc1 -- please see new developer-notes doc 2011-01-16 07:26:13 +05:30
Sitaram Chamarty d022d90031 some tests added/expanded 2011-01-15 19:18:31 +05:30
Sitaram Chamarty 9b5793f2d1 v1.5.9 2011-01-15 19:02:34 +05:30
Sitaram Chamarty efa8e0ff16 new contrib/ldap with 3 useful scripts (thanks to Nokia MeeGo folks) 2011-01-13 13:24:01 +05:30
Sitaram Chamarty d8789a3af0 get rid of wasted parse in wild_repo_rights 2011-01-12 00:37:09 +05:30
Sitaram Chamarty c642d9660e (forgot some test output files from an earlier commit) 2011-01-05 19:13:07 +05:30
Sitaram Chamarty 5004369e17 minor doc fix re @all and deny rules
http://groups.google.com/group/gitolite/browse_thread/thread/aa5f87e826cef687
2011-01-05 18:25:12 +05:30
Sitaram Chamarty 10a30c961d (major change in big-config mode) split the compiled config file
Fedora's config has over 11,000 repositories and the compiled config
file is over 20 MB in size.  Although negligible on a server class
machine, on my laptop just parsing this file takes a good 2.5 seconds.

Even if you use GL_ALL_READ_ALL (see a couple of commits before this
one) to remove the overhead for 'read's, that's still a pretty big
overhead for writes.  And GL_ALL_READ_ALL is not really a solution for
most people anyway.

With this commit, using GL_BIG_CONFIG adds another optimisation; see
doc/big-config.mkd for details (look for the word "split config" to find
the section that talks about it).

----

Implementation notes:

  - the check for GL_NO_CREATE_REPOS has moved *into* the loop (which it
    completely bypassed earlier) so that write_1_compiled_conf can be
    called on each item
2011-01-02 11:30:29 +05:30
Sitaram Chamarty 7fc1e9459f (data format change) fix misnamed 'repo_config' to 'git_configs'
this change includes a minor data format change.  This should be mostly
transparent for upgrades though.
2011-01-02 10:21:39 +05:30
Sitaram Chamarty 27081ad1c1 new rc var: GL_ALL_READ_ALL 2011-01-02 10:21:39 +05:30
Sitaram Chamarty e0f4bbaf16 (minor) more doc updates, really small ones 2010-12-31 20:17:36 +05:30
Sitaram Chamarty ffcbc52637 rc file stripped down, variables categorised, documentation lifted out
the old file was getting too unwieldy...
2010-12-31 19:03:48 +05:30
Sitaram Chamarty 3abb7ac1a8 (minor) usermod has a "-a" -- I didn't know!
(thanks to Michael Schueler)
2010-12-28 21:54:34 +05:30
Sitaram Chamarty e98bde322e allow gitolite to be used when the users already have real IDs
Fedora (for example) runs like this:

  * each user has his own userid and login
  * his/her ~/.ssh/authkeys file (containing only his/her key) has a
    "command=" clause invoking just "gl-auth-command"
  * trusted users have "gl-auth-command -s" meaning they can get a shell if
    they want to

As a result, there is no specific $HOME where you can look for
.gitolite.rc.  Hence this patch

----

Side note: in addition, Fedora may have one or more of the following
characteristics (writing them here for convenience; they're not directly
relevant to this patch):

  * actual git repos are under "git" (or some such), and include the chmod g+s
    (git init --shared) unix perms tricks for shared access

  * but since they're coming through gl-auth, branch-level acls are in effect

  * the gitolite config file is generated from some database and compiled (all
    via cron)

  * they keydir/ is empty; in fact they probably don't use the admin repo at
    all, AFAIK
2010-12-28 13:58:53 +05:30
Sitaram Chamarty 5b9bf700cc allow access checks from ADC or hook
For sample code see new file contrib/adc/get-rights-and-owner.in-perl.
Despite the name, you can use similar code in a hook also -- comments in
that file will tell you how.

implementation notes:

  - check_access now takes an optional last arg "dry_run", which is also
    passes through to check_ref
  - check_ref returns a "DENIED by ..." instead of die-ing if dry_run is
    passed in

  - as a side effect, cli_repo_rights is now just a stub calling
    check_access (we kept it hanging around for backward compat -- too
    much adc pain for too many people if we change it now)
2010-12-25 12:40:41 +05:30
Sitaram Chamarty f88b097db1 v1.5.8 2010-12-25 05:58:27 +05:30
Sitaram Chamarty 975a0d05b0 minor fix to mirror-shell...
needed if $REPO_BASE contains slashes.

(reported/code sent by Dylan Simon)
2010-12-25 05:58:26 +05:30
Sitaram Chamarty 45a696c419 fine tune "no pubkeys" warning
perm categories (like READERS and WRITERS, or whatever you put in your
$GL_WILDREPOS_PERM_CATS) are *supposed* to "have no pubkeys"; don't warn
about them
2010-12-25 05:58:26 +05:30
Sitaram Chamarty 5f3344025c (minor) doc updates 2010-12-25 05:58:26 +05:30
Sitaram Chamarty 2bbcc8239c tighten up pattern to check rsync arguments
thanks to Joe Schaefer at the ASF for catching it.  Note that this new
pattern *may* be too restrictive -- if you're using this feature and
have a problem with the new pattern please email me.

See email to gitolite mailing list around this date (2010-11-28) for
more details.
2010-11-28 20:12:39 +05:30
Sitaram Chamarty db97c5a40a (minor) indentation fix
been meaning to do it for a while, but I got a push:

http://colabti.org/irclogger/irclogger_log/git?date=2010-11-26#l622

----

If I had been on the channel at that time I may have quoted Emerson on
"consistency" just for the fun of it...  ;-)
2010-11-28 09:34:47 +05:30
Teemu Matilainen 21a00bd6a9 gl-setup: Replace similar long one-liners with functions 2010-11-21 19:16:52 +05:30
Teemu Matilainen b0d641ef48 gl-setup: Avoid stupid "cd -" simulation tricks
They don't work if someone calls the script for example
    su - gitolite -c gl-setup <key>
from a directory where "gitolite" user does not have permissions (e.g.
0700), then 'cd $od' fails and we stay in gitolite's $HOME.

[commit message changed by committer; author was more polite ;-)]
2010-11-20 22:18:16 +05:30
Teemu Matilainen d8179f09bf Print to STDERR when dying
Signed-off-by: Teemu Matilainen <teemu.matilainen@reaktor.fi>
2010-11-20 21:54:56 +05:30
Sitaram Chamarty 5ce22e135d (contrib) update-email-check added; please read comments first! 2010-11-19 15:33:26 +05:30
Sitaram Chamarty c1b27eae22 stick to regex metas that come with perl 5.8
we have a stated aim to work with any perl that git is happy with, which
means it should work with perl 5.8.  At least :)
2010-11-18 19:23:13 +05:30
Sitaram Chamarty 74726fdc31 added watch ADC (includes documentation), courtesy mitchell@kde.org 2010-11-18 12:40:09 +05:30
Sitaram Chamarty 7313d48247 gitolite-down: disable write-access to take backups
(we quietly do not document the 'able' adc, which is now the most
"official" adc in the sense that it has a new test, t64-write-able!)

other notes: fix bug in 'able' (not setting $loc)
2010-11-16 22:57:23 +05:30
Sitaram Chamarty 16ab95665c (admin doc) try that "moving servers" thing again :) 2010-11-16 14:35:39 +05:30
Sitaram Chamarty acfaa421d1 BSD compat changes
- openssh 5.6 doesn't like "ssh user@host" with no command following
    it, because they changed the rules for pty allocation failure.

    I'm calling this a BSD compat change because BSD hit it first, but
    really, the "ssh -T" will eventually be needed by Linuxes also, as
    they start upgrading to openssh 5.6

  - FreeBSD (and I presume the other BSDs also) *require* a "-t"
    argument to mktemp (thanks to matias for finding this).

    Note that on FreeBSD, -t is a prefix (the X's are taken literally,
    and the real random stuff gets appended to the prefix), while on
    Linux, it is a template (the X's are converted to random
    characters).  Thus, on BSD you will get names like
    /tmp/tmp.XXXXXXXXXX.1BAEGkHm, whereas on Linux you'll get
    /tmp/tmp.Aq7vbdNpGp or something.
2010-11-15 05:25:19 +05:30
Sitaram Chamarty 0b6edbf7c2 (minor) fix doc refs missed when we renamed some doc files 2010-11-15 05:25:18 +05:30
Sitaram Chamarty ad727488fc (install doc) various updates
(thanks to a somewhat heated "discussion" with "abstrakt" on #git)

While I don't agree with everything he said, some improvements are
always possible (always, always!) in docs:

  - move the "conventions used" section closer to the action
  - add note about RPM/DEB using "gitolite" as the user, not "git"
  - de-emphasise multiple gitolite hosting users at the top; refer
    advanced users to the already present detailed section later instead
  - in that section, add a bit of intro, and hand-wave the inconsistency
    between its 2 sub-sections ;-)

----

Unrelated to the "discussion" today, someone else (running Arch? don't
remember) had a system where /usr/local/bin was not in $PATH for a
normal user, so I added a note about that.
2010-11-14 11:05:13 +05:30
Sitaram Chamarty 64728c805b (admin doc) moving servers 2010-11-12 19:27:17 +05:30
Sitaram Chamarty 270e0b9157 (minor) support saying 'repo.git' in the config file
but complain loudly so they stop doing this... :-)
2010-11-10 18:07:58 +05:30
Teemu Matilainen 6eb8558e8d compile: Allow empty @group definitions
Use case: group information is generated from an external system and
because of synchronization or authorization restrictions some groups
can be empty.

Signed-off-by: Teemu Matilainen <teemu.matilainen@reaktor.fi>
2010-11-10 12:38:15 +05:30
Sitaram Chamarty 182b1d0b34 (who-uses) Gentoo's overlay system now uses gitolite 2010-11-07 21:59:49 +05:30
Sitaram Chamarty 047790140a custom perm categories in setperms (WARNING: PLEASE READ FULL COMMIT MESSAGE)
THE COMPILED CONFIG FILE FORMAT CHANGES WITH THIS VERSION.  PLEASE DO
NOT MIX VERSIONS OR DOWNGRADE.  Upgrading using normal gitolite upgrade
means should be fine, though.

Originally, we only allowed "R" and "RW" as categories of users supplied
to the `setperms` command.  These map respectively to "READERS" and
"WRITERS" in the access rules.

Now:

  - we prefer READERS instead of R and WRITERS instead of RW
  - we allow the admin to define other categories as she wishes
    (example: MANAGERS, TESTERS, etc).  These do not have abbreviations,
    however, so they must be supplied in full.

PLEASE, *PLEASE*, read the section in doc/wildcard-repositories.mkd for
more info.  This is a VERY powerful feature and if you're not careful
you could mess up the ACLs nicely.

Backward compat note: you can continue to use the "R" and "RW"
categories when running the "setperms" command, and gitolite will
internally convert them to READERS and WRITERS categories.

----

implementation notes:

  - new RC var called GL_WILDREPOS_PERM_CATS that is a space-sep list of
    the allowed categories in a gl-perms file; defaults to "R RW" if not
    specified

  - wild_repo_rights no longer returns $c, $r, $wC, where $r = $user if
    "R $user", $r = '@all' if "R @all", and similarly with $w and "RW".

    Instead it returns $c and a new hash that effectively gives the same
    info, but expanded to include any other valid categories (listed in
    GL_WILDREPOS_PERM_CATS)

  - consequently, the arguments that parse_acl takes also change the
    same way

  - (side note: R and RW are quietly converted to READERS and WRITERS;
    however, new categories that you define yourself do not have
    abbreviations)

  - setperms validates perms to make sure only allowed categories are
    used; however even if someone changed them behind the scenes,
    wild_repo_rights will also check.  This is necessary in case the
    admin tightened up GL_WILDREPOS_PERM_CATS after someone had already
    setperms-d his repos.

  - as a bonus, we eliminate all the post-Dumper shenanigans, at least
    for READERS and WRITERS.  Those two now look, to the compile script,
    just like any other usernames.
2010-11-06 21:03:34 +05:30
Sitaram Chamarty 4df32c3ff0 v1.5.7 2010-11-06 18:53:01 +05:30
Sitaram Chamarty a690058ce6 (test driver) editrc function buglet
Till now I did not have an RC var whose name was a prefix of another
valid RC var, so I never noticed that editrc would set the longer one
also when you set the shorter one.

Fixed
2010-11-06 12:35:46 +05:30