Commit graph

22 commits

Author SHA1 Message Date
Sitaram Chamarty 79647078a3 auth: regex goof on my part
for those not yet able to upgrade (or until I merge this into the branch
you care about), if you have a repo called, say "bk2git", just refer to
it as "bk2git.git" in the clone command!

[Thanks to Mark Frazer for finding this...]
2009-12-25 01:13:31 +05:30
Sitaram Chamarty b0ce84d47f document @SHELL feature, allow "info" for all,
...but still distinguish shell folks with a small extra line telling
them they have shell access
2009-12-23 19:57:36 +05:30
Sitaram Chamarty 75de6c0438 auth: (WDITOT?) allow special users to get a shell
".../gl-auth-command username" is the normal command that authkeys
forces, and this prevents that key from being used to get a shell.

We now allow the user to get a shell if the forced command has a "-s"
before the "username", like ".../gl-auth-command -s sitaram".

(Now that a plain "ssh gitolite" gets you a shell, there's a new "info"
command that such privileged keys can use to get basic access info).

Thanks to Jesse Keating for the idea!  I can't believe this never
occurred to me before, but I guess I was so enamoured of my "innovation"
in converting what used to be an error into some useful info I didn't
think a bit more :/
2009-12-19 22:47:11 +05:30
Sitaram Chamarty 512fc4a0a5 auth: set umask when autoviv-ing repos
Looks like I'd forgotten this when I did the autoviv code.  Repos
created via gl-compile (when you add a new repo to the config file and
push) worked fine, but repos created via gl-auth (when you autoviv a
repo, wild or not) did not.

This *should* be merged into wildrepos soon after testing; wildrepos
will have a lot more autoviv-ing than master.
2009-12-17 14:11:58 +05:30
Sitaram Chamarty b7404aa772 auth/install/pu-hook: pass ADMINDIR and BINDIR via ENV
The admin repo's post-update hook needs to know where $GL_ADMINDIR is,
and we had a weird way of doing that which depended on gl-install
actually munging the hook code.

We also always assumed the binaries are in GL_ADMINDIR/src.

We now use an env var to pass both these values.  This removes the weird
dependency on gl-install that the post-update hook had, as well as make
running other programs easier due to the new $GL_BINDIR env var.
2009-12-17 14:11:55 +05:30
Sitaram Chamarty e6da853082 auth, compile, pm: good bit of refactoring
all of this is prep for the upcoming, all-new, chrome-plated,
"wildrepos" branch :)

  - many variables go to gitolite.pm now, and are "our"d into the other
    files as needed
  - new functions parse_acl, report_basic to replace inlined code
2009-12-05 14:14:37 +05:30
Sitaram Chamarty b78a720cee auth/compile: auto-vivify is default now, so:
the "create a new repo" code moves from compile to auth.

Only someone who has W access can create it, but he can do so even on a
"R" operation (like clone or ls-remote).

This is a pre-requisite for rebel's wildcard repos, where
autovivification is the only way you can create arbitrary repos matching
a pattern.

The only reason it's getting into master is because it looks cool!

----

OK that's a lie; the real reason is to keep the two branches as similar
as possible, though they;ve diverged quite a bit since the "only
one-line difference" days where "rebel" just meant "deny/exclude"
rules!)
2009-11-27 23:06:48 +05:30
Sitaram Chamarty 9a85f5d0d6 auth: print permissions for @all also
I don't have a use for "@all" at all (pun not intended!) other than the
"testing" repo, but <teemu dot matilainen at iki dot fi> sent in a patch
to mark those repos with "R" and "W" in the permissions list, and I
started thinking about it.

This could actually be useful if we *differentiated* such access from
normal (explicit username) access.  From the "corporate environment"
angle, it would be nice if a project manager could quickly check if any
of his projects have erroneously been made accessible by @all.

So what we do now is print "@" in the corresponding column if "@all" has
the corresponding access.

Also, when someone has access both as himself *and* via @all, we print
the "@"; printing the "R" or "W" would hide the "@", and wouldn't
correctly satisfy the use case described above.
2009-11-25 09:15:36 +05:30
Sitaram Chamarty de2e38c372 minor doc/message updates/clarifications 2009-11-24 09:16:29 +05:30
Sitaram Chamarty 648dce20ec auth: make ".git" at the end optional 2009-10-30 10:37:02 +05:30
Sitaram Chamarty a19a7f01d7 auth, doc/3: print useful information when no command given 2009-10-28 21:46:57 +05:30
Sitaram Chamarty 78d02e1437 the rc file can now be in one of 2 places...
Packaging gitolite for debian requires the rc file to be in /etc/gitolite.
But non-root installs must still be supported, and they need it in $HOME.

This means the rc file is no longer in a fixed place, which needs code to find
the rc file first.  See comments inside new file 'gitolite.pm' for details.

The rest of the changes are in the other programs, to replace the hard-coded
rc filename with a call to this new code.
2009-10-25 12:45:45 +05:30
Sitaram Chamarty 59e15e62a1 support git installed outside default $PATH
(also some minor fixes to doc/3)
2009-10-13 10:03:12 +05:30
Sitaram Chamarty 1b9969f3d6 auth: better message, remove unsightly perl warning on bad command 2009-09-27 23:52:04 +05:30
Sitaram Chamarty c66e1ad732 compile: pubkey related linting added
- warn about files in keydir/ that dont end with ".pub"
  - warn about pubkey files for which the user is not mentioned in config
  - warn more sternly about the opposite (user in config, no pubkey!)

update hook: add reponame to message on deny
auth: minor typo
2009-09-27 09:51:00 +05:30
Sitaram Chamarty 694050d6c4 all src: suffixed a \n to all die's; error output looks cleaner now 2009-09-10 21:35:49 +05:30
Sitaram Chamarty 3d44b003c8 clarifications in various messages etc
(thanks to SethX for feedback)

  - install: a little more verbosity in the mkdir
  - install and example conf: some of the help text made more clear
  - auth: error message on bad $cmd is now clearer, plus no perl-warnings to
    confuse people
2009-09-10 21:26:25 +05:30
Sitaram Chamarty 804c70f570 almost all src/conf: logging totally redone, upgrade doc added
- logs go into $GL_ADMINDIR/logs by default, named by year-month
  - logfile name template (including dir prefix) now in $GL_LOGT
  - two new env vars passed down: GL_TS and GL_LOG (timestamp, logfilename)
  - log messages timestamps more compact, fields tab-delimited
  - old and new SHAs cut to 14 characters
2009-09-06 18:07:38 +05:30
Sitaram Chamarty 5d4d5184b4 sources: 1-line all the "do"s for brevity and clarity
and yes, brevity and clarity "do" go together in perl :)
2009-09-01 19:36:00 +05:30
Sitaram Chamarty 62d89bf8f8 gl-auth: R_COMMANDS adds "git-upload-archive" 2009-08-31 21:08:21 +05:30
Sitaram Chamarty e55fc3b7f3 minor: remove needless "our"s 2009-08-30 13:28:12 +05:30
Sitaram Chamarty f0099a125e reduce clutter by making src, doc, conf subdirectories 2009-08-27 14:00:00 +05:30
Renamed from gl-auth-command (Browse further)