[ { "path": "CHANGELOG", "content": "2025-07-18 v3.6.14 only one important fix:\n\n detect HEAD name in admin repo (don't require it be \"master\")\n\n2023-07-14 v3.6.13 only one important fix:\n\n remove the \"description\" file on new repos, to fix a bug\n created by an optimisation made 6 years ago in 3.6.8 (and\n was caught only in 2022 or so!)\n\n2020-08-04 v3.6.12 mirroring terminology changes\n\n install script can now modify #! lines when using a custom\n perl executable\n\n 'config' user command allows for config values with spaces\n in them\n\n finally added notes in \"t/README\" on testing http mode and\n mirroring, with pre-build helpers for Fedora and Manjaro\n\n ...plus various bug fixes\n\n2019-01-08 v3.6.11 fix security issue in 'rsync' (bundle helper); see commit\n 5df2b81 for more\n\n2018-09-30 v3.6.10 fix up boo-boo caused by previous release; see mails on\n list for details\n\n2018-08-07 v3.6.9 prevent racy access to repos in process of migration to\n gitolite\n\n 'info' learns new '-p' option to show only physical repos\n (as opposed to wild repos)\n\n2018-07-12 v3.6.8 fix bug when deleting *all* hooks for a repo\n\n allow trailing slashes in repo names\n\n make pre-receive hook driver bail on non-zero exit of a\n pre-receive hook\n\n allow templates in gitolite.conf (new feature)\n\n various optimiations\n\n2017-07-02 v3.6.7 allow repo-specific hooks to be organised into\n subdirectories, and allow the multi-hook driver to be\n placed in some other location of your choice\n\n allow simple test code to be embedded within the\n gitolite.conf file; see contrib/utils/testconf for how.\n (This goes on the client side, not on the server)\n\n allow syslog \"facility\" to be changed, from the default of\n 'local0'\n\n allow @group names in config values to be expanded; it is\n replaced with a space separated list of members\n\n2016-09-08 v3.6.6 simple but important fix for a future perl deprecation\n (perl will be removing \".\" from @INC in 5.24)\n\n 'perms' now requires a '-c' to activate batch mode\n (should not affect interactive use but check your scripts\n perhaps?)\n\n gitolite setup now accepts a '-m' option to supply a\n custom message (useful when it is used by a script)\n\n2016-02-20 v3.6.5 allow creator check to be bypassed during mirroring\n\n handle new style ssh fingerprinting correctly (thanks to\n Robin Johnson)\n\n allow pre-auto-gc as a repo-specific hook\n\n optimise mirror pushes for heavily used repos\n\n create-with-reference trigger: on repo creation, setup\n objects/info/alternates for a server side alternate object\n store.\n\n 'mirror status all all' prints a list of repos that have\n *some* error, which is arguably more useful for further\n action/processing\n\n allow incrementally adding more repo-specific hooks\n\n2015-11-01 v3.6.4 a ref-create bug in wild repos was fixed\n\n some contrib code related to AD integration, and to\n redmine user aliases\n\n teach Alias.pm a few new tricks\n\n remove a race condition in 'create' command that affected\n the 'default roles' setting\n\n make 'who-pushed' more efficient (local push logs, and\n 'tip search')\n\n 'gitolite query-rc' learns '-d' ('--dump') option\n\n2015-04-26 v3.6.3 allow limited use of 'git config' using the new 'config'\n command\n\n accept openssh 6.8's new fingerprint output format\n\n (finally!) allow limited symlinks within ~/repositories;\n see commit 8e36230 for details\n\n perms command now lists available roles\n\n minor backward compat breakage: 'perms -l repo' no longer\n works; see 'perms -h' for new usage\n\n allow gitolite-shell to be used as $SHELL (experts only;\n no support, no docs; see commit 9cd1e37 for details)\n\n help with 'git push --signed' using a post-receive hook to\n adopt push certs into 'refs/push-certs'; for details see\n contrib/hooks/repo-specific/save-push-signatures\n\n new 'transparent proxy' feature for git repos; see\n src/lib/Gitolite/Triggers/TProxy.pm for details\n\n2014-11-10 v3.6.2 disable ../ everywhere (see mailing list thread for\n details)\n\n VREF/NAME_NC -- like VREF/NAME but for new commits only.\n Details within src/VREF/NAME_NC.\n\n allow gitolite.conf to be tested locally; details within\n contrib/utils/gitolite-local\n\n2014-06-22 v3.6.1 experimental rc format convertor for \"<= 3.3\" users who\n have already upgraded the *code* to \">= v3.4\". Program is\n in contrib/utils.\n\n giving shell access to a few users got a lot easier (see\n comments in the rc file).\n\n allow logging to syslog as well (see comments in the rc\n file)\n\n new 'motd' command\n\n redis caching redone and now in core; see\n http://gitolite.com/gitolite/cache.html\n\n2014-05-09 v3.6 (cool stuff) the access command can now help you debug\n your rules / understand how a specific access decision was\n arrived at.\n\n mirroring: since mirroring is asynchronous (by default\n anyway), when a 'git push --mirror' fails, you may not\n know it unless you look in the log file on the server.\n Now gitolite captures the info and -- if the word 'fatal'\n appears anywhere within it, it saves the entire output and\n prints it to STDERR for anyone who reads or writes the\n repo on the *master* server, until the error condition\n clears up.\n\n mirroring: allow 'nosync' slaves -- no attempt to\n automatically push to these slaves will be made. Instead,\n you have to manually (or via cron, etc) trigger pushes.\n\n (backward compat breakage) the old v2 syntax for\n specifying gitweb owner and description is no longer\n supported.\n\n macros now allow strings as arguments (thanks to Jason\n Donenfeld for the idea/problem).\n\n the 'info' command can print in JSON format if asked to.\n\n repo-specific hooks: now you can specify more than one,\n and gitolite runs all of them in sequence.\n\n new trigger 'expand-deny-messages' to show more details\n when access is denied.\n\n git-annex support is finally in master, yaaay!\n\n new 'readme' command, modelled after 'desc'. Apparently\n gitweb can use a README.html file in the *bare* repo\n directory -- who knew!\n\n2013-10-14 v3.5.3 catch undefined groupnames (when possible)\n\n mirroring: async push to slaves\n\n (some portability fixes)\n\n (a couple of contrib scripts - querying IPA based LDAP\n servers for group membership, and user key management)\n\n allow groups in subconf files (this *may* slow down\n compilation in extreme cases)\n\n make adding repo-specific hooks easier (see cust.mkd or\n cust.html online for docs)\n\n smart http now supports git 1.8.2 and above (which changed\n the protocol requirements a wee bit)\n\n2013-07-10 v3.5.2 allow ENV vars to be set from repo options, for use in\n triggers and hooks\n\n bug-fix: the new set-default-roles feature was being\n invoked on every run of \"perms\" and overriding it!\n\n2013-03-24 v3.5 (2 minor backward compat breakages)\n 1. 'DEFAULT_ROLE_PERMS' replaced by per repo\n 'default.roles' option\n 2. 'gitolite list-memberships' now requires a '-r' or a\n '-u' flag\n\n new 'gitolite owns' command (thanks to Kevin Pulo)\n\n2013-03-05 v3.4 new rc file format makes it much easier to enable specific\n features\n\n2012-12-29 v3.3 bug fix: gl-perms propagation to slaves broke sometime\n after v3.2 (so if you're only picking up tagged releases\n you're OK)\n\n the \"D\" command now allows rm/unlock to be totally\n disabled\n\n new trigger: update-gitweb-daemon-from-options; another\n way to update gitweb and daemon access lists\n\n new 'create' command for explicit wild repo creation, and\n new AutoCreate trigger to control auto-creation\n\n allow simple macros in conf file\n\n2012-11-14 v3.2 major efficiency boost for large setups\n\n optional support for multi-line pubkeys; see\n src/triggers/post-compile/ssh-authkeys-split\n\n bug fix for not creating gl-conf when repo para has only\n config lines and no access rules\n\n new 'bg' trigger command to put long jobs started from a\n trigger into background\n\n %GL_REPO and %GL_CREATOR now work for 'option's also\n\n test suite now much more BSD friendly\n\n2012-10-05 v3.1 (security) fix path traversal on wild repos\n\n new %GL_CREATOR variable for git-config lines\n\n rsync command to create and send bundles automagically\n\n migrated 'who-pushed'\n\n logical expressions on refexes!!!\n\n2012-06-27 v3.04 documentation graduated and moved out of parents house :)\n\n new trigger for 'repo specific umask'\n\n new 'list-dangling-repos' command\n\n new LOCAL_CODE rc var; allow admin specified programs to\n override system-installed ones\n\n new 'upstream' trigger-cum-command to maintain local\n copies of external repos\n\n new 'sudo' command\n\n minor backward compat breakage in 'gitolite query-rc'\n\n 'perms' command can now create repo if needed\n\n migrated 'symbolic-ref' command\n\n 'gitolite setup --hooks-only'\n\n2012-05-23 v3.03 fix major bug that allowed an admin to get a shell\n\n2012-05-20 v3.02 packaging instructions fixed up and smoke tested\n\n make it easier to give some users a full shell\n\n allow aliasing a repo to another name\n\n simulate POST_CREATE for new normal (non-wild) repos\n\n (just for kicks) a VREF that allows for voting on changes\n to a branch\n\n bug fix: smart http was not running PRE_ and POST_GIT\n triggers\n\n htpasswd migrated\n\n2012-04-29 v3.01 mostly BSD and Solaris compat\n also fork command added\n\n2012-04-18 v3.0 first release to \"master\"\n This is a compete rewrite of gitolite; please see\n documentation before upgrading.\n" }, { "path": "CONTRIBUTING", "content": "Go to http://gitolite.com/gitolite/index.html#contactsupport for information on\ncontacting me, the mailing list, and IRC channel. *Unless you are reporting\nwhat you think is a security issue, I prefer you send to the mailing list,\nnot to me directly.*\n\nPlease DO NOT send messages via github's \"issues\" system, linkedin\ncomments/discussion, stackoverflow questions, google+, and any other Web 3.0\n\"coolness\". (The issues system does have an email interface, but it is not a\nsubstitute for email. I can't cc anyone else when I want to, for instance.\nWell I can, but any response the original requester then makes using the\nwebsite will not get cc-d to the person I cc-d).\n\nPlease send patches *via email*, not as github pull requests. Again, if you\nthink it's a security issue, send it directly to my gmail address, but\notherwise please send it to the mailing list, so others can see it and comment\non it.\n\nThe preferred format is the files created by git-format-patch, as attachments.\nHowever, if your repo has a public clone URL, you can make a new branch just\nfor this fix, and send the repo URL and branch name to the mailing list.\n\n(If you do send me a github pull request, I may take it if it's a trivial\npatch, but otherwise I'll ask you to close the pull request, then read\nthis URL for how to send me the patch.)\n" }, { "path": "COPYING", "content": " GNU GENERAL PUBLIC LICENSE\n Version 2, June 1991\n\n Copyright (C) 1989, 1991 Free Software Foundation, Inc.,\n 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA\n Everyone is permitted to copy and distribute verbatim copies\n of this license document, but changing it is not allowed.\n\n Preamble\n\n The licenses for most software are designed to take away your\nfreedom to share and change it. By contrast, the GNU General Public\nLicense is intended to guarantee your freedom to share and change free\nsoftware--to make sure the software is free for all its users. This\nGeneral Public License applies to most of the Free Software\nFoundation's software and to any other program whose authors commit to\nusing it. (Some other Free Software Foundation software is covered by\nthe GNU Lesser General Public License instead.) You can apply it to\nyour programs, too.\n\n When we speak of free software, we are referring to freedom, not\nprice. Our General Public Licenses are designed to make sure that you\nhave the freedom to distribute copies of free software (and charge for\nthis service if you wish), that you receive source code or can get it\nif you want it, that you can change the software or use pieces of it\nin new free programs; and that you know you can do these things.\n\n To protect your rights, we need to make restrictions that forbid\nanyone to deny you these rights or to ask you to surrender the rights.\nThese restrictions translate to certain responsibilities for you if you\ndistribute copies of the software, or if you modify it.\n\n For example, if you distribute copies of such a program, whether\ngratis or for a fee, you must give the recipients all the rights that\nyou have. You must make sure that they, too, receive or can get the\nsource code. And you must show them these terms so they know their\nrights.\n\n We protect your rights with two steps: (1) copyright the software, and\n(2) offer you this license which gives you legal permission to copy,\ndistribute and/or modify the software.\n\n Also, for each author's protection and ours, we want to make certain\nthat everyone understands that there is no warranty for this free\nsoftware. If the software is modified by someone else and passed on, we\nwant its recipients to know that what they have is not the original, so\nthat any problems introduced by others will not reflect on the original\nauthors' reputations.\n\n Finally, any free program is threatened constantly by software\npatents. We wish to avoid the danger that redistributors of a free\nprogram will individually obtain patent licenses, in effect making the\nprogram proprietary. To prevent this, we have made it clear that any\npatent must be licensed for everyone's free use or not licensed at all.\n\n The precise terms and conditions for copying, distribution and\nmodification follow.\n\n GNU GENERAL PUBLIC LICENSE\n TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION\n\n 0. This License applies to any program or other work which contains\na notice placed by the copyright holder saying it may be distributed\nunder the terms of this General Public License. The \"Program\", below,\nrefers to any such program or work, and a \"work based on the Program\"\nmeans either the Program or any derivative work under copyright law:\nthat is to say, a work containing the Program or a portion of it,\neither verbatim or with modifications and/or translated into another\nlanguage. (Hereinafter, translation is included without limitation in\nthe term \"modification\".) Each licensee is addressed as \"you\".\n\nActivities other than copying, distribution and modification are not\ncovered by this License; they are outside its scope. The act of\nrunning the Program is not restricted, and the output from the Program\nis covered only if its contents constitute a work based on the\nProgram (independent of having been made by running the Program).\nWhether that is true depends on what the Program does.\n\n 1. You may copy and distribute verbatim copies of the Program's\nsource code as you receive it, in any medium, provided that you\nconspicuously and appropriately publish on each copy an appropriate\ncopyright notice and disclaimer of warranty; keep intact all the\nnotices that refer to this License and to the absence of any warranty;\nand give any other recipients of the Program a copy of this License\nalong with the Program.\n\nYou may charge a fee for the physical act of transferring a copy, and\nyou may at your option offer warranty protection in exchange for a fee.\n\n 2. You may modify your copy or copies of the Program or any portion\nof it, thus forming a work based on the Program, and copy and\ndistribute such modifications or work under the terms of Section 1\nabove, provided that you also meet all of these conditions:\n\n a) You must cause the modified files to carry prominent notices\n stating that you changed the files and the date of any change.\n\n b) You must cause any work that you distribute or publish, that in\n whole or in part contains or is derived from the Program or any\n part thereof, to be licensed as a whole at no charge to all third\n parties under the terms of this License.\n\n c) If the modified program normally reads commands interactively\n when run, you must cause it, when started running for such\n interactive use in the most ordinary way, to print or display an\n announcement including an appropriate copyright notice and a\n notice that there is no warranty (or else, saying that you provide\n a warranty) and that users may redistribute the program under\n these conditions, and telling the user how to view a copy of this\n License. (Exception: if the Program itself is interactive but\n does not normally print such an announcement, your work based on\n the Program is not required to print an announcement.)\n\nThese requirements apply to the modified work as a whole. If\nidentifiable sections of that work are not derived from the Program,\nand can be reasonably considered independent and separate works in\nthemselves, then this License, and its terms, do not apply to those\nsections when you distribute them as separate works. But when you\ndistribute the same sections as part of a whole which is a work based\non the Program, the distribution of the whole must be on the terms of\nthis License, whose permissions for other licensees extend to the\nentire whole, and thus to each and every part regardless of who wrote it.\n\nThus, it is not the intent of this section to claim rights or contest\nyour rights to work written entirely by you; rather, the intent is to\nexercise the right to control the distribution of derivative or\ncollective works based on the Program.\n\nIn addition, mere aggregation of another work not based on the Program\nwith the Program (or with a work based on the Program) on a volume of\na storage or distribution medium does not bring the other work under\nthe scope of this License.\n\n 3. You may copy and distribute the Program (or a work based on it,\nunder Section 2) in object code or executable form under the terms of\nSections 1 and 2 above provided that you also do one of the following:\n\n a) Accompany it with the complete corresponding machine-readable\n source code, which must be distributed under the terms of Sections\n 1 and 2 above on a medium customarily used for software interchange; or,\n\n b) Accompany it with a written offer, valid for at least three\n years, to give any third party, for a charge no more than your\n cost of physically performing source distribution, a complete\n machine-readable copy of the corresponding source code, to be\n distributed under the terms of Sections 1 and 2 above on a medium\n customarily used for software interchange; or,\n\n c) Accompany it with the information you received as to the offer\n to distribute corresponding source code. (This alternative is\n allowed only for noncommercial distribution and only if you\n received the program in object code or executable form with such\n an offer, in accord with Subsection b above.)\n\nThe source code for a work means the preferred form of the work for\nmaking modifications to it. For an executable work, complete source\ncode means all the source code for all modules it contains, plus any\nassociated interface definition files, plus the scripts used to\ncontrol compilation and installation of the executable. However, as a\nspecial exception, the source code distributed need not include\nanything that is normally distributed (in either source or binary\nform) with the major components (compiler, kernel, and so on) of the\noperating system on which the executable runs, unless that component\nitself accompanies the executable.\n\nIf distribution of executable or object code is made by offering\naccess to copy from a designated place, then offering equivalent\naccess to copy the source code from the same place counts as\ndistribution of the source code, even though third parties are not\ncompelled to copy the source along with the object code.\n\n 4. You may not copy, modify, sublicense, or distribute the Program\nexcept as expressly provided under this License. Any attempt\notherwise to copy, modify, sublicense or distribute the Program is\nvoid, and will automatically terminate your rights under this License.\nHowever, parties who have received copies, or rights, from you under\nthis License will not have their licenses terminated so long as such\nparties remain in full compliance.\n\n 5. You are not required to accept this License, since you have not\nsigned it. However, nothing else grants you permission to modify or\ndistribute the Program or its derivative works. These actions are\nprohibited by law if you do not accept this License. Therefore, by\nmodifying or distributing the Program (or any work based on the\nProgram), you indicate your acceptance of this License to do so, and\nall its terms and conditions for copying, distributing or modifying\nthe Program or works based on it.\n\n 6. Each time you redistribute the Program (or any work based on the\nProgram), the recipient automatically receives a license from the\noriginal licensor to copy, distribute or modify the Program subject to\nthese terms and conditions. You may not impose any further\nrestrictions on the recipients' exercise of the rights granted herein.\nYou are not responsible for enforcing compliance by third parties to\nthis License.\n\n 7. If, as a consequence of a court judgment or allegation of patent\ninfringement or for any other reason (not limited to patent issues),\nconditions are imposed on you (whether by court order, agreement or\notherwise) that contradict the conditions of this License, they do not\nexcuse you from the conditions of this License. If you cannot\ndistribute so as to satisfy simultaneously your obligations under this\nLicense and any other pertinent obligations, then as a consequence you\nmay not distribute the Program at all. For example, if a patent\nlicense would not permit royalty-free redistribution of the Program by\nall those who receive copies directly or indirectly through you, then\nthe only way you could satisfy both it and this License would be to\nrefrain entirely from distribution of the Program.\n\nIf any portion of this section is held invalid or unenforceable under\nany particular circumstance, the balance of the section is intended to\napply and the section as a whole is intended to apply in other\ncircumstances.\n\nIt is not the purpose of this section to induce you to infringe any\npatents or other property right claims or to contest validity of any\nsuch claims; this section has the sole purpose of protecting the\nintegrity of the free software distribution system, which is\nimplemented by public license practices. Many people have made\ngenerous contributions to the wide range of software distributed\nthrough that system in reliance on consistent application of that\nsystem; it is up to the author/donor to decide if he or she is willing\nto distribute software through any other system and a licensee cannot\nimpose that choice.\n\nThis section is intended to make thoroughly clear what is believed to\nbe a consequence of the rest of this License.\n\n 8. If the distribution and/or use of the Program is restricted in\ncertain countries either by patents or by copyrighted interfaces, the\noriginal copyright holder who places the Program under this License\nmay add an explicit geographical distribution limitation excluding\nthose countries, so that distribution is permitted only in or among\ncountries not thus excluded. In such case, this License incorporates\nthe limitation as if written in the body of this License.\n\n 9. The Free Software Foundation may publish revised and/or new versions\nof the General Public License from time to time. Such new versions will\nbe similar in spirit to the present version, but may differ in detail to\naddress new problems or concerns.\n\nEach version is given a distinguishing version number. If the Program\nspecifies a version number of this License which applies to it and \"any\nlater version\", you have the option of following the terms and conditions\neither of that version or of any later version published by the Free\nSoftware Foundation. If the Program does not specify a version number of\nthis License, you may choose any version ever published by the Free Software\nFoundation.\n\n 10. If you wish to incorporate parts of the Program into other free\nprograms whose distribution conditions are different, write to the author\nto ask for permission. For software which is copyrighted by the Free\nSoftware Foundation, write to the Free Software Foundation; we sometimes\nmake exceptions for this. Our decision will be guided by the two goals\nof preserving the free status of all derivatives of our free software and\nof promoting the sharing and reuse of software generally.\n\n NO WARRANTY\n\n 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY\nFOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN\nOTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES\nPROVIDE THE PROGRAM \"AS IS\" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED\nOR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF\nMERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS\nTO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE\nPROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,\nREPAIR OR CORRECTION.\n\n 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING\nWILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR\nREDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,\nINCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING\nOUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED\nTO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY\nYOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER\nPROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE\nPOSSIBILITY OF SUCH DAMAGES.\n" }, { "path": "README.markdown", "content": "Gitolite README\n===============\n\n## about this README\n\n**(Github-users: click the \"wiki\" link before sending me anything via github.)**\n\n**This is a minimal README for gitolite**, so you can quickly get started with:\n\n* installing gitolite on a fresh userid on a Unix(-like) machine, using ssh\n* learning enough to do some basic access control\n\n**For anything more, you need to look at the complete documentation, at:\n**. Please go there for what/why/how, concepts,\nbackground, troubleshooting, more details on what is covered here, advanced\nfeatures not covered here, migration from older gitolite, running gitolite\nover http (rather than ssh), and many more topics.\n\n\n\n## Assumptions\n\n* You are familiar with:\n * OS: at least one Unix-like OS\n * ssh: ssh, ssh keys, ssh authorized keys file\n * git: basic use of git, bare and non-bare remotes\n\n* You are setting up a fresh, ssh-based, installation of gitolite on a Unix\n machine of some sort.\n\n* You have root access, or someone has created a userid called \"git\" for you\n to use and given you a password for it. This is a brand new userid (or\n you have deleted everything but `.bashrc` and similar files to make it\n look like one!)\n\n* If your server is not connected to the internet, you know how to clone the\n gitolite source code by using some in-between server or \"git bundle\".\n\n\n\n## Installation and setup\n\n### server requirements\n\n* any unix system\n* sh\n* git 1.6.6 or later\n* perl 5.8.8 or later\n* openssh 5.0 or later\n* a dedicated userid to host the repos (in this document, we assume it is\n \"git\", but it can be anything; substitute accordingly)\n* this user id does NOT currently have any ssh pubkey-based access\n * ideally, this user id has shell access ONLY by \"su - git\" from some\n other userid on the same server (this ensure minimal confusion for ssh\n newbies!)\n\n### steps to install\n\nFirst, prepare the ssh key:\n\n* login to \"git\" on the server\n* make sure `~/.ssh/authorized_keys` is empty or non-existent\n* make sure your ssh public key from your workstation has been copied as\n $HOME/YourName.pub\n\nNext, install gitolite by running these commands:\n\n git clone https://github.com/sitaramc/gitolite\n mkdir -p $HOME/bin\n gitolite/install -to $HOME/bin\n\nFinally, setup gitolite with yourself as the administrator:\n\n gitolite setup -pk YourName.pub\n\nIf the last command doesn't run perhaps \"bin\" is not in your \"PATH\". You can\neither add it, or just run:\n\n $HOME/bin/gitolite setup -pk YourName.pub\n\nIf you get any other errors please refer to the online documentation whose URL\nwas given at the top of this file.\n\n## adding users and repos\n\n*Do NOT add new repos or users manually on the server.* Gitolite users,\nrepos, and access rules are maintained by making changes to a special repo\ncalled \"gitolite-admin\" and *pushing* those changes to the server.\n\nTo administer your gitolite installation, start by doing this on your\nworkstation (if you have not already done so):\n\n git clone git@host:gitolite-admin\n\n> -------------------------------------------------------------------------\n\n> **NOTE: if you are asked for a password, something went wrong.**. Go hit\n> the link for the complete documentation earlier in this file.\n\n> -------------------------------------------------------------------------\n\nNow if you \"cd gitolite-admin\", you will see two subdirectories in it: \"conf\"\nand \"keydir\".\n\nTo add new users alice, bob, and carol, obtain their public keys and add them\nto \"keydir\" as alice.pub, bob.pub, and carol.pub respectively.\n\nTo add a new repo \"foo\" and give different levels of access to these\nusers, edit the file \"conf/gitolite.conf\" and add lines like this:\n\n repo foo\n RW+ = alice\n RW = bob\n R = carol\n\nOnce you have made these changes, do something like this:\n\n git add conf\n git add keydir\n git commit -m \"added foo, gave access to alice, bob, carol\"\n git push\n\nWhen the push completes, gitolite will add the new users to\n`~/.ssh/authorized_keys` on the server, as well as create a new, empty, repo\ncalled \"foo\".\n\n## help for your users\n\nOnce a user has sent you their public key and you have added them as\nspecified above and given them access, you have to tell them what URL to\naccess their repos at. This is usually \"git clone git@host:reponame\"; see\nman git-clone for other forms.\n\n**NOTE**: again, if they are asked for a password, something is wrong.\n\nIf they need to know what repos they have access to, they just have to run\n\"ssh git@host info\".\n\n## access rule examples\n\nGitolite's access rules are very powerful. The simplest use was already\nshown above. Here is a slightly more detailed example:\n\n repo foo\n RW+ = alice\n - master = bob\n - refs/tags/v[0-9] = bob\n RW = bob\n RW refs/tags/v[0-9] = carol\n R = dave\n\nHere's what these example rules say:\n\n * alice can do anything to any branch or tag -- create, push,\n delete, rewind/overwrite etc.\n\n * bob can create or fast-forward push any branch whose name does\n not start with \"master\" and create any tag whose name does not\n start with \"v\"+digit.\n\n * carol can create tags whose names start with \"v\"+digit.\n\n * dave can clone/fetch.\n\nPlease see the main documentation linked above for all the gory details, as\nwell as more features and examples.\n\n## groups\n\nGitolite allows you to group users or repos for convenience. Here's an\nexample that creates two groups of users:\n\n @staff = alice bob carol\n @interns = ashok\n\n repo secret\n RW = @staff\n\n repo foss\n RW+ = @staff\n RW = @interns\n\nGroup lists accumulate. The following two lines have the same effect as\nthe earlier definition of @staff above:\n\n @staff = alice bob\n @staff = carol\n\nYou can also use group names in other group names:\n\n @all-devs = @staff @interns\n\nFinally, @all is a special group name that is often convenient to use if\nyou really mean \"all repos\" or \"all users\".\n\n## commands\n\nUsers can run certain commands remotely, using ssh. Running\n\n ssh git@host help\n\nprints a list of available commands.\n\nThe most commonly used command is \"info\". All commands respond to a\nsingle argument of \"-h\" with suitable information.\n\nIf you have shell on the server, you have a lot more commands available to\nyou; try running \"gitolite help\".\n\n\n\n## LICENSE\n\n# contact and support\n\nPlease see for mailing list and IRC\ninfo.\n\n# license\n\nThe gitolite software is copyright Sitaram Chamarty and is licensed under the\nGPL v2; please see the file called COPYING in the source distribution.\n\nPlease see for more.\n\n> -------------------------------------------------------------------------\n\n> **NOTE**: GIT is a trademark of Software Freedom Conservancy and my use of\n> \"Gitolite\" is under license.\n\n> -------------------------------------------------------------------------\n" }, { "path": "check-g2-compat", "content": "#!/usr/bin/perl\n\nuse Cwd;\n\nmy $h = $ENV{HOME};\nmy $rc = \"$h/.gitolite.rc\";\nmy %count;\n\nintro();\n\nmsg( FATAL => \"no rc file found; do you even *have* g2 running?\" ) if not -f $rc;\ndo $rc;\nunless ( $return = do $rc ) {\n msg( FATAL => \"couldn't parse $rc: $@\" ) if $@;\n msg( FATAL => \"couldn't do $rc: $!\" ) unless defined $return;\n msg( WARNING => \"couldn't run $rc\" ) unless $return;\n}\n\nprint \"checking rc file...\\n\";\nrc_basic();\nrest_of_rc();\nprint \"\\n\";\n\nprint \"checking conf file(s)...\\n\";\nconf();\nprint \"\\n\";\n\nprint \"checking repos...\\n\";\nrepo();\nprint \"\\n\";\n\nprint \"...all done...\\n\";\n\n# ----------------------------------------------------------------------\n\nsub intro {\n msg( INFO => \"This program only checks for uses that make the new g3 completely unusable\" );\n msg( '' => \"or that might end up giving *more* access to someone if migrated as-is.\" );\n msg( '' => \"It does NOT attempt to catch all the differences described in the docs.\" );\n msg( '', '' );\n msg( INFO => \"'see docs' usually means the pre-migration checklist in\" );\n msg( '', => \"'g2migr.html'; to get there, start from the main migration\" );\n msg( '', => \"page at http://gitolite.com/gitolite/migr.html\" );\n msg( '', '' );\n}\n\nsub rc_basic {\n msg( FATAL => \"GL_ADMINDIR in the wrong place -- aborting; see docs\" ) if $GL_ADMINDIR ne \"$h/.gitolite\";\n msg( NOTE => \"GL_ADMINDIR is in the right place; assuming you did not mess with\" );\n msg( '', \"GL_CONF, GL_LOGT, GL_KEYDIR, and GL_CONF_COMPILED\" );\n msg( FATAL => \"REPO_BASE in the wrong place -- aborting; see docs\" ) if $REPO_BASE ne \"$h/repositories\" and $REPO_BASE ne \"repositories\";\n# ( abs or rel both ok)\n}\n\nsub rest_of_rc {\n msg( SEVERE => \"GIT_PATH found; see docs\" ) if $GIT_PATH;\n msg( SEVERE => \"GL_ALL_INCLUDES_SPECIAL found; see docs\" ) if $GL_ALL_INCLUDES_SPECIAL;\n msg( SEVERE => \"GL_NO_CREATE_REPOS not yet implemented\" ) if $GL_NO_CREATE_REPOS;\n msg( SEVERE => \"rsync not yet implemented\" ) if $RSYNC_BASE;\n msg( WARNING => \"ADMIN_POST_UPDATE_CHAINS_TO found; see docs\" ) if $ADMIN_POST_UPDATE_CHAINS_TO;\n msg( WARNING => \"GL_NO_DAEMON_NO_GITWEB found; see docs\" ) if $GL_NO_DAEMON_NO_GITWEB;\n msg( WARNING => \"GL_NO_SETUP_AUTHKEYS found; see docs\" ) if $GL_NO_SETUP_AUTHKEYS;\n msg( WARNING => \"UPDATE_CHAINS_TO found; see docs\" ) if $UPDATE_CHAINS_TO;\n msg( WARNING => \"GL_ADC_PATH found; see docs\" ) if $GL_ADC_PATH;\n msg( WARNING => \"non-default GL_WILDREPOS_PERM_CATS found\" ) if $GL_WILDREPOS_PERM_CATS ne 'READERS WRITERS';\n}\n\nsub conf {\n chdir($h);\n chdir($GL_ADMINDIR);\n\n my $conf = `find . -name \"*.conf\" | xargs cat`;\n msg( \"SEVERE\", \"NAME rules; see docs\" ) if $conf =~ m(NAME/);\n msg( \"SEVERE\", \"subconf command in admin repo; see docs\" ) if $conf =~ m(NAME/conf/fragments);\n msg( \"SEVERE\", \"mirroring used; see docs\" ) if $conf =~ m(config +gitolite\\.mirror\\.);\n}\n\nsub repo {\n chdir($h);\n chdir($REPO_BASE);\n my @creater = `find . -name gl-creater`;\n if (@creater) {\n msg( WARNING => \"found \" . scalar(@creater) . \" gl-creater files; see docs\" );\n }\n\n my @perms = `find . -name gl-perms | xargs egrep -l -w R\\\\|RW`;\n if (@perms) {\n msg( WARNING => \"found \" . scalar(@perms) . \" gl-perms files with R or RW; see docs\" );\n }\n}\n\nsub msg {\n my ( $type, $text ) = @_;\n print \"$type\" if $type;\n print \"\\t$text\\n\";\n exit 1 if $type eq 'FATAL';\n\n $count{$type}++ if $type;\n}\n" }, { "path": "contrib/commands/compile-1", "content": "#!/usr/bin/perl -s\nuse strict;\nuse warnings;\n\n# DESCRIPTION:\n\n# This program is meant to re-compile the access rules (and 'config' or\n# 'option' lines) of exactly ONE actual repo (i.e., not a repo group or a\n# repo pattern).\n\n# MOTIVATION:\n\n# Fedora has a huge number of repos, as well as lot of churn in permissions.\n# The combination of having a large conf *and* frequent compiles were not\n# working out, hence this solution. Not sure if any others have such a\n# situation, so it's a standalone program, separate from \"core\" gitolite,\n# shipped in \"contrib\" instead of \"src\".\n\n# SETUP:\n\n# It expects to run as a gitolite sub-command, which means you will need to\n# copy it from contrib to src/commands, or the equivalent location inside\n# LOCAL_CODE; see non-core.html in the docs for details.\n\n# INVOCATION:\n\n# It takes one argument: the name of a file that contains the new ruleset\n# you want to use. (This cannot be STDIN or \"-\" or something).\n\n# example:\n#\n# gitolite compile-1 \n\n# WARNING:\n\n# If the main gitolite.conf changes significantly (specifically, if the\n# number of effective rules in it increase quite a bit), you may have to run\n# this command on ALL repos to update their individual gl-conf files.\n#\n# (TBD: explain this in more concrete terms)\n\n# ----------------------------------------------------------------------\n# THERE IS NO ERROR CHECKING ON THE WARNING ABOVE, NOR ON THE ASSUMPTIONS AND\n# REQUIREMENTS BELOW. PLEASE USE CAREFULLY!\n# ----------------------------------------------------------------------\n\n# ASSUMPTIONS/REQUIREMENTS:\n\n# The file given must contain exactly one 'repo' line, with exactly one repo\n# name, followed by the rules, configs, and options for that repo in the\n# normal gitolite.conf syntax.\n\n# The file must not have any group definitions, though it may use group\n# definitions already setup in the main gitolite.conf file.\n\n# Rules for this repo need not be already defined in the main gitolite.conf.\n# If they are, they will cease to have any effect once you run this command\n# - only the rules you supply in the file passed to this command will apply,\n# and they will be considered to be placed at the end of gitolite.conf.\n\n# If the repo does not exist, it must be first created using:\n#\n# GL_USER=admin gitolite create \n#\n# where is the gitolite-style name (i.e., \"foo\", not \"foo.git\" or\n# \"~/repositories/foo\" or \"~/repositories/foo.git\")\n#\n# This, of course, requires the main gitolite.conf to have the following\n# lines at the top:\n#\n# repo [A-Za-z].*\n# C = admin\n\n# Any change to the main gitolite.conf is followed by a full 'gitolite\n# compile'; i.e., ~/.gitolite/conf/gitolite.conf-compiled.pm, the main\n# \"compiled\" conf file, is consistent with the latest gitolite.conf.\n\nuse 5.10.0;\nuse Data::Dumper;\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Rc;\nuse Gitolite::Common;\nuse Gitolite::Conf;\nuse Gitolite::Conf::Store;\nuse Gitolite::Conf::Sugar;\n\nmy ($cf, $repo) = args(); # conffile from @ARGV, repo from first line of conffile\nmy $startseq = getseq(); # get the starting sequence number by looking in the (common) compiled conf file\nparse_and_store($cf, $repo); # parse the ruleset and write out just the gl-conf file\n # (this is the only part that uses core gitolite functions)\nupdate_seq($repo, $startseq); # update gl-conf with adjusted sequence numbers\n\nexit 0;\n\n# ----------------------------------------------------------------------\n\nsub args {\n my $cf = shift @ARGV or _die \"need conffile\";\n $cf = $ENV{PWD} . \"/\" . $cf unless $cf =~ m(^/);\n\n my $t = slurp($cf);\n _die \"bad conf file\" unless $t =~ /^\\s*repo\\s+(\\S+)\\s*$/m;\n my $repo = $1;\n\n return ($cf, $repo);\n}\n\nsub getseq {\n my @main_cc = slurp \"$rc{GL_ADMIN_BASE}/conf/gitolite.conf-compiled.pm\";\n my $max = 0;\n for (@main_cc) {\n $max = $1 if m/^ +(\\d+),$/ and $max < $1;\n }\n\n return $max;\n}\n\nsub parse_and_store {\n my ($cf, $repo) = @_;\n\n parse(sugar($cf));\n _chdir( $rc{GL_REPO_BASE} );\n Gitolite::Conf::Store::store_1($repo);\n}\n\nsub update_seq {\n my ($repo, $startseq) = @_;\n\n _chdir(\"$rc{GL_REPO_BASE}/$repo.git\");\n my $text = slurp(\"gl-conf\");\n\n $startseq+=1000;\n # just for safety, in case someone adds a few rules to the main conf later, but neglects to update repo confs\n\n $text =~ s/^( +)(\\d+),$/\"$1\" . ($2+$startseq) . \",\"/gme;\n\n _print(\"gl-conf\", $text);\n}\n" }, { "path": "contrib/commands/ukm", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Rc;\nuse Gitolite::Common;\nuse Gitolite::Easy;\n\n=for usage\nUsage for this command is not that simple. Please read the full\ndocumentation in\nhttps://github.com/sitaramc/gitolite-doc/blob/master/docs/contrib/ukm.mkd\nor online at http://gitolite.com/gitolite/contrib/ukm.html.\n=cut\n\nusage() if @ARGV and $ARGV[0] eq '-h';\n\n# Terms used in this file.\n# pubkeypath: the (relative) filename of a public key starting from\n# gitolite-admin/keydir. Examples: alice.pub, foo/bar/alice.pub,\n# alice@home.pub, foo/alice@laptop.pub. You get more examples, if you\n# replace \"alice\" by \"bob@example.com\".\n# userid: computed from a pubkeypath by removing any directory\n# part, the '.pub' extension and the \"old-style\" @NAME classifier.\n# The userid identifies a user in the gitolite.conf file.\n# keyid: an identifier for a key given on the command line.\n# If the script is called by one of the super_key_managers, then the\n# keyid is the pubkeypath without the '.pub' extension. Otherwise it\n# is the userid for a guest.\n# The keyid is normalized to lowercase letters.\n\nmy $rb = $rc{GL_REPO_BASE};\nmy $ab = $rc{GL_ADMIN_BASE};\n\n# This will be the subdirectory under \"keydir\" in which the guest\n# keys will be stored. To prevent denial of service, this directory\n# should better start with 'zzz'.\n# The actual value can be set through the GUEST_DIRECTORY resource.\n# WARNING: If this value is changed you must understand the consequences.\n# There will be no support if guestkeys_dir is anything else than\n# 'zzz/guests'.\nmy $guestkeys_dir = 'zzz/guests';\n\n# A guest key cannot have arbitrary names (keyid). Only keys that do *not*\n# match $forbidden_guest_pattern are allowed. Super-key-managers can add\n# any keyid.\n\n# This is the directory for additional keys of a self key manager.\nmy $selfkeys_dir = 'zzz/self';\n# There is no flexibility for selfkeys. One must specify a keyid that\n# matches the regular expression '^@[a-z0-9]+$'. Note that all keyids\n# are transformed to lowercase before checking.\nmy $required_self_pattern = qr([a-z0-9]+);\nmy $selfkey_management = 0; # disable selfkey managment\n\n# For guest key managers the keyid must pass two tests.\n# 1) It must match the $required_guest_pattern regular expression.\n# 2) It must not match the $forbidden_guest_pattern regular expression.\n# Default for $forbidden_guest_pattern is qr(.), i.e., every keyid is\n# forbidden, or in other words, only the gitolite-admin can manage keys.\n# Default for $required_guest_pattern is such that the keyid must look\n# like an email address, i.e. must have exactly one @ and at least one\n# dot after the @.\n# Just setting 'ukm' => 1 in .gitolite.rc only allows the super-key-managers\n# (i.e., only the gitolite admin(s)) to manage keys.\nmy $required_guest_pattern =\n qr(^[0-9a-z][-0-9a-z._+]*@[-0-9a-z._+]+[.][-0-9a-z._+]+$);\nmy $forbidden_guest_pattern = qr(.);\n\ndie \"The command 'ukm' is not enabled.\\n\" if ! $rc{'COMMANDS'}{'ukm'};\n\nmy $km = $rc{'UKM_CONFIG'};\nif(ref($km) eq 'HASH') {\n # If not set we only allow keyids that look like emails\n my $rgp = $rc{'UKM_CONFIG'}{'REQUIRED_GUEST_PATTERN'} || '';\n $required_guest_pattern = qr(^($rgp)$) if $rgp;\n $forbidden_guest_pattern = $rc{'UKM_CONFIG'}{'FORBIDDEN_GUEST_PATTERN'}\n || $forbidden_guest_pattern;\n $selfkey_management = $rc{'UKM_CONFIG'}{'SELFKEY_MANAGEMENT'} || 0;\n}\n\n# get the actual userid\nmy $gl_user = $ENV{GL_USER};\nmy $super_key_manager = is_admin(); # or maybe is_super_admin() ?\n\n# save arguments for later\nmy $operation = shift || 'list';\nmy $keyid = shift || '';\n$keyid = lc $keyid; # normalize to lowercase ids\n\nmy ($zop, $zfp, $zselector, $zuser) = get_pending($gl_user);\n# The following will only be true if a selfkey manager logs in to\n# perform a pending operation.\nmy $pending_self = ($zop ne '');\n\ndie \"You are not a key manager.\\n\"\n unless $super_key_manager || $pending_self\n || in_group('guest-key-managers')\n || in_group('self-key-managers');\n\n# Let's deal with the pending user first. The only allowed operations\n# that are to confirm the add operation with the random code\n# that must be provided via stdin or to undo a pending del operation.\nif ($pending_self) {\n pending_user($gl_user, $zop, $zfp, $zselector, $zuser);\n exit;\n}\n\nmy @available_operations = ('list','add','del');\ndie \"unknown ukm subcommand: $operation\\n\"\n unless grep {$operation eq $_} @available_operations;\n\n# get to the keydir\n_chdir(\"$ab/keydir\");\n\n# Note that the program warns if it finds a fingerprint that maps to\n# different userids.\nmy %userids = (); # mapping from fingerprint to userid\nmy %fingerprints = (); # mapping from pubkeypath to fingerprint\nmy %pubkeypaths = (); # mapping from userid to pubkeypaths\n # note that the result is a list of pubkeypaths\n\n# Guest keys are managed by people in the @guest-key-managers group.\n# They can only add/del keys in the $guestkeys_dir directory. In fact,\n# the guest key manager $gl_user has only access to keys inside\n# %guest_pubkeypaths.\nmy %guest_pubkeypaths = (); # mapping from userid to pubkeypath for $gl_user\n\n# Self keys are managed by people in the @self-key-managers group.\n# They can only add/del keys in the $selfkeys_dir directory. In fact,\n# the self key manager $gl_user has only access to keys inside\n# %self_pubkeypaths.\nmy %self_pubkeypaths = ();\n\n# These are the keys that are managed by a super key manager.\nmy @all_pubkeypaths = `find . -type f -name \"*.pub\" 2>/dev/null | sort`;\n\nfor my $pubkeypath (@all_pubkeypaths) {\n chomp($pubkeypath);\n my $fp = fingerprint($pubkeypath);\n $fingerprints{$pubkeypath} = $fp;\n my $userid = get_userid($pubkeypath);\n my ($zop, $zfp, $zselector, $zuser) = get_pending($userid);\n $userid = $zuser if $zop;\n if (! defined $userids{$fp}) {\n $userids{$fp} = $userid;\n } else {\n warn \"key $fp is used for different user ids\\n\"\n unless $userids{$fp} eq $userid;\n }\n push @{$pubkeypaths{$userid}}, $pubkeypath;\n if ($pubkeypath =~ m|^./$guestkeys_dir/([^/]+)/[^/]+\\.pub$|) {\n push @{$guest_pubkeypaths{$userid}}, $pubkeypath if $gl_user eq $1;\n }\n if ($pubkeypath =~ m|^./$selfkeys_dir/([^/]+)/[^/]+\\.pub$|) {\n push @{$self_pubkeypaths{$userid}}, $pubkeypath if $gl_user eq $1;\n }\n}\n\n###################################################################\n# do stuff according to the operation\n###################################################################\n\nif ( $operation eq 'list' ) {\n list_pubkeys();\n print \"\\n\\n\";\n exit;\n}\n\ndie \"keyid required\\n\" unless $keyid;\ndie \"Not allowed to use '..' in keyid.\\n\" if $keyid =~ /\\.\\./;\n\nif ( $operation eq 'add' ) {\n if ($super_key_manager) {\n add_pubkey($gl_user, \"$keyid.pub\", safe_stdin());\n } elsif (selfselector($keyid)) {\n add_self($gl_user, $keyid, safe_stdin());\n } else {\n # assert ingroup('guest-key-managers');\n add_guest($gl_user, $keyid, safe_stdin());\n }\n} elsif ( $operation eq 'del' ) {\n if ($super_key_manager) {\n del_super($gl_user, \"$keyid.pub\");\n } elsif (selfselector($keyid)) {\n del_self($gl_user, $keyid);\n } else {\n # assert ingroup('guest-key-managers');\n del_guest($gl_user, $keyid);\n }\n}\n\nexit;\n\n\n###################################################################\n# only function definitions are following\n###################################################################\n\n# make a temp clone and switch to it\nour $TEMPDIR;\nBEGIN { $TEMPDIR = `mktemp -d -t tmp.XXXXXXXXXX`; chomp($TEMPDIR) }\nEND { my $err = $?; `/bin/rm -rf $TEMPDIR`; $? = $err; }\n\nsub cd_temp_clone {\n chomp($TEMPDIR);\n hushed_git( \"clone\", \"$rb/gitolite-admin.git\", \"$TEMPDIR/gitolite-admin\" );\n chdir(\"$TEMPDIR/gitolite-admin\");\n my $ip = $ENV{SSH_CONNECTION};\n $ip =~ s/ .*//;\n my ($zop, $zfp, $zselector, $zuser) = get_pending($ENV{GL_USER});\n my $email = $zuser;\n $email .= '@' . $ip unless $email =~ m(@);\n my $name = $zop ? \"\\@$zselector\" : $zuser;\n # Record the keymanager in the gitolite-admin repo as author of the change.\n hushed_git( \"config\", \"user.email\", \"$email\" );\n hushed_git( \"config\", \"user.name\", \"'$name from $ip'\" );\n}\n\n# compute the fingerprint from the full path of a pubkey file\nsub fingerprint {\n my ($fp, $output) = ssh_fingerprint_file(shift);\n # Do not print the output of $output to an untrusted destination.\n die \"does not seem to be a valid pubkey\\n\" unless $fp;\n return $fp;\n}\n\n\n# Read one line from STDIN and return it.\n# If no data is available on STDIN after one second, the empty string\n# is returned.\n# If there is more than one line or there was an error in reading, the\n# function dies.\nsub safe_stdin {\n use IO::Select;\n my $s=IO::Select->new(); $s->add(\\*STDIN);\n return '' unless $s->can_read(1);\n my $data;\n my $ret = read STDIN, $data, 4096;\n # current pubkeys are approx 400 bytes so we go a little overboard\n die \"could not read pubkey data\" . ( defined($ret) ? \"\" : \": $!\" ) . \"\\n\"\n unless $ret;\n die \"pubkey data seems to have more than one line\\n\" if $data =~ /\\n./;\n return $data;\n}\n\n# call git, be quiet\nsub hushed_git {\n system(\"git \" . join(\" \", @_) . \">/dev/null 2>/dev/null\");\n}\n\n# Extract the userid from the full path of the pubkey file (relative\n# to keydir/ and including the '.pub' extension.\nsub get_userid {\n my ($u) = @_; # filename of pubkey relative to keydir/.\n $u =~ s(.*/)(); # foo/bar/baz.pub -> baz.pub\n $u =~ s/(\\@[^.]+)?\\.pub$//; # baz.pub, baz@home.pub -> baz\n return $u;\n}\n\n# Extract the @selector part from the full path of the pubkey file\n# (relative to keydir/ and including the '.pub' extension).\n# If there is no @selector part, the empty string is returned.\n# We also correctly extract the selector part from pending keys.\nsub get_selector {\n my ($u) = @_; # filename of pubkey relative to keydir/.\n $u =~ s(.*/)(); # foo/bar/baz.pub -> baz.pub\n $u =~ s(\\.pub$)(); # baz@home.pub -> baz@home\n return $1 if $u =~ m/.\\@($required_self_pattern)$/; # baz@home -> home\n my ($zop, $zfp, $zselector, $zuser) = get_pending($u);\n # If $u was not a pending key, then $zselector is the empty string.\n return $zselector;\n}\n\n# Extract fingerprint, operation, selector, and true userid from a\n# pending userid.\nsub get_pending {\n my ($gl_user) = @_;\n return ($1, $2, $3, $4)\n if ($gl_user=~/^zzz-(...)-([0-9a-f]{32})-($required_self_pattern)-(.*)/);\n return ('', '', '', $gl_user)\n}\n\n# multiple / and are simplified to one / and the path is made relative\nsub sanitize_pubkeypath {\n my ($pubkeypath) = @_;\n $pubkeypath =~ s|//|/|g; # normalize path\n $pubkeypath =~ s,\\./,,g; # remove './' from path\n return './'.$pubkeypath; # Don't allow absolute paths.\n}\n\n# This function is only relavant for guest key managers.\n# It returns true if the pattern is OK and false otherwise.\nsub required_guest_keyid {\n local ($_) = @_;\n /$required_guest_pattern/ and ! /$forbidden_guest_pattern/;\n}\n\n# The function takes a $keyid as input and returns the keyid with the\n# initial @ stripped if everything is fine. It aborts with an error if\n# selfkey management is not enabled or the function is called for a\n# non-self-key-manager.\n# If the required selfkey pattern is not matched, it returns an empty string.\n# Thus the function can be used to check whether a given keyid is a\n# proper selfkeyid.\nsub selfselector {\n my ($keyid) = @_;\n return '' unless $keyid =~ m(^\\@($required_self_pattern)$);\n $keyid = $1;\n die \"selfkey management is not enabled\\n\" unless $selfkey_management;\n die \"You are not a selfkey manager.\\n\" if ! in_group('self-key-managers');\n return $keyid;\n}\n\n# Return the number of characters reserved for the userid field.\nsub userid_width {\n my ($paths) = @_;\n my (%pkpaths) = %{$paths};\n my (@userid_lengths) = sort {$a <=> $b} (map {length($_)} keys %pkpaths);\n @userid_lengths ? $userid_lengths[-1] : 0;\n}\n\n# List the keys given by a reference to a hash.\n# The regular expression $re is used to remove the initial part of the\n# keyid and replace it by what is matched inside the parentheses.\n# $format and $width are used for pretty printing\nsub list_keys {\n my ($paths, $tokeyid, $format, $width) = @_;\n my (%pkpaths) = %{$paths};\n for my $userid (sort keys %pkpaths) {\n for my $pubkeypath (sort @{$pkpaths{$userid}}) {\n my $fp = $fingerprints{$pubkeypath};\n my $userid = $userids{$fp};\n my $keyid = &{$tokeyid}($pubkeypath);\n printf $format,$fp,$userid,$width+1-length($userid),\"\",$keyid\n if ($super_key_manager\n || required_guest_keyid($keyid)\n || $keyid=~m(^\\@));\n }\n }\n}\n\n# Turn a pubkeypath into a keyid for super-key-managers, guest-keys,\n# and self-keys.\nsub superkeyid {\n my ($keyid) = @_;\n $keyid =~ s(\\.pub$)();\n $keyid =~ s(^\\./)();\n return $keyid;\n}\n\nsub guestkeyid {\n my ($keyid) = @_;\n $keyid =~ s(\\.pub$)();\n $keyid =~ s(^.*/)();\n return $keyid;\n}\n\nsub selfkeyid {\n my ($keyid) = @_;\n $keyid =~ s(\\.pub$)();\n $keyid =~ s(^.*/)();\n my ($zop, $zfp, $zselector, $zuser) = get_pending($keyid);\n return \"\\@$zselector (pending $zop)\" if $zop;\n $keyid =~ s(.*@)(@);\n return $keyid;\n}\n\n###################################################################\n\n# List public keys managed by the respective user.\n# The fingerprints, userids and keyids are printed.\n# keyids are shown in a form that can be used for add and del\n# subcommands. \nsub list_pubkeys {\n print \"Hello $gl_user, you manage the following keys:\\n\";\n my $format = \"%-47s %s%*s%s\\n\";\n my $width = 0;\n if ($super_key_manager) {\n $width = userid_width(\\%pubkeypaths);\n $width = 6 if $width < 6; # length(\"userid\")==6\n printf $format, \"fingerprint\", \"userid\", ($width-5), \"\", \"keyid\";\n list_keys(\\%pubkeypaths, , \\&superkeyid, $format, $width);\n } else {\n my $widths = $selfkey_management?userid_width(\\%self_pubkeypaths):0;\n my $widthg = userid_width(\\%guest_pubkeypaths);\n $width = $widths > $widthg ? $widths : $widthg; # maximum width\n return unless $width; # there are no keys\n $width = 6 if $width < 6; # length(\"userid\")==6\n printf $format, \"fingerprint\", \"userid\", ($width-5), \"\", \"keyid\";\n list_keys(\\%self_pubkeypaths, \\&selfkeyid, $format, $width)\n if $selfkey_management;\n list_keys(\\%guest_pubkeypaths, \\&guestkeyid, $format, $width);\n }\n}\n\n\n###################################################################\n\n# Add a public key for the user $gl_user.\n# $pubkeypath is the place where the new key will be stored.\n# If the file or its fingerprint already exists, the operation is\n# rejected.\nsub add_pubkey {\n my ( $gl_user, $pubkeypath, $keymaterial ) = @_;\n if(! $keymaterial) {\n print STDERR \"Please supply the new key on STDIN.\\n\";\n print STDERR \"Try something like this:\\n\";\n print STDERR \"cat FOO.pub | ssh GIT\\@GITOLITESERVER ukm add KEYID\\n\";\n die \"missing public key data\\n\";\n }\n # clean pubkeypath a bit\n $pubkeypath = sanitize_pubkeypath($pubkeypath);\n # Check that there is not yet something there already.\n die \"cannot override existing key\\n\" if $fingerprints{$pubkeypath};\n\n my $userid = get_userid($pubkeypath);\n # Super key managers shouldn't be able to add a that leads to\n # either an empty userid or to a userid that starts with @.\n #\n # To avoid confusion, all keyids for super key managers must be in\n # a full path format. Having a public key of the form\n # gitolite-admin/keydir/@foo.pub might be confusing and might lead\n # to other problems elsewhere.\n die \"cannot add key that starts with \\@\\n\" if (!$userid) || $userid=~/^@/;\n\n cd_temp_clone();\n _chdir(\"keydir\");\n $pubkeypath =~ m((.*)/); # get the directory part\n _mkdir($1);\n _print($pubkeypath, $keymaterial);\n my $fp = fingerprint($pubkeypath);\n\n # Maybe we are adding a selfkey.\n my ($zop, $zfp, $zselector, $zuser) = get_pending($userid);\n my $user = $zop ? \"$zuser\\@$zselector\" : $userid;\n $userid = $zuser;\n # Check that there isn't a key with the same fingerprint under a\n # different userid.\n if (defined $userids{$fp}) {\n if ($userid ne $userids{$fp}) {\n print STDERR \"Found $fp $userids{$fp}\\n\" if $super_key_manager;\n print STDERR \"Same key is already available under another userid.\\n\";\n die \"cannot add key\\n\";\n } elsif ($zop) {\n # Because of the way a key is confirmed with ukm, it is\n # impossible to confirm the initial key of the user as a\n # new selfkey. (It will lead to the function list_pubkeys\n # instead of pending_user_add, because the gl_user will\n # not be that of a pending user.) To avoid confusion, we,\n # therefore, forbid to add the user's initial key\n # altogether.\n # In fact, we here also forbid to add any key for that\n # user that is already in the system.\n die \"You cannot add a key that already belongs to you.\\n\";\n }\n } else {# this fingerprint does not yet exist\n my @paths = @{$pubkeypaths{$userid}} if defined $pubkeypaths{$userid};\n if (@paths) {# there are already keys for $userid\n if (grep {$pubkeypath eq $_} @paths) {\n print STDERR \"The keyid is already present. Nothing changed.\\n\";\n } elsif ($super_key_manager) {\n # It's OK to add new selfkeys, but here we are in the case\n # of adding multiple keys for guests. That is forbidden.\n print STDERR \"Adding new public key for $userid.\\n\";\n } elsif ($pubkeypath =~ m(^\\./$guestkeys_dir/)) {\n # Arriving here means we are about to add a *new*\n # guest key, because the fingerprint is not yet\n # existing. This would be for an already existing\n # userid (added by another guest key manager). Since\n # that effectively means to (silently) add an\n # additional key for an existing user, it must be\n # forbidden.\n die \"cannot add another public key for an existing user\\n\";\n }\n }\n }\n exit if (`git status -s` eq ''); # OK to add identical keys twice\n hushed_git( \"add\", \".\" ) and die \"git add failed\\n\";\n hushed_git( \"commit\", \"-m\", \"'ukm add $gl_user $userid\\n\\n$fp'\" )\n and die \"git commit failed\\n\";\n system(\"gitolite push >/dev/null 2>/dev/null\") and die \"git push failed\\n\";\n}\n\n# Guest key managers should not be allowed to add directories or\n# multiple keys via the @domain mechanism, since this might allow\n# another guest key manager to give an attacker access to another\n# user's repositories.\n#\n# Example: Alice adds bob.pub for bob@example.org. David adds eve.pub\n# (where only Eve but not Bob has the private key) under the keyid\n# bob@example.org@foo. This basically gives Eve the same rights as\n# Bob.\nsub add_guest {\n my ( $gl_user, $keyid, $keymaterial ) = @_;\n die \"keyid not allowed: '$keyid'\\n\"\n if $keyid =~ m(@.*@) or $keyid =~ m(/) or !required_guest_keyid($keyid);\n add_pubkey($gl_user, \"$guestkeys_dir/$gl_user/$keyid.pub\", $keymaterial);\n}\n\n# Add a new selfkey for user $gl_user.\nsub add_self {\n my ( $gl_user, $keyid, $keymaterial ) = @_;\n my $selector = \"\";\n $selector = selfselector($keyid); # might return empty string\n die \"keyid not allowed: $keyid\\n\" unless $selector;\n\n # Check that the new selector is not already in use even not in a\n # pending state.\n die \"keyid already in use: $keyid\\n\"\n if grep {selfkeyid($_)=~/^\\@$selector( .*)?$/} @{$self_pubkeypaths{$gl_user}};\n # generate new pubkey create fingerprint\n system(\"ssh-keygen -N '' -q -f \\\"$TEMPDIR/session\\\" -C $gl_user\");\n my $sessionfp = fingerprint(\"$TEMPDIR/session.pub\");\n $sessionfp =~ s/://g;\n my $user = \"zzz-add-$sessionfp-$selector-$gl_user\";\n add_pubkey($gl_user, \"$selfkeys_dir/$gl_user/$user.pub\", $keymaterial);\n print `cat \"$TEMPDIR/session.pub\"`;\n}\n\n###################################################################\n\n\n# Delete a key of user $gl_user.\nsub del_pubkey {\n my ($gl_user, $pubkeypath) = @_;\n $pubkeypath = sanitize_pubkeypath($pubkeypath);\n my $fp = $fingerprints{$pubkeypath};\n die \"key not found\\n\" unless $fp;\n cd_temp_clone();\n chdir(\"keydir\");\n hushed_git( \"rm\", \"$pubkeypath\" ) and die \"git rm failed\\n\";\n my $userid = get_userid($pubkeypath);\n hushed_git( \"commit\", \"-m\", \"'ukm del $gl_user $userid\\n\\n$fp'\" )\n and die \"git commit failed\\n\";\n system(\"gitolite push >/dev/null 2>/dev/null\") and die \"git push failed\\n\";\n}\n\n# $gl_user is a super key manager. This function aborts if the\n# superkey manager tries to remove his last key.\nsub del_super {\n my ($gl_user, $pubkeypath) = @_;\n $pubkeypath = sanitize_pubkeypath($pubkeypath);\n die \"You are not managing the key $keyid.\\n\"\n unless grep {$_ eq $pubkeypath} @all_pubkeypaths;\n my $userid = get_userid($pubkeypath);\n if ($gl_user eq $userid) {\n my @paths = @{$pubkeypaths{$userid}};\n die \"You cannot delete your last key.\\n\"\n if scalar(grep {$userid eq get_userid($_)} @paths)<2;\n }\n del_pubkey($gl_user, $pubkeypath);\n}\n\nsub del_guest {\n my ($gl_user, $keyid) = @_;\n my $pubkeypath = sanitize_pubkeypath(\"$guestkeys_dir/$gl_user/$keyid.pub\");\n my $userid = get_userid($pubkeypath);\n # Check whether $gl_user actually manages $keyid.\n my @paths = ();\n @paths = @{$guest_pubkeypaths{$userid}}\n if defined $guest_pubkeypaths{$userid};\n die \"You are not managing the key $keyid.\\n\"\n unless grep {$_ eq $pubkeypath} @paths;\n del_pubkey($gl_user, $pubkeypath);\n}\n\n# Delete a selfkey of $gl_user. The first delete is a preparation of\n# the deletion and only a second call will actually delete the key. If\n# the second call is done with the key that is scheduled for deletion,\n# it is basically undoing the previous del call. This last case is\n# handled in function pending_user_del.\nsub del_self {\n my ($gl_user, $keyid) = @_;\n my $selector = selfselector($keyid); # might return empty string\n die \"keyid not allowed: '$keyid'\\n\" unless $selector;\n\n # Does $gl_user actually manage that keyid?\n # All (non-pending) selfkeys have an @selector part in their pubkeypath.\n my @paths = @{$self_pubkeypaths{$gl_user}};\n die \"You are not managing the key $keyid.\\n\"\n unless grep {$selector eq get_selector($_)} @paths;\n\n cd_temp_clone();\n _chdir(\"keydir\");\n my $fp = '';\n # Is it the first or the second del call? It's the second call, if\n # there is a scheduled-for-deletion or scheduled-for-addition\n # selfkey which has the given keyid as a selector part.\n @paths = grep {\n my ($zop, $zfp, $zselector, $zuser) = get_pending(get_userid($_));\n $zselector eq $selector\n } @paths;\n if (@paths) {# start actual deletion of the key (second call)\n my $pubkeypath = $paths[0];\n $fp = fingerprint($pubkeypath);\n my ($zop, $zf, $zs, $zu) = get_pending(get_userid($pubkeypath));\n $zop = $zop eq 'add' ? 'undo-add' : 'confirm-del';\n hushed_git(\"rm\", \"$pubkeypath\") and die \"git rm failed\\n\";\n hushed_git(\"commit\", \"-m\", \"'ukm $zop $gl_user\\@$selector\\n\\n$fp'\")\n and die \"git commit failed\\n\";\n system(\"gitolite push >/dev/null 2>/dev/null\")\n and die \"git push failed\\n\";\n print STDERR \"pending keyid deleted: \\@$selector\\n\";\n return;\n }\n my $oldpubkeypath = \"$selfkeys_dir/$gl_user/$gl_user\\@$selector.pub\";\n # generate new pubkey and create fingerprint to get a random number\n system(\"ssh-keygen -N '' -q -f \\\"$TEMPDIR/session\\\" -C $gl_user\");\n my $sessionfp = fingerprint(\"$TEMPDIR/session.pub\");\n $sessionfp =~ s/://g;\n my $user = \"zzz-del-$sessionfp-$selector-$gl_user\";\n my $newpubkeypath = \"$selfkeys_dir/$gl_user/$user.pub\";\n\n # A key for gitolite access that is in authorized_keys and not\n # existing in the expected place under keydir/ should actually not\n # happen, but one never knows.\n die \"key not available\\n\" unless -r $oldpubkeypath;\n\n # For some strange reason the target key already exists.\n die \"cannot override existing key\\n\" if -e $newpubkeypath;\n\n $fp = fingerprint($oldpubkeypath);\n print STDERR \"prepare deletion of key \\@$selector\\n\";\n hushed_git(\"mv\", \"$oldpubkeypath\", \"$newpubkeypath\")\n and die \"git mv failed\\n\";\n hushed_git(\"commit\", \"-m\", \"'ukm prepare-del $gl_user\\@$selector\\n\\n$fp'\")\n and die \"git commit failed\\n\";\n system(\"gitolite push >/dev/null 2>/dev/null\")\n and die \"git push failed\\n\";\n}\n\n###################################################################\n# Adding a selfkey should be done as follows.\n#\n# cat newkey.pub | ssh git@host ukm add @selector > session\n# cat session | ssh -i newkey git@host ukm\n#\n# The provided random data will come from a newly generated ssh key\n# whose fingerprint will be stored in $gl_user. So we compute the\n# fingerprint of the data that is given to us. If it doesn't match the\n# fingerprint, then something went wrong and the confirm operation is\n# forbidden, in fact, the pending key will be removed from the system.\nsub pending_user_add {\n my ($gl_user, $zfp, $zselector, $zuser) = @_;\n my $oldpubkeypath = \"$selfkeys_dir/$zuser/$gl_user.pub\";\n my $newpubkeypath = \"$selfkeys_dir/$zuser/$zuser\\@$zselector.pub\";\n\n # A key for gitolite access that is in authorized_keys and not\n # existing in the expected place under keydir/ should actually not\n # happen, but one never knows.\n die \"key not available\\n\" unless -r $oldpubkeypath;\n\n my $keymaterial = safe_stdin();\n # If there is no keymaterial (which corresponds to a session key\n # for the confirm-add operation), logging in to this key, removes\n # it from the system.\n my $session_key_not_provided = '';\n if (!$keymaterial) {\n $session_key_not_provided = \"missing session key\";\n } else {\n _print(\"$TEMPDIR/session.pub\", $keymaterial);\n my $sessionfp = fingerprint(\"$TEMPDIR/session.pub\");\n $sessionfp =~ s/://g;\n $session_key_not_provided = \"session key not accepted\"\n unless ($zfp eq $sessionfp)\n }\n my $fp = fingerprint($oldpubkeypath);\n if ($session_key_not_provided) {\n print STDERR \"$session_key_not_provided\\n\";\n print STDERR \"pending keyid deleted: \\@$zselector\\n\";\n hushed_git(\"rm\", \"$oldpubkeypath\") and die \"git rm failed\\n\";\n hushed_git(\"commit\", \"-m\", \"'ukm del $zuser\\@$zselector\\n\\n$fp'\")\n and die \"git commit failed\\n\";\n system(\"gitolite push >/dev/null 2>/dev/null\")\n and die \"git push failed\\n\";\n return;\n }\n\n # For some strange reason the target key already exists.\n die \"cannot override existing key\\n\" if -e $newpubkeypath;\n\n print STDERR \"pending keyid added: \\@$zselector\\n\";\n hushed_git(\"mv\", \"$oldpubkeypath\", \"$newpubkeypath\")\n and die \"git mv failed\\n\";\n hushed_git(\"commit\", \"-m\", \"'ukm confirm-add $zuser\\@$zselector\\n\\n$fp'\")\n and die \"git commit failed\\n\";\n system(\"gitolite push >/dev/null 2>/dev/null\")\n and die \"git push failed\\n\";\n}\n\n# To delete a key, one must first bring the key into a pending state\n# and then truely delete it with another key. In case, the login\n# happens with the pending key (implemented below), it means that the\n# delete operation has to be undone.\nsub pending_user_del {\n my ($gl_user, $zfp, $zselector, $zuser) = @_;\n my $oldpubkeypath = \"$selfkeys_dir/$zuser/$gl_user.pub\";\n my $newpubkeypath = \"$selfkeys_dir/$zuser/$zuser\\@$zselector.pub\";\n print STDERR \"undo pending deletion of keyid \\@$zselector\\n\";\n # A key for gitolite access that is in authorized_keys and not\n # existing in the expected place under keydir/ should actually not\n # happen, but one never knows.\n die \"key not available\\n\" unless -r $oldpubkeypath;\n # For some strange reason the target key already exists.\n die \"cannot override existing key\\n\" if -e $newpubkeypath;\n my $fp = fingerprint($oldpubkeypath);\n hushed_git(\"mv\", \"$oldpubkeypath\", \"$newpubkeypath\")\n and die \"git mv failed\\n\";\n hushed_git(\"commit\", \"-m\", \"'ukm undo-del $zuser\\@$zselector\\n\\n$fp'\")\n and die \"git commit failed\\n\";\n}\n\n# A user whose key is in pending state cannot do much. In fact,\n# logging in as such a user simply takes back the \"bringing into\n# pending state\", i.e. a key scheduled for adding is remove and a key\n# scheduled for deletion is brought back into its properly added state.\nsub pending_user {\n my ($gl_user, $zop, $zfp, $zselector, $zuser) = @_;\n cd_temp_clone();\n _chdir(\"keydir\");\n if ($zop eq 'add') {\n pending_user_add($gl_user, $zfp, $zselector, $zuser);\n } elsif ($zop eq 'del') {\n pending_user_del($gl_user, $zfp, $zselector, $zuser);\n } else {\n die \"unknown operation\\n\";\n }\n system(\"gitolite push >/dev/null 2>/dev/null\")\n and die \"git push failed\\n\";\n}\n" }, { "path": "contrib/hooks/repo-specific/save-push-signatures", "content": "#!/bin/sh\n\n# ----------------------------------------------------------------------\n# post-receive hook to adopt push certs into 'refs/push-certs'\n\n# Collects the cert blob on push and saves it, then, if a certain number of\n# signed pushes have been seen, processes all the \"saved\" blobs in one go,\n# adding them to the special ref 'refs/push-certs'. This is done in a way\n# that allows searching for all the certs pertaining to one specific branch\n# (thanks to Junio Hamano for this idea plus general brainstorming).\n\n# The \"collection\" happens only if $GIT_PUSH_CERT_NONCE_STATUS = OK; again,\n# thanks to Junio for pointing this out; see [1]\n#\n# [1]: https://groups.google.com/forum/#!topic/gitolite/7cSrU6JorEY\n\n# WARNINGS:\n# Does not check that GIT_PUSH_CERT_STATUS = \"G\". If you want to check that\n# and FAIL the push, you'll have to write a simple pre-receive hook\n# (post-receive is not the place for that; see 'man githooks').\n#\n# Gitolite users: failing the hook cannot be done as a VREF because git does\n# not set those environment variables in the update hook. You'll have to\n# write a trivial pre-receive hook and add that in.\n\n# Relevant gitolite doc links:\n# repo-specific environment variables\n# http://gitolite.com/gitolite/dev-notes.html#appendix-1-repo-specific-environment-variables\n# repo-specific hooks\n# http://gitolite.com/gitolite/non-core.html#repo-specific-hooks\n# http://gitolite.com/gitolite/cookbook.html#v36-variation-repo-specific-hooks\n\n# Environment:\n# GIT_PUSH_CERT_NONCE_STATUS should be \"OK\" (as mentioned above)\n#\n# GL_OPTIONS_GPC_PENDING (optional; defaults to 1). This is the number of\n# git push certs that should be waiting in order to trigger the post\n# processing. You can set it within gitolite like so:\n#\n# repo foo bar # or maybe just 'repo @all'\n# option ENV.GPC_PENDING = 5\n\n# Setup:\n# Set up this code as a post-receive hook for whatever repos you need to.\n# Then arrange to have the environment variable GL_OPTION_GPC_PENDING set to\n# some number, as shown above. (This is only required if you need it to be\n# greater than 1.) It could of course be different for different repos.\n# Also see \"Invocation\" section below.\n\n# Invocation:\n# Normally via git (see 'man githooks'), once it is setup as a post-receive\n# hook.\n#\n# However, if you set the \"pending\" limit high, and want to periodically\n# \"clean up\" pending certs without necessarily waiting for the counter to\n# trip, do the following (untested):\n#\n# RB=$(gitolite query-rc GL_REPO_BASE)\n# for r in $(gitolite list-phy-repos)\n# do\n# cd $RB/$repo.git\n# unset GL_OPTIONS_GPC_PENDING # if it is set higher up\n# hooks/post-receive post_process\n# done\n#\n# That will take care of it.\n\n# Using without gitolite:\n# Just set GL_OPTIONS_GPC_PENDING within the script (maybe read it from git\n# config). Everything else is independent of gitolite.\n\n# ----------------------------------------------------------------------\n# make it work on BSD also (but NOT YET TESTED on FreeBSD!)\nuname_s=`uname -s`\nif [ \"$uname_s\" = \"Linux\" ]\nthen\n _lock() { flock \"$@\"; }\nelse\n _lock() { lockf -k \"$@\"; }\n # I'm assuming other BSDs also have this; I only have FreeBSD.\nfi\n\n# ----------------------------------------------------------------------\n# standard stuff\ndie() { echo \"$@\" >&2; exit 1; }\nwarn() { echo \"$@\" >&2; }\n\n# ----------------------------------------------------------------------\n# if there are no arguments, we're running as a \"post-receive\" hook\nif [ -z \"$1\" ]\nthen\n # ignore if it may be a replay attack\n [ \"$GIT_PUSH_CERT_NONCE_STATUS\" = \"OK\" ] || exit 1\n # I don't think \"exit 1\" does anything in a post-receive anyway, so that's\n # just a symbolic gesture!\n\n # note the lock file used\n _lock .gpc.lock $0 cat_blob\n\n # if you want to initiate the post-processing ONLY from outside (for\n # example via cron), comment out the next line.\n exec $0 post_process\nfi\n\n# ----------------------------------------------------------------------\n# the 'post_process' part; see \"Invocation\" section in the doc at the top\nif [ \"$1\" = \"post_process\" ]\nthen\n # this is the same lock file as above\n _lock .gpc.lock $0 count_and_rotate $$\n\n [ -d git-push-certs.$$ ] || exit 0\n\n # but this is a different one\n _lock .gpc.ref.lock $0 update_ref $$\n\n exit 0\nfi\n\n# ----------------------------------------------------------------------\n# other values for \"$1\" are internal use only\n\nif [ \"$1\" = \"cat_blob\" ]\nthen\n mkdir -p git-push-certs\n git cat-file blob $GIT_PUSH_CERT > git-push-certs/$GIT_PUSH_CERT\n echo $GIT_PUSH_CERT >> git-push-certs/.blob.list\nfi\n\nif [ \"$1\" = \"count_and_rotate\" ]\nthen\n count=$(ls git-push-certs | wc -l)\n if test $count -ge ${GL_OPTIONS_GPC_PENDING:-1}\n then\n # rotate the directory\n mv git-push-certs git-push-certs.$2\n fi\nfi\n\nif [ \"$1\" = \"update_ref\" ]\nthen\n # use a different index file for all this\n GIT_INDEX_FILE=push_certs_index; export GIT_INDEX_FILE\n\n # prepare the special ref to receive commits\n # historically this hook put the certs in a ref named refs/push-certs\n # however, git does *NOT* replicate single-level refs\n # trying to push them explicitly causes this error:\n # remote: error: refusing to create funny ref 'refs/push-certs' remotely\n # https://lore.kernel.org/git/robbat2-20211115T063838-612792475Z@orbis-terrarum.net/\n #\n # As a good-enough solution, use the namespace of meta/ for the refs.\n # This is already used in other systems:\n # - kernel.org refs/meta/cgit\n # - gerrit refs/meta/config\n # - GitBlit reflog: refs/meta/gitblit https://www.gitblit.com/administration.html#H12\n # - cc-utils refs/meta/ci\n # - JGit refs/meta/push-certs https://www.ibm.com/docs/en/radfws/9.6.1?topic=SSRTLW_9.6.1/org.eclipse.egit.doc/help/JGit/New_and_Noteworthy/4.1/4.1.htm\n #\n # To migrate from old to new, for each repo:\n # git update-ref refs/meta/push-certs refs/push-certs\n PUSH_CERTS_EXTRA_REFS='' PUSH_CERTS='' # These vars will be populated after checks.\n # others vars are temp\n _OLD_PUSH_CERTS=refs/push-certs\n _NEW_PUSH_CERTS=refs/meta/push-certs\n _OLD_PUSH_CERTS_EXISTS=0\n _NEW_PUSH_CERTS_EXISTS=0\n git show-ref --verify --quiet -- \"$_OLD_PUSH_CERTS\" && _OLD_PUSH_CERTS_EXISTS=1\n git show-ref --verify --quiet -- \"$_NEW_PUSH_CERTS\" && _NEW_PUSH_CERTS_EXISTS=1\n case \"${_OLD_PUSH_CERTS_EXISTS}${_NEW_PUSH_CERTS_EXISTS}\" in\n # neither or new only:\n # let's push to the NEW name only\n '00'|'01') PUSH_CERTS=$_NEW_PUSH_CERTS ;;\n # old-only: stick to the same, the migration is opt-in\n '10') PUSH_CERTS=$_OLD_PUSH_CERTS ;;\n # Both: Push to the old name, duplicate to the new name\n '11') PUSH_CERTS=$_OLD_PUSH_CERTS PUSH_CERTS_EXTRA_REFS=$_NEW_PUSH_CERTS ;;\n esac\n # cleanup vars\n unset _OLD_PUSH_CERTS_EXISTS _NEW_PUSH_CERTS_EXISTS _OLD_PUSH_CERTS _NEW_PUSH_CERTS\n\n if git rev-parse -q --verify $PUSH_CERTS >/dev/null\n then\n git read-tree $PUSH_CERTS\n else\n git read-tree --empty\n T=$(git write-tree)\n C=$(echo 'start' | git commit-tree $T)\n for _ref in $PUSH_CERTS $PUSH_CERTS_EXTRA_REFS ; do\n git update-ref \"${_ref}\" \"${C}\"\n done\n fi\n\n # for each cert blob...\n for b in `cat git-push-certs.$2/.blob.list`\n do\n cf=git-push-certs.$2/$b\n\n # it's highly unlikely that the blob got GC-ed already but write it\n # back anyway, just in case\n B=$(git hash-object -w $cf)\n\n # bit of a sanity check\n [ \"$B\" = \"$b\" ] || warn \"this should not happen: $B is not equal to $b\"\n\n # for each ref described within the cert, update the index\n for ref in `cat $cf | egrep '^[a-f0-9]+ [a-f0-9]+ refs/' | cut -f3 -d' '`\n do\n git update-index --add --cacheinfo 100644,$b,$ref\n # we're using the ref name as a \"fake\" filename, so people can,\n # for example, 'git log refs/push-certs -- refs/heads/master', to\n # see all the push certs pertaining to the master branch. This\n # idea came from Junio Hamano, the git maintainer (I certainly\n # don't deal with git plumbing enough to have thought of it!)\n done\n\n T=$(git write-tree)\n C=$( git commit-tree -p $PUSH_CERTS $T < $cf )\n for _ref in $PUSH_CERTS $PUSH_CERTS_EXTRA_REFS ; do\n git update-ref \"${_ref}\" \"${C}\"\n done\n\n rm -f $cf\n done\n rm -f git-push-certs.$2/.blob.list\n rmdir git-push-certs.$2\nfi\n" }, { "path": "contrib/lib/Apache/gitolite.conf", "content": "# Apache Gitolite smart-http install Active Directory Authentication\n\n# Author: Jonathan Gray\n\n# It is assumed you already have mod_ssl, mod_ldap, & mod_authnz configured for apache\n# It is also assumed you are disabling http on port 80 and requiring the use of https on port 443\n\n# Boiler plate configuration from the smart-http deployment documentation script\n# Adjust paths if you use something other than the default\nSetEnv GIT_PROJECT_ROOT /var/www/gitolite-home/repositories\nScriptAlias /git/ /var/www/gitolite-home/gitolite-source/src/gitolite-shell/\nScriptAlias /gitmob/ /var/www/gitolite-home/gitolite-source/src/gitolite-shell/\nSetEnv GITOLITE_HTTP_HOME /var/www/gitolite-home\n# WARNING: do not add a trailing slash to the value of GITOLITE_HTTP_HOME\nSetEnv GIT_HTTP_EXPORT_ALL\n \n# Setup LDAP trusted root certificate from your domain\nLDAPTrustedGlobalCert CA_BASE64 /etc/httpd/conf.d/domain.ca.cer\n\n# In case you havn't setup proper SSL certificates in ssl.conf, go ahead and do it here to save headache later with git\nSSLCertificateFile /etc/httpd/conf.d/gitolite.server.crt\nSSLCertificateKeyFile /etc/httpd/conf.d/gitolite.server.key\nSSLCertificateChainFile /etc/httpd/conf.d/DigiCertCA.crt\n \n\n Order deny,allow\n\t# In case you want to restrict access to a given ip/subnet\n #Allow from my.ip.range/cidr\n #Deny from All\n AuthType Basic\n AuthName \"Git\"\n AuthBasicProvider ldap\n AuthUserFile /dev/null\n AuthzLDAPAuthoritative on\n AuthLDAPURL ldaps://AD.DC1.local:3269 AD.DC2.local:3269 AD.DC3.local:3269/?sAMAccountName?sub\n AuthLDAPBindDN git@domain.local\n AuthLDAPBindPassword super.secret.password\n AuthLDAPGroupAttributeIsDN on\n \n\t# You must use one of the two following approaches to handle authentication via active directory\n\t\n # Require membership in the gitolite users group in AD\n # The ldap-filter option is used to handle nested groups on the AD server rather than multiple calls to traverse from apache\n # Require ldap-filter memberof:1.2.840.113556.1.4.1941:=cn=Gitolite Users,ou=Security Groups,dc=domain,dc=local\n\n\t# Alternatively, require a valid user account only since you're going to control authorization in gitolite anyway\n\tRequire valid-user\n\n" }, { "path": "contrib/lib/Gitolite/Triggers/RedmineUserAlias.pm", "content": "package Gitolite::Triggers::RedmineUserAlias;\n\nuse Gitolite::Rc;\nuse Gitolite::Common;\nuse Gitolite::Conf::Load;\n\nuse strict;\nuse warnings;\n\n# aliasing a redmine username to a more user-friendly one\n# ----------------------------------------------------------------------\n\n=for usage\n\nWhy:\n\n Redmine creates users like \"redmine_alice_123\"; we want the users to just\n see \"alice\" instead of that.\n\nAssumption:\n\n* Redmine does not allow duplicates in the middle bit; i.e., you can't\n create redmine_alice_123 and redmine_alice_456 also.\n\nHow:\n\n* add this code as lib/Gitolite/Triggers/RedmineUserAlias.pm to your\n site-local code directory; see this link for how:\n\n http://gitolite.com/gitolite/non-core.html#locations\n\n* add the following to the rc file, just before the ENABLE section (don't\n forget the trailing comma):\n\n INPUT => [ 'RedmineUserAlias::input' ],\n\nNotes:\n\n* http mode has not been tested and will not be. If someone has the time to\n test it and make it work please let me know.\n\n* not tested with mirroring.\n\nQuote:\n\n* \"All that for what is effectively one line of code. I need a life\".\n\n=cut\n\nsub input {\n $ARGV[0] or _die \"no username???\";\n $ARGV[0] =~ s/^redmine_(\\S+)_\\d+$/$1/;\n}\n\n1;\n" }, { "path": "contrib/t/ukm.t", "content": "#!/usr/bin/perl\n\n# Call like this:\n# TSH_VERBOSE=1 TSH_ERREXIT=1 HARNESS_ACTIVE=1 GITOLITE_TEST=y prove t/ukm.t\n\nuse strict;\nuse warnings;\n\n# this is hardcoded; change it if needed\nuse lib \"src/lib\";\nuse Gitolite::Common;\nuse Gitolite::Test;\n\n# basic tests using ssh\n# ----------------------------------------------------------------------\n\nmy $bd = `gitolite query-rc -n GL_BINDIR`;\nmy $h = $ENV{HOME};\nmy $ab = `gitolite query-rc -n GL_ADMIN_BASE`;\nmy $pd = \"$bd/../t/keys\"; # source for pubkeys\numask 0077;\n\n_mkdir( \"$h/.ssh\", 0700 ) if not -d \"$h/.ssh\";\n\ntry \"plan 204\";\n\n\n# Reset everything.\n# Only admin and u1, u2, and u3 keys are available initially\n# Keys u4, u5, and u6 are used as guests later.\n# For easy access, we put the keys into ~/.ssh/, though.\ntry \"\n rm -f $h/.ssh/authorized_keys; ok or die 1\n cp $pd/u[1-6]* $h/.ssh; ok or die 2\n cp $pd/admin* $h/.ssh; ok or die 3\n cp $pd/config $h/.ssh; ok or die 4\n cat $h/.ssh/config\n perl s/%USER/$ENV{USER}/\n put $h/.ssh/config\n mkdir $ab/keydir; ok or die 5\n cp $pd/u[1-3].pub $ab/keydir; ok or die 6\n cp $pd/admin.pub $ab/keydir; ok or die 7\n\";\n\n# Put the keys into ~/.ssh/authorized_keys\nsystem(\"gitolite ../triggers/post-compile/ssh-authkeys\");\n\n# enable user key management in a simple form.\n# Guest key managers can add keyids looking like email addresses, but\n# cannot add emails containing example.com or hemmecke.org.\nsystem(\"sed -i \\\"s/.*ENABLE =>.*/'UKM_CONFIG'=>{'FORBIDDEN_GUEST_PATTERN'=>'example.com|hemmecke.org'}, ENABLE => ['ukm',/\\\" $h/.gitolite.rc\");\n\n# super-key-managers can add/del any key\n# super-key-managers should in fact agree with people having write\n# access to gitolite-admin repo.\n# guest-key-managers can add/del guest keys\nconfreset; confadd '\n @guest-key-managers = u2 u3\n @creators = u2 u3\n repo pub/CREATOR/..*\n C = @creators\n RW+ = CREATOR\n RW = WRITERS\n R = READERS\n';\n\n# Populate the gitolite-admin/keydir in the same way as it was used for\n# the initialization of .ssh/authorized_keys above.\ntry \"\n mkdir keydir; ok or die 8\n cp $pd/u[1-3].pub keydir; ok or die 9;\n cp $pd/admin.pub keydir; ok or die 10;\n git add conf keydir; ok\n git commit -m ukm; ok; /master.* ukm/\n\";\n\n# Activate new config data.\ntry \"PUSH admin; ok; gsh; /master -> master/; !/FATAL/\" or die text();\n\n# Check whether the above setup yields the expected behavior for ukm.\n# The admin is super-key-manager, thus can manage every key.\ntry \"\n ssh admin ukm; ok; /Hello admin, you manage the following keys:/\n / admin +admin/\n / u1 +u1/\n / u2 +u2/\n / u3 +u3/\n\";\n\n# u1 isn't a key manager, so shouldn't be above to manage keys.\ntry \"ssh u1 ukm; !ok; /FATAL: You are not a key manager./\";\n\n# u2 and u3 are guest key managers, but don't yet manage any key.\ntry \"ssh u2 ukm; ok\"; cmp \"Hello u2, you manage the following keys:\\n\\n\\n\";\ntry \"ssh u3 ukm; ok\"; cmp \"Hello u3, you manage the following keys:\\n\\n\\n\";\n\n\n###################################################################\n# Unknows subkommands abort ukm.\ntry \"ssh u2 ukm fake; !ok; /FATAL: unknown ukm subcommand: fake/\";\n\n\n###################################################################\n# Addition of keys.\n\n# If no data is provided on stdin, we don't block, but rather timeout\n# after one second and abort the program.\ntry \"ssh u2 ukm add u4\\@example.org; !ok; /FATAL: missing public key data/\";\n\n# If no keyid is given, we cannot add a key.\ntry \"ssh u2 ukm add; !ok; /FATAL: keyid required/\";\n\ntry \"\n DEF ADD = cat $pd/%1.pub|ssh %2 ukm add %3\n DEF ADDOK = ADD %1 %2 %3; ok\n DEF ADDNOK = ADD %1 %2 %3; !ok\n DEF FP = ADDNOK u4 u2 %1\n DEF FORBIDDEN_PATTERN = FP %1; /FATAL: keyid not allowed:/\n\";\n\n# Neither a guest key manager nor a super key manager can add keys that have\n# double dot in their keyid. This is hardcoded to forbid paths with .. in it.\ntry \"\n ADDNOK u4 u2 u4\\@hemmecke..org; /Not allowed to use '..' in keyid./\n ADDNOK u4 admin u4\\@hemmecke..org; /Not allowed to use '..' in keyid./\n ADDNOK u4 admin ./../.myshrc; /Not allowed to use '..' in keyid./\n\";\n\n# guest-key-managers can only add keys that look like emails.\ntry \"\n FORBIDDEN_PATTERN u4\n FORBIDDEN_PATTERN u4\\@example\n FORBIDDEN_PATTERN u4\\@foo\\@example.org\n\n # No support for 'old style' multiple keys.\n FORBIDDEN_PATTERN u4\\@example.org\\@foo\n\n # No path delimiter in keyid\n FORBIDDEN_PATTERN foo/u4\\@example.org\n\n # Certain specific domains listed in FORBIDDEN_GUEST_PATTERN are forbidden.\n # Note that also u4\\@example-com would be rejected, because MYDOMAIN\n # contains a regular expression --> I don't care.\n FORBIDDEN_PATTERN u4\\@example.com\n FORBIDDEN_PATTERN u4\\@hemmecke.org\n\";\n\n# Accept one guest key.\ntry \"ADDOK u4 u2 u4\\@example.org\";\ntry \"ssh u2 ukm; ok; /Hello u2, you manage the following keys:/\n / u4\\@example.org *u4\\@example.org/\";\n\n# Various ways how a key must be rejected.\ntry \"\n # Cannot add the same key again.\n ADDNOK u4 u2 u4\\@example.org; /FATAL: cannot override existing key/\n\n # u2 can also not add u4.pub under another keyid\n ADDNOK u4 u2 u4\\@example.net; /FATAL: cannot add key/\n /Same key is already available under another userid./\n\n # u2 can also not add another key under the same keyid.\n ADDNOK u5 u2 u4\\@example.org; /FATAL: cannot override existing key/\n\n # Also u3 cannot not add another key under the same keyid.\n ADDNOK u5 u3 u4\\@example.org\n /FATAL: cannot add another public key for an existing user/\n\n # And u3 cannot not add u4.pub under another keyid.\n ADDNOK u4 u3 u4\\@example.net; /FATAL: cannot add key/\n /Same key is already available under another userid./\n\n # Not even the admin can add the same key u4 under a different userid.\n ADDNOK u4 admin u4\\@example.net; /FATAL: cannot add key/\n /Same key is already available under another userid./\n /Found .* u4\\@example.org/\n\n # Super key managers cannot add keys that start with @.\n # We don't care about @ in the dirname, though.\n ADDNOK u4 admin foo/\\@ex.net; /FATAL: cannot add key that starts with \\@/\n ADDNOK u4 admin foo/\\@ex; /FATAL: cannot add key that starts with \\@/\n ADDNOK u4 admin \\@ex.net; /FATAL: cannot add key that starts with \\@/\n ADDNOK u4 admin \\@ex; /FATAL: cannot add key that starts with \\@/\n\";\n\n# But u3 can add u4.pub under the same keyid.\ntry \"ADDOK u4 u3 u4\\@example.org\";\n\ntry \"ssh u3 ukm; ok; /Hello u3, you manage the following keys:/\n / u4\\@example.org *u4\\@example.org/\";\n\n# The admin can add multiple keys for the same userid.\ntry \"\n ADDOK u5 admin u4\\@example.org\n ADDOK u5 admin u4\\@example.org\\@home\n ADDOK u5 admin laptop/u4\\@example.org\n ADDOK u5 admin laptop/u4\\@example.org\\@home\n\";\n\n# And admin can also do this for other guest key managers. Note,\n# however, that the gitolite-admin must be told where the\n# GUEST_DIRECTORY is. But he/she could find out by cloning the\n# gitolite-admin repository and adding the same key directly.\ntry \"\n ADDOK u5 admin zzz/guests/u2/u4\\@example.org\\@foo\n ADDOK u6 admin zzz/guests/u3/u6\\@example.org\n\";\n\ntry \"ssh admin ukm; ok\"; cmp \"Hello admin, you manage the following keys:\nfingerprint userid keyid\na4:d1:11:1d:25:5c:55:9b:5f:91:37:0e:44:a5:a5:f2 admin admin\n00:2c:1f:dd:a3:76:5a:1e:c4:3c:01:15:65:19:a5:2e u1 u1\n69:6f:b5:8a:f5:7b:d8:40:ce:94:09:a2:b8:95:79:5b u2 u2\n26:4b:20:24:98:a4:e4:a5:b9:97:76:9a:15:92:27:2d u3 u3\n78:cf:7e:2b:bf:18:58:54:23:cc:4b:3d:7e:f4:63:79 u4\\@example.org laptop/u4\\@example.org\n78:cf:7e:2b:bf:18:58:54:23:cc:4b:3d:7e:f4:63:79 u4\\@example.org laptop/u4\\@example.org\\@home\n78:cf:7e:2b:bf:18:58:54:23:cc:4b:3d:7e:f4:63:79 u4\\@example.org u4\\@example.org\n78:cf:7e:2b:bf:18:58:54:23:cc:4b:3d:7e:f4:63:79 u4\\@example.org u4\\@example.org\\@home\n8c:a6:c0:a5:71:85:0b:89:d3:08:97:22:ae:95:e1:bb u4\\@example.org zzz/guests/u2/u4\\@example.org\n78:cf:7e:2b:bf:18:58:54:23:cc:4b:3d:7e:f4:63:79 u4\\@example.org zzz/guests/u2/u4\\@example.org\\@foo\n8c:a6:c0:a5:71:85:0b:89:d3:08:97:22:ae:95:e1:bb u4\\@example.org zzz/guests/u3/u4\\@example.org\nfc:0f:eb:52:7a:d2:35:da:89:96:f5:15:0e:85:46:e7 u6\\@example.org zzz/guests/u3/u6\\@example.org\n\\n\\n\";\n\n# Now, u2 has two keys in his directory, but u2 can manage only one of\n# them, since the one added by the admin has two @ in it. Thus the key\n# added by admin is invisible to u2.\ntry \"ssh u2 ukm; ok\"; cmp \"Hello u2, you manage the following keys:\nfingerprint userid keyid\n8c:a6:c0:a5:71:85:0b:89:d3:08:97:22:ae:95:e1:bb u4\\@example.org u4\\@example.org\n\\n\\n\";\n\n# Since admin added key u6@example.org to the directory of u2, u2 is\n# also able to see it and, in fact, to manage it.\ntry \"ssh u3 ukm; ok\"; cmp \"Hello u3, you manage the following keys:\nfingerprint userid keyid\n8c:a6:c0:a5:71:85:0b:89:d3:08:97:22:ae:95:e1:bb u4\\@example.org u4\\@example.org\nfc:0f:eb:52:7a:d2:35:da:89:96:f5:15:0e:85:46:e7 u6\\@example.org u6\\@example.org\n\\n\\n\";\n\n###################################################################\n# Deletion of keys.\ntry \"\n DEF DEL = ssh %1 ukm del %2\n DEF DELOK = DEL %1 %2; ok\n DEF DELNOK = DEL %1 %2; !ok\n DEF DELNOMGR = DELNOK %1 %2; /FATAL: You are not managing the key /\n\";\n\n# Deletion requires a keyid.\ntry \"ssh u3 ukm del; !ok; /FATAL: keyid required/\";\n\n# u3 can, of course, not remove any unmanaged key.\ntry \"DELNOMGR u3 u2\";\n\n# But u3 can delete u4@example.org and u6@example.org. This will, of course,\n# not remove the key u4@example.org that u2 manages.\ntry \"\n DELOK u3 u4\\@example.org\n DELOK u3 u6\\@example.org\n\";\n\n# After having deleted u4@example.org, u3 cannot remove it again,\n# even though, u2 still manages that key.\ntry \"DELNOMGR u3 u4\\@example.org\";\n\n# Of course a super-key-manager can remove any (existing) key.\ntry \"\n DELOK admin zzz/guests/u2/u4\\@example.org\n DELNOK admin zzz/guests/u2/u4\\@example.org\n /FATAL: You are not managing the key zzz/guests/u2/u4\\@example.org./\n DELNOK admin zzz/guests/u2/u4\\@example.org\\@x\n /FATAL: You are not managing the key zzz/guests/u2/u4\\@example.org./\n DELOK admin zzz/guests/u2/u4\\@example.org\\@foo\n\";\n\n# As the admin could do that via pushing to the gitolite-admin manually,\n# it's also allowed to delete even non-guest keys.\ntry \"DELOK admin u3\";\n\n# Let's clean the environment again.\ntry \"\n DELOK admin laptop/u4\\@example.org\\@home\n DELOK admin laptop/u4\\@example.org\n DELOK admin u4\\@example.org\\@home\n DELOK admin u4\\@example.org\n ADDOK u3 admin u3\n \";\n\n# Currently the admin has just one key. It cannot be removed.\n# But after adding another key, deletion should work fine.\ntry \"\n DELNOK admin admin; /FATAL: You cannot delete your last key./\n ADDOK u6 admin second/admin; /Adding new public key for admin./\n DELOK admin admin\n DELNOK u6 admin; /FATAL: You are not managing the key admin./\n DELNOK u6 second/admin; /FATAL: You cannot delete your last key./\n ADDOK admin u6 admin; /Adding new public key for admin./\n DELOK u6 second/admin\n\";\n\n###################################################################\n# Selfkey management.\n\n# If self key management is not switched on in the .gitolite.rc file,\n# it's not allowed at all.\ntry \"ssh u2 ukm add \\@second; !ok; /FATAL: selfkey management is not enabled/\";\n\n# Let's enable it.\nsystem(\"sed -i \\\"/'UKM_CONFIG'=>/s/=>{/=>{'SELFKEY_MANAGEMENT'=>1,/\\\" $h/.gitolite.rc\");\n\n# And add self-key-managers to gitolite.conf\n# chdir(\"../gitolite-admin\") or die \"in `pwd`, could not cd ../g-a\";\ntry \"glt pull admin origin master; ok\";\nput \"|cut -c5- > conf/gitolite.conf\", '\n repo gitolite-admin\n RW+ = admin\n repo testing\n RW+ = @all\n @guest-key-managers = u2 u3\n @self-key-managers = u1 u2\n @creators = u2 u3\n repo pub/CREATOR/..*\n C = @creators\n RW+ = CREATOR\n RW = WRITERS\n R = READERS\n';\ntry \"\n git add conf keydir; ok\n git commit -m selfkey; ok; /master.* selfkey/\n\";\ntry \"PUSH admin; ok; gsh; /master -> master/; !/FATAL/\" or die text();\n\n# Now we can start with the tests.\n\n# Only self key managers are allowed to use selfkey management.\n# See variable @self-key-managers.\ntry \"ssh u3 ukm add \\@second; !ok; /FATAL: You are not a selfkey manager./\";\n\n# Cannot add keyid that are not alphanumeric.\ntry \"ssh u1 ukm add \\@second-key; !ok; /FATAL: keyid not allowed:/\";\n\n# Add a second key for u1, but leave it pending by not feeding in the\n# session key. The new user can login, but he/she lives under a quite\n# random gl_user name and thus is pretty much excluded from everything\n# except permissions given to @all. If this new id calls ukm without\n# providing the session key, this (pending) key is automatically\n# removed from the system.\n# If a certain keyid is in the system, then it cannot be added again.\ntry \"\n ADDOK u4 u1 \\@second\n ssh admin ukm; ok; /u1 zzz/self/u1/zzz-add-[a-z0-9]{32}-second-u1/\n ssh u1 ukm; ok; /u1 \\@second .pending add./\n ADDNOK u4 u1 \\@second; /FATAL: keyid already in use: \\@second/\n ssh u4 ukm; ok; /pending keyid deleted: \\@second/\n ssh admin ukm; ok; !/zzz/; !/second/\n\";\n\n# Not providing a proper ssh public key will abort. Providing a good\n# ssh public key, which is not a session key makes the key invalid.\n# The key will, therefore, be deleted by this operation.\ntry \"\n ADDOK u4 u1 \\@second\n echo fake|ssh u4 ukm; !ok; /FATAL: does not seem to be a valid pubkey/\n cat $pd/u5.pub | ssh u4 ukm; ok;\n /session key not accepted/\n /pending keyid deleted: \\@second/\n\";\n\n# True addition of a new selfkey is done via piping it to a second ssh\n# call that uses the new key to call ukm. Note that the first ssh must\n# have completed its job before the second ssh is able to successfully\n# log in. This can be done via sleep or via redirecting to a file and\n# then reading from it.\ntry \"\n # ADDOK u4 u1 \\@second | (sleep 2; ssh u4 ukm); ok\n ADD u4 u1 \\@second > session; ok\n cat session | ssh u4 ukm; ok; /pending keyid added: \\@second/\n\";\n\n# u1 cannot add his/her initial key, since that key can never be\n# confirmed via ukm, so it is forbidden altogether. In fact, u1 is not\n# allowed to add any key twice.\ntry \"\n ADDNOK u1 u1 \\@first\n /FATAL: You cannot add a key that already belongs to you./\n ADDNOK u4 u1 \\@first\n /FATAL: You cannot add a key that already belongs to you./\n\";\n\n# u1 also can add more keys, but not under an existing keyid. That can\n# be done by any of his/her identities (here we choose u4).\ntry \"\n ADDNOK u5 u1 \\@second; /FATAL: keyid already in use: \\@second/\n ADD u5 u4 \\@third > session; ok\n cat session | ssh u5 ukm; ok; /pending keyid added: \\@third/\n\";\n\n# u2 cannot add the same key, but is allowed to use the same name (@third).\ntry \"\n ADDNOK u5 u2 \\@third; /FATAL: cannot add key/\n /Same key is already available under another userid./\n ADD u6 u2 \\@third > session; ok\n cat session | ssh u6 ukm; ok; /pending keyid added: \\@third/\n\";\n\n# u6 can schedule his/her own key for deletion, but cannot actually\n# remove it. Trying to do so results in bringing back the key. Actual\n# deletion must be confirmed by another key.\ntry \"\n ssh u6 ukm del \\@third; /prepare deletion of key \\@third/\n ssh u2 ukm; ok; /u2 \\@third .pending del./\n ssh u6 ukm; ok; /undo pending deletion of keyid \\@third/\n ssh u6 ukm del \\@third; /prepare deletion of key \\@third/\n ssh u2 ukm del \\@third; ok; /pending keyid deleted: \\@third/\n\";\n\n# While in pending-deletion state, it's forbidden to add another key\n# with the same keyid. It's also forbidden to add a key with the same\n# fingerprint as the to-be-deleted key).\n# A new key under another keyid, is OK.\ntry \"\n ssh u1 ukm del \\@third; /prepare deletion of key \\@third/\n ADDNOK u4 u1 \\@third; /FATAL: keyid already in use: \\@third/\n ADDNOK u5 u1 \\@fourth;\n /FATAL: You cannot add a key that already belongs to you./\n ADD u6 u1 \\@fourth > session; ok\n ssh u1 ukm; ok;\n /u1 \\@second/\n /u1 \\@fourth .pending add./\n /u1 \\@third .pending del./\n\";\n# We can remove a pending-for-addition key (@fourth) by logging in\n# with a non-pending key. Trying to do anything with key u5 (@third)\n# will just bring it back to its normal state, but not change the\n# state of any other key. As already shown above, using u6 (@fourth)\n# without a proper session key, would remove it from the system.\n# Here we want to demonstrate that key u1 can delete u6 immediately.\ntry \"ssh u1 ukm del \\@fourth; /pending keyid deleted: \\@fourth/\";\n\n# The pending-for-deletion key @third can also be removed via the u4\n# (@second) key.\ntry \"ssh u4 ukm del \\@third; ok; /pending keyid deleted: \\@third/\";\n\n# Non-existing selfkeys cannot be deleted.\ntry \"ssh u4 ukm del \\@x; !ok; /FATAL: You are not managing the key \\@x./\";\n" }, { "path": "contrib/triggers/IP-check", "content": "#!/bin/bash\n\n# Check an IP before allowing access.\n\n# This is also a generic example of how to add arbitrary checks at the PRE_GIT\n# stage, in order to control fetch/clone as well, not just push operations\n# (VREFs, in contrast, only work for pushes).\n\n# Notice how repo-specific information is being passed to this code (bullet 3\n# below). For more on that, see:\n# https://gitolite.com/gitolite/dev-notes#appendix-1-repo-specific-environment-variables\n\n# Instructions:\n\n# 1. put this in an appropriate triggers directory (read about non-core\n# code at http://gitolite.com/gitolite/non-core for more on this; the\n# cookbook may also help here).\n\n# 2. add a line:\n# PRE_GIT => [ 'IP-check' ],\n# just before the \"ENABLE\" line in the rc file\n\n# 3. add a line like this to the \"repo ...\" section in gitolite.conf:\n# option ENV.IP_allowed = 1.2.3.0/24\n# take care that this expression is valid, in the sense that passing it\n# to 'ipcalc -n' will return the part before the \"/\". I.e., in this\n# example, 'ipcalc -n 1.2.3.0/24' should (and does) return 1.2.3.0.\n\n# ----\n\n[ -n \"$GL_OPTION_IP_allowed\" ] || exit 0\n\nexpected=${GL_OPTION_IP_allowed%/*}\n mask=${GL_OPTION_IP_allowed#*/}\n\ncurrent_ip=${SSH_CONNECTION%% *}\n\neval `ipcalc -n $current_ip/$mask`\n\n[ \"$expected\" == \"$NETWORK\" ] && exit 0\n\necho >&2 \"IP $current_ip does not match allowed block $GL_OPTION_IP_allowed\"\nexit 1\n" }, { "path": "contrib/triggers/file_mirror", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\n# Use an external (non-gitolite) mirror to backup gitolite repos. They will\n# be automatically kept uptodate as people push to your gitolite server. If\n# your server should die and you create a new one, you can quickly and easily\n# get everything back from the external mirror with a few simple commands.\n\n# -------------------------------------------------------------\n# SEE WARNINGS/CAVEATS AND INSTRUCTIONS AT THE END OF THIS FILE\n# -------------------------------------------------------------\n\n# ----------------------------------------------------------------------\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Easy;\n\nmy ( $trigger, $repo, $dummy, $op ) = @ARGV;\nexit 0 unless $trigger eq 'POST_GIT' or $trigger eq 'POST_CREATE';\nexit 0 if $trigger eq 'POST_GIT' and $op ne 'W';\n\nchdir(\"$rc{GL_REPO_BASE}/$repo.git\") or _die \"chdir failed: $!\\n\";\n\nmy %config = config( $repo, \"gitolite-options\\\\.mirror\\\\.extcopy\" );\nfor my $copy ( values %config ) {\n _do($copy);\n\n # processing one copy is sufficient for restoring!\n last if $trigger eq 'POST_CREATE';\n}\n\n# in shell, that would be something like:\n# gitolite git-config -r $repo gitolite-options\\\\.mirror\\\\.extcopy | cut -f3 | while read copy\n# do\n# ...\n\n# ----------------------------------------------------------------------\n\nsub _do {\n my $url = shift;\n\n if ( $trigger eq 'POST_CREATE' ) {\n # brand new repo just created; needs to be populated from mirror\n\n # For your urls you will need a way to somehow query the server and\n # ask if the repo is present; it's upto you how you do it.\n my $path = $url;\n $path =~ s(^file://)();\n return unless -d $path;\n\n # now fetch. Maybe we can put a \"-q\" in there?\n system( \"git\", \"fetch\", $url, \"+refs/*:refs/*\" );\n\n } elsif ( $trigger eq 'POST_GIT' ) {\n # someone just pushed; we need to update our mirrors\n\n # need to create the repo on the mirror. Again, it's upto you how you\n # make sure there's a repo on the mirror that can receive the push.\n make_repo($url); # in case it doesn't already exist\n\n # now push\n system( \"git\", \"push\", \"--mirror\", $url );\n }\n}\n\nsub make_repo {\n my $url = shift;\n # in this example, the URL is 'file:///...'; for other urls, presumably\n # the url tells you enough about how to *create* a repo.\n\n my $path = $url;\n $path =~ s(^file://)();\n return if -d $path;\n system( \"git\", \"init\", \"--bare\", $path );\n}\n\n__END__\n\nWARNINGS\n--------\n\n1. THIS IS SAMPLE CODE. You will AT LEAST have to customise the _do() and\n make_repo() functions above based on what your remote URLs are. For\n example, I don't even know how to create a repo from the command line if\n your external store is, say, github!\n\n2. THIS DOES NOT WORK FOR WILD REPOs. It can be made to work, with a few\n extra steps to backup and restore the \"gl-perms\" and \"gl-creator\" files.\n\n \"Left as an exercise for the reader!\"\n\nDESIGN NOTES\n------------\n\nThis is really just a combination of \"upstream\" (see src/triggers/upstream)\nand mirroring (gitolite mirroring does allow a copy to be non-gitolite, as\nlong as the ssh stuff is done the same way).\n\nThe main difference is that gitolite mirroring expects peers to all talk ssh,\nwhereas this method lets you use other protocols. Specifically, since this\nwhole thing was started off by someone wanting to put his repos on s3\n(apparently jgit can talk to s3 directly), you can modify the two functions to\ndeal with whatever remote server you have.\n\nLANGUAGE\n--------\n\nThis doesn't have to be in perl. Shell equivalent for the only gitolite\nspecific code is supplied; the rest of the code is fairly straightforward.\n\nSETUP\n-----\n\n1. Put this code into your LOCAL_CODE directory under \"triggers\"; see\n non-core.html for details.\n\n2. Add these lines to your rc file, just before the ENABLE line. (I'm\n assuming a v3.4 or later installation here).\n\n POST_CREATE => [ 'file_mirror' ],\n POST_GIT => [ 'file_mirror' ],\n\n3. Backup your rc file, since you may have other changes in it that you'll\n want to preserve.\n\n4. Do something like this in your gitolite.conf file:\n\n repo @all\n option mirror.extcopy-1 = file:///tmp/he1/%GL_REPO.git\n option mirror.extcopy-2 = file:///tmp/he2/%GL_REPO.git\n\n As you can see, since this is just for demo/test, we're using a couple of\n temp directories to serve as our \"remotes\" using the file:// protocol.\n\n5. Do a one-time manual sync of all the repos (subsequent syncs happen on\n each push):\n\n gitolite list-phy-repos | xargs -I xx gitolite trigger POST_GIT xx admin W\n\n (This is a little trick we're playing on the trigger stuff, but it should\n work fine. Just make sure that, if you have other things in your POST_GIT\n trigger list, they're not affected in some way. 'gitolite query-rc\n POST_GIT' will tell you what else you have.)\n\nThat takes care of the \"setup\" and \"regular backup\".\n\nRESTORE\n-------\n\n1. Install gitolite normally. You'll get the usual two repos.\n\n2. Restore the previously backed up rc file to replace the default one that\n gitolite created. At the very least, the rc file should have the\n POST_CREATE and POST_GIT entries.\n\n ---------------------------------------------------------\n IF YOU FORGET THIS STEP, NASTY THINGS WILL HAPPEN TO YOU!\n ---------------------------------------------------------\n\n3. Clone the admin repo from one of your backup servers to some temp dir. In\n our example,\n\n git clone /tmp/he1/gitolite-admin.git old-ga\n\n4. 'cd' to that clone and force push to your *new* admin repo:\n\n cd old-ga\n git push -f admin:gitolite-admin\n\nThat's it. As each repo gets created by the admin push, they'll get populated\nby the backed up stuff due to the POST_CREATE trigger.\n" }, { "path": "contrib/utils/ad_groups.sh", "content": "#!/bin/bash\n\n# author derived from: damien.nozay@gmail.com\n# author: Jonathan Gray\n\n# Given a username,\n# Provides a space-separated list of groups that the user is a member of.\n#\n# see http://gitolite.com/gitolite/conf.html#getting-user-group-info-from-ldap\n# GROUPLIST_PGM => /path/to/ldap_groups.sh\n\n# Be sure to add your domain CA to the trusted certificates in /etc/openldap/ldap.conf using the TLS_CACERT option or you'll get certificate validation errors\n\nldaphost='ldap://AD.DC1.local:3268,ldap://AD.DC2.local:3268,ldap://AD.DC3.local:3268'\nldapuser='git@domain.local'\nldappass='super.secret.password'\nbinddn='dc=domain,dc=local'\nusername=$1;\n\n# I don't assume your users share a common OU, so I search the entire domain\nldap_groups() {\n # Go fetch the full user CN as it could be anywhere inside the DN\n usercn=$(\n ldapsearch -ZZ -H ${ldaphost} -D ${ldapuser} -w ${ldappass} -b ${binddn} -LLL -o ldif-wrap=no \"(sAMAccountName=${username})\" \\\n | grep \"^dn:\" \\\n | perl -pe 's|dn: (.*?)|\\1|'\n )\n\n # Using a proprietary AD extension, let the AD Controller resolve all nested group memberships\n # http://ddkonline.blogspot.com/2010/05/how-to-recursively-get-group-membership.html\n # Also, substitute spaces in AD group names for '_' since gitolite expects a space separated list\n echo $(\n ldapsearch -ZZ -H ${ldaphost} -D ${ldapuser} -w ${ldappass} -b ${binddn} -LLL -o ldif-wrap=no \"(member:1.2.840.113556.1.4.1941:=${usercn})\" \\\n | grep \"^dn:\" \\\n | perl -pe 's|dn: CN=(.*?),.*|\\1|' \\\n | sed 's/ /_/g'\n )\n}\n\nldap_groups $@\n" }, { "path": "contrib/utils/gitolite-local", "content": "#!/bin/bash\n\n# ----------------------------------------------------------------------\n# change these lines to suit\ntestconf=$HOME/GITOLITE-TESTCONF\ngitolite_url=https://github.com/sitaramc/gitolite\n # change it to something local for frequent use\n # gitolite_url=file:///tmp/gitolite.git\n\n# ----------------------------------------------------------------------\n# Usage: gitolite-local \n#\n# Test your gitolite.conf rule lists on your LOCAL machine (without even\n# pushing to the server!)\n#\n# (one-time)\n#\n# 1. put this code somewhere in your $PATH if you wish\n# 2. edit the line near the top of the script if you want to use some other\n# directory than the default, for \"testconf\".\n# 2. prepare the \"testconf\" directory by running:\n# gitolite-local prep\n#\n# (lather, rinse, repeat)\n#\n# 1. edit the conf (see notes below for more)\n# gitolite-local edit\n# 2. compile the conf\n# gitolite-local compile\n# 3. check permissions using \"info\" command:\n# gitolite-local info USERNAME\n# 4. check permissions using \"access\" command:\n# gitolite-local access \n# 5. clone, fetch, and push if you like!\n# gitolite-local clone \n# gitolite-local fetch \n# gitolite-local push \n#\n# note on editing the conf: you don't have to use the edit command; you can\n# also directly edit '.gitolite/conf/gitolite.conf' in the 'testconf'\n# directory. You'll need to do that if your gitolite conf consists of more\n# than just one file (like if you have includes, etc.)\n#\n# note on the clone command: most of the options won't work for clone, unless\n# git is ok with them being placed *after* the repo name.\n\n# ----------------------------------------------------------------------\ndie() { echo \"$@\" >&2; exit 1; }\nusage() { perl -lne 'print substr($_, 2) if /^# Usage/../^$/' < $0; exit 1; }\n[ -z \"$1\" ] && usage\n\n# ----------------------------------------------------------------------\nif [ $1 == prep ]\nthen\n set -e\n\n [ -d $testconf ] && die \"directory '$testconf' already exists\"\n\n mkdir $testconf\n cd $testconf\n\n export HOME=$PWD\n\n echo getting gitolite source...\n git clone $gitolite_url gitolite\n echo\n\n echo installing gitolite...\n gitolite/install >/dev/null\n echo\n\n echo setting up gitolite...\n export PATH=$PWD/gitolite/src:$PATH\n gitolite setup -a admin\n echo\n\n exit 0\nfi\n\nod=$PWD\ncd $testconf\nexport HOME=$PWD\nexport PATH=$PWD/gitolite/src:$PATH\n\nif [ $1 = edit ]\nthen\n editor=${EDITOR:-vim}\n $editor .gitolite/conf/gitolite.conf\nelif [ $1 = compile ]\nthen\n gitolite compile\nelif [ $1 = compile+ ]\nthen\n gitolite compile\\; gitolite trigger POST_COMPILE\nelif [ $1 = info ]\nthen\n shift\n user=$1\n shift\n\n GL_USER=$user gitolite info \"$@\"\nelif [ $1 = access ]\nthen\n shift\n\n gitolite access \"$@\"\nelif [ $1 = clone ]\nthen\n shift\n export G3T_USER=$1\n shift\n\n cd $od\n export GL_BINDIR=$HOME/gitolite/t\n # or you could do it the long way, using 'gitolite query-rc GL_BINDIR'\n repo=$1; shift\n git clone --upload-pack=$GL_BINDIR/gitolite-upload-pack file:///$repo \"$@\"\nelif [ $1 = fetch ]\nthen\n shift\n export G3T_USER=$1\n shift\n\n cd $od\n export GL_BINDIR=$HOME/gitolite/t\n git fetch --upload-pack=$GL_BINDIR/gitolite-upload-pack \"$@\"\nelif [ $1 = push ]\nthen\n shift\n export G3T_USER=$1\n shift\n\n cd $od\n export GL_BINDIR=$HOME/gitolite/t\n git push --receive-pack=$GL_BINDIR/gitolite-receive-pack \"$@\"\nfi\n" }, { "path": "contrib/utils/ipa_groups.pl", "content": "#!/usr/bin/env perl\n#\n# ipa_groups.pl\n#\n# See perldoc for usage\n#\nuse Net::LDAP;\nuse Net::LDAP::Control::Paged;\nuse Net::LDAP::Constant qw(LDAP_CONTROL_PAGED);\nuse strict;\nuse warnings;\n\nmy $usage = < 'require',\n cafile => '/etc/pki/tls/certs/prod.example.net_CA.crt'\n);\n\n# Base DN to search\nmy $base_dn = 'dc=prod,dc=example,dc=net';\n\n# User for binding to LDAP server with\nmy $user = 'uid=svc_gitolite_bind,cn=sysaccounts,cn=etc,dc=prod,dc=example,dc=net';\nmy $pass = 'reallysecurepasswordstringhere';\n\n## Below variables should not need to be changed under normal circumstances\n\n# OU where groups are located. Anything return that is not within this OU is\n# removed from results. This OU is static on FreeIPA so will only need updating\n# if you want to support other LDAP servers. This is a regex so can be set to\n# anything you want (E.G '.*').\nmy $groups_ou = qr/cn=groups,cn=accounts,${base_dn}$/;\n\n# strip path - if you want to return the full path of the group object then set\n# this to 0\nmy $strip_group_paths = 1;\n\n# Number of seconds before timeout (for each query)\nmy $timeout=5;\n\n# user object class\nmy $user_oclass = 'person';\n\n# group attribute\nmy $group_attrib = 'memberOf';\n\n## END OF CONFIG SECTION\n\n# Catch timeouts here\n$SIG{'ALRM'} = sub {\n die \"LDAP queries timed out\";\n};\n\nalarm($timeout);\n\n# try each server until timeout is reached, has very fast failover if a server\n# is totally unreachable\nmy $ldap = Net::LDAP->new(@ldap_hosts, %ldap_opts) ||\n die \"Error connecting to specified servers: $@ \\n\";\n\nmy $mesg = $ldap->bind(\n dn => $user,\n password => $pass\n);\n\nif ($mesg->code()) {\n die (\"error:\", $mesg->code(),\"\\n\",\n \"error name: \",$mesg->error_name(),\"\\n\",\n \"error text: \",$mesg->error_text(),\"\\n\");\n}\n\n# How many LDAP query results to grab for each paged round\n# Set to under 1000 to limit load on LDAP server\nmy $page = Net::LDAP::Control::Paged->new(size => 500);\n\n# @queries is an array or array references. We initially fill it up with one\n# arrayref (The first LDAP search) and then add more during the execution.\n# First start by resolving the group.\nmy @queries = [ ( base => $base_dn,\n filter => \"(&(objectClass=${user_oclass})(uid=${uid}))\",\n control => [ $page ],\n) ];\n\n# array to store groups matching $groups_ou\nmy @verified_groups;\n\n# Loop until @queries is empty...\nforeach my $queryref (@queries) {\n\n # set cookie for paged querying\n my $cookie;\n alarm($timeout);\n while (1) {\n # Perform search\n my $mesg = $ldap->search( @{$queryref} );\n\n foreach my $entry ($mesg->entries) {\n my @groups = $entry->get_value($group_attrib);\n # find any groups matching $groups_ou regex and push onto $verified_groups array\n foreach my $group (@groups) {\n if ($group =~ /$groups_ou/) {\n push @verified_groups, $group;\n }\n }\n }\n\n # Only continue on LDAP_SUCCESS\n $mesg->code and last;\n\n # Get cookie from paged control\n my($resp) = $mesg->control(LDAP_CONTROL_PAGED) or last;\n $cookie = $resp->cookie or last;\n\n # Set cookie in paged control\n $page->cookie($cookie);\n } # END: while(1)\n\n # Reset the page control for the next query\n $page->cookie(undef);\n\n if ($cookie) {\n # We had an abnormal exit, so let the server know we do not want any more\n $page->cookie($cookie);\n $page->size(0);\n $ldap->search( @{$queryref} );\n # Then die\n die(\"LDAP query unsuccessful\");\n }\n\n} # END: foreach my $queryref (...)\n\n# we're assuming that the group object looks something like\n# cn=name,cn=groups,cn=accounts,dc=X,dc=Y and there are no ',' chars in group\n# names\nif ($strip_group_paths) {\n for (@verified_groups) { s/^cn=([^,]+),.*$/$1/g };\n}\n\nforeach my $verified (@verified_groups) {\n print $verified . \"\\n\";\n}\n\nalarm(0);\n\n__END__\n\n=head1 NAME\n\nipa_groups.pl\n\n=head2 VERSION\n\n0.1.1\n\n=head2 DESCRIPTION\n\nConnects to one or more FreeIPA-based LDAP servers in a first-reachable fashion and returns a newline separated list of groups for a given uid. Uses memberOf attribute and thus supports nested groups.\n\n=head2 AUTHOR\n\nRichard Clark \n\n=head2 FreeIPA vs Generic LDAP\n\nThis script uses regular LDAP, but is focussed on support for FreeIPA, where users and groups are generally contained within single OUs, and memberOf attributes within the user object are enumerated with a recursive list of groups that the user is a member of.\n\nIt is mostly impossible to provide generic out of the box LDAP support due to varying schemas, supported extensions and overlays between implementations.\n\n=head2 CONFIGURATION\n\n=head3 LDAP Bind Account \n\nTo setup an LDAP bind user in FreeIPA, create a svc_gitolite_bind.ldif file along the following lines:\n\n dn: uid=svc_gitolite_bind,cn=sysaccounts,cn=etc,dc=prod,dc=example,dc=net\n changetype: add\n objectclass: account\n objectclass: simplesecurityobject\n uid: svc_gitolite_bind\n userPassword: reallysecurepasswordstringhere\n passwordExpirationTime: 20150201010101Z\n nsIdleTimeout: 0\n\nThen create the service account user, using ldapmodify authenticating as the the directory manager account (or other acccount with appropriate privileges to the sysaccounts OU):\n\n $ ldapmodify -h auth-ldap-001.prod.example.net -Z -x -D \"cn=Directory Manager\" -W -f svc_gitolite_bind.ldif\n\n=head3 Required Configuration\n\nThe following variables within the C<## CONFIG SECTION ##> need to be configured before the script will work.\n\nC<@ldap_hosts> - Should be set to an array of URIs or hosts to connect to. Net::LDAP will attempt to connect to each host in this list and stop on the first reachable server. The example shows TLS-supported URIs, if you want to use plain-text LDAP then set the protocol part of the URI to LDAP:// or just provide hostnames as this is the default behavior for Net::LDAP.\n\nC<%ldap_opts> - To use LDAP-over-TLS, provide the CA certificate for your LDAP servers. To use plain-text LDAP, then empty this hash of it's values or provide other valid arguments to Net::LDAP.\n\nC<%base_dn> - This can either be set to the 'true' base DN for your directory, or alternatively you can set it the the OU that your users are located in (E.G cn=users,cn=accounts,dc=prod,dc=example,dc=net).\n\nC<$user> - Provide the full Distinguished Name of your directory bind account as configured above.\n\nC<$pass> - Set to password of your directory bind account as configured above.\n\n=head3 Optional Configuration\n\nC<$groups_ou> - By default this is a regular expression matching the default groups OU. Any groups not matching this regular expression are removed from the search results. This is because FreeIPA enumerates non-user type groups (E.G system, sudoers, policy and other types) within the memberOf attribute. To change this behavior, set C<$groups_ou> to a regex matching anything you want (E.G: '.*').\n\nC<$strip_group_paths> - If this is set to perl boolean false (E.G '0') then groups will be returned in DN format. Default is true, so just the short/CN value is returned.\n\nC<$timeout> - Number of seconds to wait for an LDAP query before determining that it has failed and trying the next server in the list. This does not affect unreachable servers, which are failed immediately.\n\nC<$user_oclass> - Object class of the user to search for.\n\nC<$group_attrib> - Attribute to search for within the user object that denotes the membership of a group.\n\n=cut\n\n" }, { "path": "contrib/utils/ldap_groups.sh", "content": "#!/bin/bash\n\n# author: damien.nozay@gmail.com\n\n# Given a username,\n# Provides a space-separated list of groups that the user is a member of.\n#\n# see http://gitolite.com/gitolite/conf.html#getting-user-group-info-from-ldap\n# GROUPLIST_PGM => /path/to/ldap_groups.sh\n\nldap_groups() {\n username=$1;\n # this relies on openldap / pam_ldap to be configured properly on your\n # system. my system allows anonymous search.\n echo $(\n ldapsearch -x -LLL \"(&(objectClass=posixGroup)(memberUid=${username}))\" cn \\\n | grep \"^cn\" \\\n | cut -d' ' -f2\n );\n}\n\nldap_groups $@\n" }, { "path": "contrib/utils/rc-format-v3.4", "content": "#!/usr/bin/perl\n\n# help with rc file format change at v3.4 -- help upgrade v3 rc files from\n# v3.3 and below to the new v3.4 and above format\n\n# once you upgrade gitolite past 3.4, you may want to use the new rc file\n# format, because it's really much nicer (just to recap: the old format will\n# still work, in fact internally the new format gets converted to the old\n# format before actually being used. However, the new format makes it much\n# easier to enable and disable features).\n\n# PLEASE SEE WARNINGS BELOW\n\n# this program helps you upgrade your rc file.\n\n# STEPS\n# cd gitolite-source-repo-clone\n# contrib/utils/upgrade-rc33 /path/to/old.gitolite.rc > new.gitolite.rc\n\n# WARNINGS\n# make sure you also READ ALL ERROR/WARNING MESSAGES GENERATED\n# make sure you EXAMINE THE FILE AND CHECK THAT EVERYTHING LOOKS GOOD before using it\n# be especially careful about\n# variables which contains single/double quotes or other special characters\n# variables that stretch across multiple lines\n# features which take arguments (like 'renice')\n# new features you've enabled which don't exist in the default rc\n\n# ----------------------------------------------------------------------\n\nuse strict;\nuse warnings;\nuse 5.10.0;\nuse Cwd;\nuse Data::Dumper;\n$Data::Dumper::Terse = 1;\n$Data::Dumper::Indent = 1;\n$Data::Dumper::Sortkeys = 1;\n\nBEGIN {\n $ENV{HOME} = getcwd;\n $ENV{HOME} .= \"/.home.rcupgrade.$$\";\n mkdir $ENV{HOME} or die \"mkdir '$ENV{HOME}': $!\\n\";\n}\n\nEND {\n system(\"rm -rf ./.home.rcupgrade.$$\");\n}\n\nuse lib \"./src/lib\";\nuse Gitolite::Rc;\n{\n no warnings 'redefine';\n sub Gitolite::Common::gl_log { }\n}\n\n# ----------------------------------------------------------------------\n\n# everything happens inside a fresh v3.6.1+ gitolite clone; no other\n# directories are used.\n\n# the old rc file to be migrated is somewhere *else* and is supplied as a\n# command line argument.\n\n# ----------------------------------------------------------------------\n\nmy $oldrc = shift or die \"need old rc filename as arg-1\\n\";\n\n{\n\n package rcup;\n do $oldrc;\n}\n\nmy %oldrc;\n{\n no warnings 'once';\n %oldrc = %rcup::RC;\n}\n\ndelete $rcup::{RC};\n{\n my @extra = sort keys %rcup::;\n warn \"**** WARNING ****\\nyou have variables declared outside the %RC hash; you must handle them manually\\n\" if @extra;\n}\n\n# this is the new rc text being built up\nmy $newrc = glrc('default-text');\n\n# ----------------------------------------------------------------------\n\n# default disable all features in newrc\nmap { disable( $_, 'sq' ) } (qw(help desc info perms writable ssh-authkeys git-config daemon gitweb));\n# map { disable($_, '') } (qw(GIT_CONFIG_KEYS));\n\nset_s('HOSTNAME');\nset_s( 'UMASK', 'num' );\nset_s( 'GIT_CONFIG_KEYS', 'sq' );\nset_s( 'LOG_EXTRA', 'num' );\nset_s( 'DISPLAY_CPU_TIME', 'num' );\nset_s( 'CPU_TIME_WARN_LIMIT', 'num' );\nset_s('SITE_INFO');\n\nset_s('LOCAL_CODE');\n\nif ( $oldrc{WRITER_CAN_UPDATE_DESC} ) {\n die \"tell Sitaram he changed the default rc too much\" unless $newrc =~ /rc variables used by various features$/m;\n $newrc =~ s/(rc variables used by various features\\n)/$1\\n # backward compat\\n WRITER_CAN_UPDATE_DESC => 1,\\n/;\n\n delete $oldrc{WRITER_CAN_UPDATE_DESC};\n}\n\nif ( $oldrc{ROLES} ) {\n my $t = '';\n for my $r ( sort keys %{ $oldrc{ROLES} } ) {\n $t .= ( \" \" x 8 ) . $r . ( \" \" x ( 28 - length($r) ) ) . \"=> 1,\\n\";\n }\n $newrc =~ s/(ROLES *=> *\\{\\n).*?\\n( *\\},)/$1$t$2/s;\n\n delete $oldrc{ROLES};\n}\n\nif ( $oldrc{DEFAULT_ROLE_PERMS} ) {\n warn \"DEFAULT_ROLE_PERMS has been replaced by per repo option\\nsee http://gitolite.com/gitolite/wild.html\\n\";\n delete $oldrc{DEFAULT_ROLE_PERMS};\n}\n\n# the following is a bit like the reverse of what the new Rc.pm does...\n\nfor my $l ( split /\\n/, $Gitolite::Rc::non_core ) {\n next if $l =~ /^ *#/ or $l !~ /\\S/;\n\n my ( $name, $where, $module ) = split ' ', $l;\n $module = $name if $module eq '.';\n ( $module = $name ) .= \"::\" . lc($where) if $module eq '::';\n\n # if you find $module as an element of $where, enable $name\n enable($name) if miw( $module, $where );\n}\n\n# now deal with commands\nif ( $oldrc{COMMANDS} ) {\n for my $c ( sort keys %{ $oldrc{COMMANDS} } ) {\n if ( $oldrc{COMMANDS}{$c} == 1 ) {\n enable($c);\n # we don't handle anything else right (and so far only git-annex\n # is affected, as far as I remember)\n\n delete $oldrc{COMMANDS}{$c};\n }\n }\n}\n\nprint $newrc;\n\nfor my $w (qw(INPUT POST_COMPILE PRE_CREATE ACCESS_1 POST_GIT PRE_GIT ACCESS_2 POST_CREATE SYNTACTIC_SUGAR)) {\n delete $oldrc{$w} unless scalar( @{ $oldrc{$w} } );\n}\ndelete $oldrc{COMMANDS} unless scalar keys %{ $oldrc{COMMANDS} };\n\nexit 0 unless %oldrc;\n\nwarn \"the following parts of the old rc were NOT converted:\\n\";\nprint STDERR Dumper \\%oldrc;\n\n# ----------------------------------------------------------------------\n\n# set scalars that the new file defaults to \"commented out\"\nsub set_s {\n my ( $key, $type ) = @_;\n $type ||= '';\n return unless exists $oldrc{$key};\n\n # special treatment for UMASK\n $oldrc{$key} = substr( \"00\" . sprintf( \"%o\", $oldrc{$key} ), -4 ) if ( $key eq 'UMASK' );\n\n $newrc =~ s/# $key /$key /; # uncomment if needed\n if ( $type eq 'num' ) {\n $newrc =~ s/$key ( *=> *).*/$key $1$oldrc{$key},/;\n } elsif ( $type eq 'sq' ) {\n $newrc =~ s/$key ( *=> *).*/$key $1'$oldrc{$key}',/;\n } else {\n $newrc =~ s/$key ( *=> *).*/$key $1\"$oldrc{$key}\",/;\n }\n\n delete $oldrc{$key};\n}\n\nsub disable {\n my ( $key, $type ) = @_;\n if ( $type eq 'sq' ) {\n $newrc =~ s/^( *)'$key'/$1# '$key'/m;\n } else {\n $newrc =~ s/^( *)$key\\b/$1# $key/m;\n }\n}\n\nsub enable {\n my $key = shift;\n $newrc =~ s/^( *)# *'$key'/$1'$key'/m;\n return if $newrc =~ /^ *'$key'/m;\n $newrc =~ s/(add new commands here.*\\n)/$1 '$key',\\n/;\n}\n\nsub miw {\n my ( $m, $w ) = @_;\n return 0 unless $oldrc{$w};\n my @in = @{ $oldrc{$w} };\n my @out = grep { !/^$m$/ } @{ $oldrc{$w} };\n $oldrc{$w} = \\@out;\n return not scalar(@in) == scalar(@out);\n}\n" }, { "path": "contrib/utils/testconf", "content": "#!/bin/bash\n\n# this is meant to be run on your *client* (where you edit and commit files\n# in a gitolite-admin *working* repo), not on the gitolite server.\n#\n# TO USE\n# ======\n\n# To use this, first upgrade gitolite to the latest on the server; you need at\n# least v3.6.7.\n#\n# Then, on the client:\n#\n# 1. copy this file (contrib/utils/testconf in the latest gitolite) to\n# somewhere in your $PATH\n# 2. modify the following lines if you wish (default should be fine for\n# most people):\n\n # a semi-permanent area to play in (please delete it manually if you want to start afresh).\n testconf=$HOME/GITOLITE-TESTCONF\n # the gitolite source code\n gitolite_url=https://github.com/sitaramc/gitolite\n\n# 3. go to your gitolite-admin clone and make suitable changes; see example\n# below. No need to push to the server, yet.\n# 4. run 'testconf`\n#\n# CAVEAT: include files are not handled the same way gitolite parsing handles\n# them -- we just cat all the conf files together, in sorted order.\n#\n# If the tests ran OK, push your changes to the server as usual.\n\n# EXAMPLE changes to gitolite.conf\n# ================================\n# Say you have these rules in the conf file:\n#\n# repo foo\n# R = u1\n# RW = u2\n# RW+ = u3\n#\n# To create test code for this, add the following lines to the conf file.\n#\n# =begin testconf\n# # you can put arbitrary bash code here, but a simple example follows\n#\n# ok() { \"$@\" && echo ok || echo \"not ok ($*)\"; }\n# nok() { ! \"$@\" && echo ok || echo \"not ok ($*)\"; }\n#\n# ok gitolite access -q foo u1 R\n# nok gitolite access -q foo u1 W\n#\n# ok gitolite access -q foo u2 W\n# nok gitolite access -q foo u2 +\n#\n# ok gitolite access -q foo u3 +\n# =end\n#\n# Note that you can actually put in any bash code between the 'begin' and\n# 'end' lines; the above is just a useful sample/template.\n#\n# Because of the 'begin' and 'end' lines, gitolite will ignore those lines\n# when processing the conf file ON THE SERVER.\n#\n# (optional) TAP compliance\n# =========================\n# if you add a line 'echo 1..5' (in this case, since there are 5 ok/nok lines;\n# you will certainly have more) to the top the file, you can run\n#\n# prove `which testconf`\n#\n# which will give you a much nicer output. The only issue is if you have\n# include files, you will need to put that in the file whose name is sorted\n# first!\n#\n# Using a non-default \".gitolite.rc\"\n# ==================================\n#\n# If your conf needs a non-default `~/.gitolite.rc`, copy the file you need as\n# \"testconf.gitolite.rc\" in the root directory of the gitolite-admin clone\n# where you are running \"testconf\". (Whether you commit this file to the\n# gitolite-admin repo, or keep it local/untracked, is your call).\n\n# ----------------------------------------------------------------------\nod=$PWD\n\n# prep\n\nmkdir -p $testconf\ncd $testconf\n\nexport HOME=$PWD\nexport PATH=$PWD/gitolite/src:$PATH\n\n[ -d gitolite ] || {\n\n echo getting gitolite source...\n git clone $gitolite_url gitolite\n echo\n\n echo installing gitolite...\n gitolite/install >/dev/null\n echo\n\n echo setting up gitolite...\n gitolite setup -a admin\n echo\n\n}\n\n# copy conf from $od\n\nrm -rf $testconf/.gitolite/conf\nmkdir -p $testconf/.gitolite/conf\ncp -a $od/conf/* $testconf/.gitolite/conf/\n\n# copy rc from $od, if it exists\n[ -f $od/testconf.gitolite.rc ] && cp $od/testconf.gitolite.rc $testconf/.gitolite.rc\n\n# compile+\n\ngitolite compile\ngitolite trigger POST_COMPILE\n\n# snarf bits of code from conf files and run them\n\ncat `find $testconf/.gitolite/conf -type f -name \"*.conf\" | sort` |\n perl -ne '\n print if /^=begin testconf$/ .. /^=end$/ and not /^=(begin|end)/;\n ' | /bin/bash\n" }, { "path": "contrib/vim/indent/gitolite.vim", "content": "\" Vim indent file\n\" Language:\tgitolite configuration\n\" URL:\t\thttps://github.com/sitaramc/gitolite/blob/master/contrib/vim/indent/gitolite.vim\n\"\t(https://raw.githubusercontent.com/sitaramc/gitolite/master/contrib/vim/indent/gitolite.vim)\n\" Maintainer:\tSitaram Chamarty \n\" (former Maintainer:\tTeemu Matilainen )\n\" Last Change:\t2017 Oct 05\n\nif exists(\"b:did_indent\")\n finish\nendif\nlet b:did_indent = 1\n\nsetlocal autoindent\nsetlocal indentexpr=GetGitoliteIndent()\nsetlocal indentkeys=o,O,*,!^F,=repo,\\\",=\n\n\" Only define the function once.\nif exists(\"*GetGitoliteIndent\")\n finish\nendif\n\nlet s:cpo_save = &cpo\nset cpo&vim\n\nfunction! GetGitoliteIndent()\n let prevln = prevnonblank(v:lnum-1)\n let pline = getline(prevln)\n let cline = getline(v:lnum)\n\n if cline =~ '^\\s*\\(C\\|R\\|RW\\|RW+\\|RWC\\|RW+C\\|RWD\\|RW+D\\|RWCD\\|RW+CD\\|-\\)[ \\t=]'\n return shiftwidth()\n elseif cline =~ '^\\s*config\\s'\n return shiftwidth()\n elseif cline =~ '^\\s*option\\s'\n return shiftwidth()\n elseif pline =~ '^\\s*repo\\s' && cline =~ '^\\s*\\(#.*\\)\\?$'\n return shiftwidth()\n elseif cline =~ '^\\s*#'\n return indent(prevln)\n elseif cline =~ '^\\s*$'\n return -1\n else\n return 0\n endif\nendfunction\n\nlet &cpo = s:cpo_save\nunlet s:cpo_save\n" }, { "path": "contrib/vim/syntax/gitolite.vim", "content": "\" Vim syntax file\n\" Language:\tgitolite configuration\n\" URL:\t\thttps://github.com/sitaramc/gitolite/blob/master/contrib/vim/syntax/gitolite.vim\n\"\t(https://raw.githubusercontent.com/sitaramc/gitolite/master/contrib/vim/syntax/gitolite.vim)\n\" Maintainer:\tSitaram Chamarty \n\" (former Maintainer:\tTeemu Matilainen )\n\" Last Change:\t2017 Oct 05\n\nif exists(\"b:current_syntax\")\n finish\nendif\n\nlet s:cpo_save = &cpo\nset cpo&vim\n\n\" this seems to be the best way, for now.\nsyntax sync fromstart\n\n\" ---- common stuff\n\nsyn match gitoliteGroup '@\\S\\+'\n\nsyn match gitoliteComment '#.*' contains=gitoliteTodo\nsyn keyword gitoliteTodo TODO FIXME XXX NOT contained\n\n\" ---- main section\n\n\" catch template-data syntax appearing outside template-data section\nsyn match gitoliteRepoError '^\\s*repo.*='\nsyn match gitoliteRepoError '^\\s*\\S\\+\\s*=' \" this gets overridden later when first word is a perm, don't worry\n\n\" normal gitolite group and repo lines\nsyn match gitoliteGroupLine '^\\s*@\\S\\+\\s*=\\s*\\S.*$' contains=gitoliteGroup,gitoliteComment\nsyn match gitoliteRepoLine '^\\s*repo\\s\\+[^=]*$' contains=gitoliteRepo,gitoliteGroup,gitoliteComment\nsyn keyword gitoliteRepo repo contained\n\nsyn keyword gitoliteSpecialRepo CREATOR\n\n\" normal gitolite rule lines\nsyn match gitoliteRuleLine '^\\s*\\(-\\|C\\|R\\|RW+\\?C\\?D\\?\\)\\s[^#]*' contains=gitoliteRule,gitoliteCreateRule,gitoliteDenyRule,gitoliteRefex,gitoliteUsers,gitoliteGroup\nsyn match gitoliteRule '\\(^\\s*\\)\\@<=\\(-\\|C\\|R\\|RW+\\?C\\?D\\?\\)\\s\\@=' contained\nsyn match gitoliteRefex '\\(^\\s*\\(-\\|R\\|RW+\\?C\\?D\\?\\)\\s\\+\\)\\@<=\\S.\\{-}\\(\\s*=\\)\\@=' contains=gitoliteSpecialRefex\nsyn match gitoliteSpecialRefex 'NAME/'\nsyn match gitoliteSpecialRefex '/USER/'\nsyn match gitoliteCreateRule '\\(^\\s*C\\s.*=\\s*\\)\\@<=\\S[^#]*[^# ]' contained contains=gitoliteGroup\nsyn match gitoliteDenyRule '\\(^\\s*-\\s.*=\\s*\\)\\@<=\\S[^#]*[^# ]' contained\n\n\" normal gitolite config (and similar) lines\nsyn match gitoliteConfigLine '^\\s*\\(config\\|option\\|include\\|subconf\\)\\s[^#]*' contains=gitoliteConfigKW,gitoliteConfigKey,gitoliteConfigVal,gitoliteComment\nsyn keyword gitoliteConfigKW config option include subconf contained\nsyn match gitoliteConfigKey '\\(\\(config\\|option\\)\\s\\+\\)\\@<=[^ =]*' contained\nsyn match gitoliteConfigVal '\\(=\\s*\\)\\@<=\\S.*' contained\n\n\" ---- template-data section\n\nsyn region gitoliteTemplateLine matchgroup=PreProc start='^=begin template-data$' end='^=end$' contains=gitoliteTplRepoLine,gitoliteTplRoleLine,gitoliteGroup,gitoliteComment,gitoliteTplError\n\nsyn match gitoliteTplRepoLine '^\\s*repo\\s\\+\\S.*=.*' contained contains=gitoliteTplRepo,gitoliteTplTemplates,gitoliteGroup\nsyn keyword gitoliteTplRepo repo contained\nsyn match gitoliteTplTemplates '\\(=\\s*\\)\\@<=\\S.*' contained contains=gitoliteGroup,gitoliteComment\n\nsyn match gitoliteTplRoleLine '^\\s*\\S\\+\\s*=\\s*.*' contained contains=gitoliteTplRole,gitoliteGroup,gitoliteComment\nsyn match gitoliteTplRole '\\S\\+\\s*='he=e-1 contained\n\n\" catch normal gitolite rules appearing in template-data section\nsyn match gitoliteTplError '^\\s*repo[^=]*$' contained\nsyn match gitoliteTplError '^\\s*\\(-\\|R\\|RW+\\?C\\?D\\?\\)\\s'he=e-1 contained\nsyn match gitoliteTplError '^\\s*\\(config\\|option\\|include\\|subconf\\)\\s'he=e-1 contained\nsyn match gitoliteTplError '^\\s*@\\S\\+\\s*=' contained contains=NONE\n\nhi def link gitoliteGroup Identifier\nhi def link gitoliteComment Comment\nhi def link gitoliteTodo ToDo\nhi def link gitoliteRepoError Error\nhi def link gitoliteGroupLine PreProc\nhi def link gitoliteRepo Keyword\nhi def link gitoliteSpecialRepo PreProc\nhi def link gitoliteRule Keyword\nhi def link gitoliteCreateRule PreProc\nhi def link gitoliteDenyRule WarningMsg\nhi def link gitoliteRefex Constant\nhi def link gitoliteSpecialRefex PreProc\nhi def link gitoliteConfigKW Keyword\nhi def link gitoliteConfigKey Identifier\nhi def link gitoliteConfigVal String\nhi def link gitoliteTplRepo Keyword\nhi def link gitoliteTplTemplates Constant\nhi def link gitoliteTplRole Constant\nhi def link gitoliteTplError Error\n\nlet b:current_syntax = \"gitolite\"\n\nlet &cpo = s:cpo_save\nunlet s:cpo_save\n" }, { "path": "convert-gitosis-conf", "content": "#!/usr/bin/perl -w\n#\n# migrate gitosis.conf to gitolite.conf format\n#\n# Based on gl-conf-convert by: Sitaram Chamarty\n# Rewritten by: Behan Webster \n#\n\nuse strict;\nuse warnings;\n\nif (not @ARGV and -t or @ARGV and $ARGV[0] eq '-h') {\n print \"Usage:\\n gl-conf-convert < gitosis.conf > gitolite.conf\\n(please see the documentation for details)\\n\";\n exit 1;\n}\n\nmy @comments = ();\nmy $groupname;\nmy %groups;\nmy $reponame;\nmy %repos;\n\nwhile (<>)\n{\n # not supported\n if (/^repositories *=/ or /^map /) {\n print STDERR \"not supported: $_\";\n s/^/NOT SUPPORTED: /;\n print;\n next;\n }\n\n # normalise whitespace to help later regexes\n chomp;\n s/\\s+/ /g;\n s/ ?= ?/ = /;\n s/^ //;\n s/ $//;\n\n if (/^\\s*$/ and @comments > 1) {\n @{$repos{$reponame}{comments}} = @comments if $reponame;\n @{$groups{$groupname}{comments}} = @comments if $groupname;\n @comments = ();\n } elsif (/^\\s*#/) {\n push @comments, $_;\n } elsif (/^\\[repo\\s+(.*?)\\]$/) {\n $groupname = '';\n $reponame = $1;\n $reponame =~ s/\\.git$//;\n } elsif (/^\\[gitosis\\]$/) {\n $groupname = '';\n $reponame = '@all';\n } elsif (/^gitweb\\s*=\\s*yes/i) {\n push @{$repos{$reponame}{R}}, 'gitweb';\n } elsif (/^daemon\\s*=\\s*yes/i) {\n push @{$repos{$reponame}{R}}, 'daemon';\n } elsif (/^description\\s*=\\s*(.+?)$/) {\n $repos{$reponame}{desc} = $1;\n } elsif (/^owner\\s*=\\s*(.+?)$/) {\n $repos{$reponame}{owner} = $1;\n } elsif (/^\\[group\\s+(.*)\\]$/) {\n $reponame = '';\n $groupname = $1;\n } elsif (/^members\\s*=\\s*(.*)/) {\n push @{$groups{$groupname}{users}}, map {s/\\@([^.]+)$/_$1/g; $_} split(' ', $1);\n } elsif (/^write?able\\s*=\\s*(.*)/) {\n foreach my $repo (split(' ', $1)) {\n $repo =~ s/\\.git$//;\n push @{$repos{$repo}{RW}}, \"\\@$groupname\";\n }\n } elsif (/^readonly\\s*=\\s*(.*)/) {\n foreach my $repo (split(' ', $1)) {\n $repo =~ s/\\.git$//;\n push @{$repos{$repo}{R}}, \"\\@$groupname\";\n }\n }\n}\n\n#use Data::Dumper;\n#print Dumper(\\%repos);\n#print Dumper(\\%groups);\n\n# Groups\nprint \"#\\n# Groups\\n#\\n\\n\";\nforeach my $grp (sort keys %groups) {\n next unless @{$groups{$grp}{users}};\n printf join(\"\\n\", @{$groups{$grp}{comments}}).\"\\n\" if $groups{$grp}{comments};\n printf \"\\@%-19s = %s\\n\", $grp, join(' ', @{$groups{$grp}{users}});\n}\n\n# Gitweb\nprint \"\\n#\\n# Gitweb\\n#\\n\\n\";\nforeach my $repo (sort keys %repos) {\n if ($repos{$repo}{desc}) {\n @{$repos{$repo}{R}} = grep(!/^gitweb$/, @{$repos{$repo}{R}});\n print $repo;\n print \" \\\"$repos{$repo}{owner}\\\"\" if $repos{$repo}{owner};\n print \" = \\\"$repos{$repo}{desc}\\\"\\n\";\n }\n}\n\n# Repos\nprint \"\\n#\\n# Repos\\n#\\n\";\nforeach my $repo (sort keys %repos) {\n print \"\\n\";\n printf join(\"\\n\", @{$repos{$repo}{comments}}).\"\\n\" if $repos{$repo}{comments};\n #if ($repos{$repo}{desc}) {\n # @{$repos{$repo}{R}} = grep(!/^gitweb$/, @{$repos{$repo}{R}});\n #}\n print \"repo\\t$repo\\n\";\n foreach my $access (qw(RW+ RW R)) {\n next unless $repos{$repo}{$access};\n my @keys;\n foreach my $key (@{$repos{$repo}{$access}}) {\n if ($key =~ /^\\@(.*)/) {\n next unless defined $groups{$1} and @{$groups{$1}{users}};\n }\n push @keys, $key;\n }\n printf \"\\t$access\\t= %s\\n\", join(' ', @keys) if @keys;\n }\n #if ($repos{$repo}{desc}) {\n # print $repo;\n # print \" \\\"$repos{$repo}{owner}\\\"\" if $repos{$repo}{owner};\n # print \" = \\\"$repos{$repo}{desc}\\\"\\n\";\n #}\n}\n" }, { "path": "install", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\n# Clearly you don't need a program to make one measly symlink, but the git\n# describe command involved in generating the VERSION string is a bit fiddly.\n\nuse Getopt::Long;\nuse FindBin;\nuse Config;\n\n# meant to be run from the root of the gitolite tree, one level above 'src'\nBEGIN { $ENV{GL_BINDIR} = $FindBin::RealBin . \"/src\"; }\nBEGIN { $ENV{GL_LIBDIR} = \"$ENV{GL_BINDIR}/lib\"; }\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Common;\n\n=for usage\nUsage (from gitolite clone directory):\n\n ./install\n to run gitolite using an absolute or relative path, for example\n 'src/gitolite' or '/full/path/to/this/dir/src/gitolite'\n\n ./install -ln []\n to symlink just the gitolite executable to some that is in\n $PATH. defaults to $HOME/bin if not specified. is\n assumed to exist; gitolite will not create it.\n\n Please provide a full path, not a relative path.\n\n ./install -to \n to copy the entire 'src' directory to . If is not in\n $PATH, use the full path to run gitolite commands.\n\n Please provide a full path, not a relative path.\n\n ./install -to \n to copy the entire 'src' directory to , but will replace\n all of the shebangs with the path to . This\n is a way to force gitolite to use some perl that is not\n installed at /usr/bin/perl.\n\nSimplest use, if $HOME/bin exists and is in $PATH, is:\n\n git clone https://github.com/sitaramc/gitolite\n gitolite/install -ln\n\n # now run setup\n gitolite setup -pk /path/to/YourName.pub\n=cut\n\nmy ( $to, $ln, $help, $quiet );\n\nGetOptions(\n 'to=s' => \\$to,\n 'ln:s' => \\$ln,\n 'help|h' => \\$help,\n 'quiet|q' => \\$quiet,\n);\nusage() if $to and $ln or $help;\n$ln = \"$ENV{HOME}/bin\" if defined($ln) and not $ln;\nfor my $d ($ln, $to) {\n next unless $d; # ignore empty values\n unless ( $d =~ m(^/) ) {\n print STDERR \"FATAL: please use an absolute path, not a relative path\\n\";\n usage();\n }\n if ( not -d $d ) {\n print STDERR \"FATAL: '$d' does not exist.\\n\";\n usage();\n }\n}\n\nchdir($ENV{GL_BINDIR});\nmy $version = `git describe --tags --long --dirty=-dt 2>/dev/null`;\nunless ($version =~ /^v\\d/) {\n print STDERR \"git describe failed; cannot deduce version number\\n\";\n $version = \"(unknown)\";\n}\n\nif ($to) {\n _mkdir($to);\n system(\"cp -RpP * $to\");\n _print( \"$to/VERSION\", $version );\n\n # Replace shebangs if necessary.\n my $thisperl = $Config{perlpath};\n if ($thisperl ne '/usr/bin/perl') {\n system(\"cd $to; grep -r -l /usr/bin/perl | xargs perl -pi -e 's(^#!/usr/bin/perl)(#!$thisperl)'\");\n }\n} elsif ($ln) {\n ln_sf( $ENV{GL_BINDIR}, \"gitolite\", $ln );\n _print( \"VERSION\", $version );\n} else {\n say \"use the following full path for gitolite:\";\n say \"\\t$ENV{GL_BINDIR}/gitolite\";\n _print( \"VERSION\", $version );\n}\n" }, { "path": "src/VREF/COUNT", "content": "#!/bin/sh\n\n# gitolite VREF to count number of changed/new files in a push\n\n# see gitolite docs for what the first 7 arguments mean\n\n# inputs:\n# arg-8 is a number\n# arg-9 is optional, and can be \"NEWFILES\"\n# outputs (STDOUT)\n# arg-7 if the number of changed (or new, if arg-9 supplied) files is > arg-8\n# otherwise nothing\n# exit status:\n# always 0\n\ndie() { echo \"$@\" >&2; exit 1; }\n[ -z \"$8\" ] && die \"not meant to be run manually\"\n\nnewsha=$3\noldtree=$4\nnewtree=$5\nrefex=$7\n\nmax=$8\n\nnf=\n[ \"$9\" = \"NEWFILES\" ] && nf='--diff-filter=A'\n# NO_SIGNOFF implies NEWFILES\n[ \"$9\" = \"NO_SIGNOFF\" ] && nf='--diff-filter=A'\n\n# count files against all the other commits in the system not just $oldsha\n# (why? consider what is $oldtree when you create a new branch, or what is\n# $oldsha when you update an old feature branch from master and then push it\ncount=`git log --name-only $nf --format=%n $newtree --not --all | grep . | sort -u | perl -ne '}{print \"$.\"'`\n\n[ $count -gt $max ] && {\n # count has been exceeded. If $9 was NO_SIGNOFF there's still a chance\n # for redemption -- if the top commit has a proper signed-off by line\n [ \"$9\" = \"NO_SIGNOFF\" ] && {\n author_email=$(git log --format=%ae -1 $newsha)\n git cat-file -p $newsha |\n egrep -i >/dev/null \"^ *$count +new +files +signed-off by: *$author_email *$\" && exit 0\n echo $refex top commit message should include the text \\'$count new files signed-off by: $author_email\\'\n exit 0\n }\n echo -n $refex \"(too many \"\n [ -n \"$nf\" ] && echo -n \"new \" || echo -n \"changed \"\n echo \"files in this push)\"\n}\n\nexit 0\n" }, { "path": "src/VREF/EMAIL-CHECK", "content": "#!/usr/bin/perl\n\n# gitolite VREF to check if all *new* commits have author == pusher\n\n# THIS IS NOT READY TO USE AS IS\n# ------------------------------\n# you MUST change the 'email_ok()' sub to suit *YOUR* site's\n# gitolite username -> author email mapping!\n\n# See bottom of the program for important philosophical notes.\n\nuse strict;\nuse warnings;\n\n# mapping between gitolite userid and correct email address is encapsulated in\n# this subroutine; change as you like\nsub email_ok {\n my ($author_email) = shift;\n my $expected_email = \"$ENV{GL_USER}\\@atc.tcs.com\";\n return $author_email eq $expected_email;\n}\n\nmy ( $ref, $old, $new ) = @ARGV;\nfor my $rev (`git log --format=\"%ae\\t%h\\t%s\" $new --not --all`) {\n chomp($rev);\n my ( $author_email, $hash, $subject ) = split /\\t/, $rev;\n\n # again, we use the trick that a vref can just choose to die instead of\n # passing back a vref, having it checked, etc., if it's more convenient\n die \"$ENV{GL_USER}, you can't push $hash authored by $author_email\\n\" . \"\\t(subject of commit was $subject)\\n\"\n unless email_ok($author_email);\n}\n\nexit 0;\n\n__END__\n\nThe following discussion is for people who want to enforce this check on ALL\ntheir developers (i.e., not just the newbies).\n\nDoing this breaks the \"D\" in \"DVCS\", forcing all your developers to work to a\ncentralised model as far as pushes are concerned. It prevents amending\nsomeone else's commit and pushing (this includes rebasing, cherry-picking, and\nso on, which are all impossible now). It also makes *any* off-line\ncollabaration between two developers useless, because neither of them can push\nthe result to the server.\n\nPHBs should note that validating the committer ID is NOT the same as reviewing\nthe code and running QA/tests on it. If you're not reviewing/QA-ing the code,\nit's probably worthless anyway. Conversely, if you *are* going to review the\ncode and run QA/tests anyway, then you don't really need to validate the\nauthor email!\n\nIn a DVCS, if you *pushed* a series of commits, you have -- in some sense --\nsigned off on them. The most formal way to \"sign\" a series is to tack on and\npush a gpg-signed tag, although most people don't go that far. Gitolite's log\nfiles are designed to preserve that accountability to *some* extent, though;\nsee contrib/adc/who-pushed for an admin defined command that quickly and\neasily tells you who *pushed* a particular commit.\n\nAnyway, the point is that the only purpose of this script is to\n\n * pander to someone who still has not grokked *D*VCS\n OR\n * tick off an item in some stupid PHB's checklist\n\n" }, { "path": "src/VREF/FILETYPE", "content": "#!/bin/sh\n\n# gitolite VREF to find autogenerated files\n\n# *completely* site specific; use it as an illustration of what can be done\n# with gitolite VREFs if you wish\n\n# see gitolite docs for what the first 7 arguments mean\n\n# inputs:\n# arg-8 is currently only one possible value: AUTOGENERATED\n# outputs (STDOUT)\n# arg-7 if any files changed in the push look like they were autogenerated\n# otherwise nothing\n# exit status:\n# always 0\n\ndie() { echo \"$@\" >&2; exit 1; }\n[ -z \"$8\" ] && die \"not meant to be run manually\"\n\nnewsha=$3\noldtree=$4\nnewtree=$5\nrefex=$7\n\noption=$8\n\n[ \"$option\" = \"AUTOGENERATED\" ] && {\n # currently we only look for \".java\" programs with the string \"Generated\n # by the protocol buffer compiler. DO NOT EDIT\" in them.\n\n git log --name-only $nf --format=%n $newtree --not --all |\n grep . |\n sort -u |\n grep '\\.java$' |\n while read fn\n do\n git show \"$newtree:$fn\" | egrep >/dev/null \\\n 'Generated by the protocol buffer compiler. +DO NOT EDIT' ||\n continue\n\n echo $refex\n exit 0\n done\n}\n" }, { "path": "src/VREF/MAX_NEWBIN_SIZE", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\n# gitolite VREF to check max size of new binary files\n\n# see gitolite docs for what the first 7 arguments mean\n\n# inputs:\n# arg-8 is a number\n# outputs (STDOUT)\n# arg-7 if any new binary files exist that are greater in size than arg-8\n# *and* there is no \"signed-off by\" line for such a file in the top commit\n# message.\n#\n# Otherwise nothing\n# exit status:\n# always 0\n\ndie \"not meant to be run manually\" unless $ARGV[7];\n\nmy ( $newsha, $oldtree, $newtree, $refex, $max ) = @ARGV[ 2, 3, 4, 6, 7 ];\n\nexit 0 if $newsha eq '0000000000000000000000000000000000000000';\n\n# / (.*) +\\| Bin 0 -> (\\d+) bytes/\n\nchomp( my $author_email = `git log --format=%ae -1 $newsha` );\nmy $msg = `git cat-file -p $newsha`;\n$msg =~ s/\\t/ /g; # makes our regexes simpler\n\nfor my $newbin (`git diff --stat=999,999 $oldtree $newtree | grep Bin.0.-`) {\n next unless $newbin =~ /^ (.*) +\\| +Bin 0 -> (\\d+) bytes/;\n my ( $f, $s ) = ( $1, $2 );\n next if $s <= $max;\n\n next if $msg =~ /^ *$f +signed-off by: *$author_email *$/mi;\n\n print \"$refex $f is larger than $max\";\n}\n\nexit 0\n" }, { "path": "src/VREF/MERGE-CHECK", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\n# gitolite VREF to check if there are any merge commits in the current push.\n\n# THIS IS DEMO CODE; please read all comments below as well as\n# doc/vref.mkd before trying to use this.\n\n# usage in conf/gitolite.conf goes like this:\n\n# - VREF/MERGE-CHECK/master = @all\n# # reject only if the merge commit is being pushed to the master branch\n# - VREF/MERGE-CHECK = @all\n# # reject merge commits to any branch\n\nmy $ref = $ARGV[0];\nmy $oldsha = $ARGV[1];\nmy $newsha = $ARGV[2];\nmy $refex = $ARGV[6];\n\n# The following code duplicates some code from parse_conf_line() and some from\n# check_ref(). This duplication is the only thing that is preventing me from\n# removing the \"M\" permission code from 'core' gitolite and using this\n# instead. However, it does demonstrate how you would do this if you had to\n# create any other similar features, for example someone wanted \"no non-merge\n# first-parent\", which is far too specific for me to add to 'core'.\n\n# -- begin duplication --\nmy $branch_refex = $ARGV[7] || '';\nif ($branch_refex) {\n $branch_refex =~ m(^refs/) or $branch_refex =~ s(^)(refs/heads/);\n} else {\n $branch_refex = 'refs/.*';\n}\nexit 0 unless $ref =~ /^$branch_refex/;\n# -- end duplication --\n\n# we can't run this check for tag creation or new branch creation, because\n# 'git log' does not deal well with $oldsha = '0' x 40.\nif ( $oldsha eq \"0\" x 40 or $newsha eq \"0\" x 40 ) {\n print STDERR \"ref create/delete ignored for purposes of merge-check\\n\";\n exit 0;\n}\n\nmy $ret = `git rev-list -n 1 --merges $oldsha..$newsha`;\nprint \"$refex FATAL: merge commits not allowed\\n\" if $ret =~ /./;\n\nexit 0;\n" }, { "path": "src/VREF/NAME_NC", "content": "#!/bin/sh\n\n# ----------------------------------------------------------------------\n# VREF/NAME_NC\n# Like VREF/NAME, but only considers \"new commits\" -- i.e., commits that\n# don't already exist in the repo as part of some other ref.\n\n# ----------------------------------------------------------------------\n# WHY\n# VREF/NAME doesn't deal well with tag creation (or new branch creation),\n# since then all files in the project look like they are being created (due\n# to comparison with an empty tree).\n\n# Use this instead of VREF/NAME when you need to make that distinction.\n\nnewsha=$3\n\n[ $newsha = \"0000000000000000000000000000000000000000\" ] && {\n echo \"we don't currently handle deletions\" >&2\n exit 1\n}\n\ngit log --name-only --format=%n $newsha --not --all |\n sort -u | grep . | sed -e 's.^.VREF/NAME_NC/.'\n\n# ----------------------------------------------------------------------\n# OTHER NOTES\n# The built-in NAME does have a wee bit of a performance advantage. I plan\n# to ignore this until someone notices this enough to be a problem :)\n#\n# I could explain it here at least, but I fear that any explanation will\n# only add to the already rampant confusion about how VREFs work. I'm not\n# rocking THAT boat again, sorry!\n" }, { "path": "src/VREF/VOTES", "content": "#!/bin/sh\n\n# gitolite VREF to count votes before allowing pushes to certain branches.\n\n# This approximates gerrit's voting (but it is SHA based; I believe Gerrit is\n# more \"changeset\" based). Here's how it works:\n\n# - A normal developer \"bob\" proposes changes to master by pushing a commit to\n# \"pers/bob/master\", then informs the voting members by email.\n\n# - Some or all of the voting members fetch and examine the commit. If they\n# approve, they \"vote\" for the commit like so. For example, say voting\n# member \"alice\" fetched bob's proposed commit into \"bob-master\" on her\n# clone, then tested or reviewed it. She would approve it by running:\n# git push origin bob-master:votes/alice/master\n\n# - Once enough votes have been tallied (hopefully there is normal team\n# communication that says \"hey I approved your commit\", or it can be checked\n# by 'git ls-remote origin' anyway), Bob, or any developer, can push the\n# same commit (same SHA) to master and the push will succeed.\n\n# - Finally, a \"trusted\" developer can push a commit to master without\n# worrying about the voting restriction at all.\n\n# The config for this example would look like this:\n\n# repo foo\n# # allow personal branches (to submit proposed changes)\n# RW+ pers/USER/ = @devs\n# - pers/ = @all\n#\n# # allow only voters to vote\n# RW+ votes/USER/ = @voters\n# - votes/ = @all\n#\n# # normal access rules go here; should allow *someone* to push master\n# RW+ = @devs\n#\n# # 2 votes required to push master, but trusted devs don't have this restriction\n# RW+ VREF/VOTES/2/master = @trusted-devs\n# - VREF/VOTES/2/master = @devs\n\n# Note: \"2 votes required to push master\" means at least 2 refs matching\n# \"votes/*/master\" have the same SHA as the one currently being pushed.\n\n# ----------------------------------------------------------------------\n\n# see gitolite docs for what the first 7 arguments mean\n\n# inputs:\n# arg-8 is a number; see below\n# arg-9 is a simple branch name (i.e., \"master\", etc). Currently this code\n# does NOT do vote counting for branch names with more than one component\n# (like foo/bar).\n# outputs (STDOUT)\n# nothing\n# exit status:\n# always 0\n\ndie() { echo \"$@\" >&2; exit 1; }\n[ -z \"$8\" ] && die \"not meant to be run manually\"\n\nref=$1\nnewsha=$3\nrefex=$7\nvotes_needed=$8\nbranch=$9\n\n# nothing to do if the branch being pushed is not \"master\" (using our example)\n[ \"$ref\" = \"refs/heads/$branch\" ] || exit 0\n\n# find how many votes have come in\nvotes=`git for-each-ref refs/heads/votes/*/$branch | grep -c $newsha`\n\n# send back a vref if we don't have the minimum votes needed. For trusted\n# developers this will invoke the RW+ rule and pass anyway, but for others it\n# will invoke the \"-\" rule and fail.\n[ $votes -ge $votes_needed ] || echo $refex \"require at least $votes_needed votes to push $branch\"\n\nexit 0\n" }, { "path": "src/VREF/lock", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Common;\n\n# gitolite VREF to lock and unlock (binary) files. Requires companion command\n# 'lock' to be enabled; see doc/locking.mkd for details.\n\n# ----------------------------------------------------------------------\n\n# see gitolite docs for what the first 7 arguments mean\n\ndie \"not meant to be run manually\" unless $ARGV[6];\n\nmy $ff = \"$ENV{GL_REPO_BASE}/$ENV{GL_REPO}.git/gl-locks\";\nexit 0 unless -f $ff;\n\nour %locks;\nmy $t = slurp($ff);\neval $t;\n_die \"do '$ff' failed with '$@', contact your administrator\" if $@;\n\nmy ( $oldtree, $newtree, $refex ) = @ARGV[ 3, 4, 6 ];\n\nfor my $file (`git diff --name-only $oldtree $newtree`) {\n chomp($file);\n\n if ( $locks{$file} and $locks{$file}{USER} ne $ENV{GL_USER} ) {\n print \"$refex '$file' locked by '$locks{$file}{USER}'\";\n last;\n }\n}\n\nexit 0\n" }, { "path": "src/VREF/partial-copy", "content": "#!/bin/sh\n\n# push updated branches back to the \"main\" repo.\n\n# This must be run as the *last* VREF, though it doesn't matter what\n# permission you give to it\n\ndie() { echo \"$@\" >&2; exit 1; }\n\nrepo=$GL_REPO\nuser=$GL_USER\nref=$1 # we're running like an update hook\nold=$2\nnew=$3\n\n# never send any STDOUT back, to avoid looking like a ref. If we fail, git\n# will catch it by our exit code\nexec >&2\n\nmain=`git config --file $GL_REPO_BASE/$repo.git/config --get gitolite.partialCopyOf`;\n[ -z \"$main\" ] && exit 0\n\nrand=$$\nexport GL_BYPASS_ACCESS_CHECKS=1\n\nif [ \"$new\" = \"0000000000000000000000000000000000000000\" ]\nthen\n # special case for deleting a ref (this is why it is important to put this\n # VREF as the last one; if we got this far he is allowed to delete it)\n git push -f $GL_REPO_BASE/$main.git :$ref || die \"FATAL: failed to delete $ref\"\n\n exit 0\nfi\n\ngit push -f $GL_REPO_BASE/$main.git $new:refs/partial/br-$rand || die \"FATAL: failed to send $new\"\n\ncd $GL_REPO_BASE/$main.git\ngit update-ref -d refs/partial/br-$rand\ngit update-ref $ref $new $old || die \"FATAL: update-ref for $ref failed\"\n\nexit 0\n" }, { "path": "src/VREF/refex-expr", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\n# see bottom of this file for instructons and IMPORTANT WARNINGS!\n# ----------------------------------------------------------------------\n\nmy $rule = $ARGV[7];\ndie \"\\n\\nFATAL: GL_REFEX_EXPR_ doesn't exist\\n(your admin probably forgot the rc file change needed for this to work)\\n\\n\"\n unless exists $ENV{ \"GL_REFEX_EXPR_\" . $rule };\nmy $res = $ENV{ \"GL_REFEX_EXPR_\" . $rule } || 0;\nprint \"$ARGV[6] ($res)\\n\" if $res;\n\nexit 0;\n\n__END__\n\n------------------------------------------------------------------------\nIMPORTANT WARNINGS:\n * has not been tested heavily\n * SO PLEASE TEST YOUR SPECIFIC USE CASE THOROUGHLY!\n * read the NOTES section below\n * syntax and semantics are to be considered beta and may change as I find\n better use cases\n------------------------------------------------------------------------\n\nRefex expressions, like VREFs, are best used as additional \"deny\" rules, to\ndeny combinations that the normal ruleset cannot detect.\n\nTo enable this, uncomment 'refex-expr' in the ENABLE list in the rc file.\n\nIt allows you to say things like \"don't allow users u3 and u4 to change the\nMakefile in the master branch\" (i.e., they can change any other file in\nmaster, or the Makefile in any other branch, but not that specific combo).\n\n repo foo\n RW+ = u1 u2 # line 1\n\n RW+ master = u3 u4 # line 2\n RW+ = u3 u4 # line 3\n RW+ VREF/NAME/Makefile = u3 u4 # line 4\n - master and VREF/NAME/Makefile = u3 u4 # line 5\n\nLine 5 is a \"refex expression\". Here are the rules:\n\n * for each refex in the expression (\"master\" and \"VREF/NAME/Makefile\" in\n this example), a count is kept of the number of times the EXACT refex was\n matched and allowed in the *normal* rules (here, lines 2 and 4) during\n this push.\n\n * the expression is evaluated based on these counts. 0 is false, and\n any non-zero is true (see more examples later). The truth value of the\n expression determines whether the refex expression matched.\n\n You can use any logical or arithmetic expression using refexes as operands\n and using these operators:\n\n not and or xor + - == -lt -gt -eq -le -ge -ne\n\n Parens are not allowed. Precedence is as you might expect for those\n operators. It's actually perl that is evaluating it (you can guess what\n the '-lt' etc., get translated to) so if in doubt, check 'man perlop'.\n\n * the refexes that form the terms of the expression (in this case, lines 2\n and 4) MUST come before the expression itself (i.e., line 5).\n\n * note the words \"EXACT refex was matched\" above.\n\n Let's say you add \"u3\" to line 1. Then the refex expression in line 5\n would never match for u3. This is because line 1 prevents line 2 from\n matching (being more general *and* appearing earlier), so the count for\n the \"master\" refex would be 0. If \"master\" is 0 (false), then \"master and\n \" is also false.\n\n (Same thing is you swap lines 2 and 3; i.e., put the \"RW+ = ...\" before\n the \"RW+ master = ...\").\n\n Put another way, the terms in the refex expression are refexes, not refs.\n Merely pushing the master branch does not mean the count for \"master\"\n increases; it has to *match* on a line that has \"master\" as the refex.\n\nHere are some more examples:\n\n * user u2 is allowed to push either 'doc/' or 'src/' but not both\n\n repo foo\n RW+ = u1 u2 u3\n\n RW+ VREF/NAME/doc/ = u2\n RW+ VREF/NAME/src/ = u2\n - VREF/NAME/doc/ and VREF/NAME/src/ = u2\n\n * user u3 is allowed to push at most 2 files to conf/\n\n repo foo\n RW+ = u1 u2 u3\n\n RW+ VREF/NAME/conf/ = u3\n - VREF/NAME/conf/ -gt 2 = u3\n" }, { "path": "src/commands/1plus1", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\n# import LOCK_*\nuse Fcntl qw(:flock);\n\nmy $lockbase = shift; # suggested: $GL_REPO_BASE/$GL_REPO.git/.gl-mirror-push-lock.$COPY_NAME\nmy @cmd_plus_args = @ARGV; # the actual 'gitolite mirror ...' command\n@ARGV = ();\n\n# ----------------------------------------------------------------------\n\nopen( my $fhrun, \">\", \"$lockbase.run\" ) or die \"open '$lockbase.run' failed: $!\";\nif ( flock( $fhrun, LOCK_EX | LOCK_NB ) ) {\n # got run lock; you're good to go\n\n system(@cmd_plus_args);\n\n flock( $fhrun, LOCK_UN );\n exit 0;\n}\n\n# \"run\" lock failed; someone is already running the command\n\nopen( my $fhqueue, \">\", \"$lockbase.queue\" ) or die \"open '$lockbase.queue' failed: $!\";\nif ( flock( $fhqueue, LOCK_EX | LOCK_NB ) ) {\n # got queue lock, now block waiting for \"run\" lock\n flock( $fhrun, LOCK_EX );\n # got run lock, so take yourself out of \"queue\" state, then run\n flock( $fhqueue, LOCK_UN );\n\n system(@cmd_plus_args);\n\n flock( $fhrun, LOCK_UN );\n exit 0;\n}\n\n# \"queue\" lock also failed; someone is running AND someone is queued; we can go home\nsay STDERR \"INFO: nothing to do/queue; '$lockbase' already running and 1 in queue\";\nexit 0;\n" }, { "path": "src/commands/D", "content": "#!/bin/sh\n\n# ----------------------------------------------------------------------\n# ADMINISTRATOR NOTES:\n# ----------------------------------------------------------------------\n\n# - set TRASH_CAN in the rc if you don't like the default. It should be\n# relative to GL_REPO_BASE or an absolute value. It should also be on the\n# same filesystem as GL_REPO_BASE, otherwise the 'mv' will take too long.\n\n# - you could set TRASH_SUFFIX also but I recomend you leave it as it is\n\n# - run a cron job to delete old repos based on age (the TRASH_SUFFIX has a\n# timestamp); your choice how/how often you do that\n\n# - you can completely disable the 'rm' command by setting an rc variable\n# called D_DISABLE_RM to \"1\".\n# ----------------------------------------------------------------------\n\n# ----------------------------------------------------------------------\n# Usage: ssh git@host D \n#\n# The whimsically named \"D\" command deletes repos (\"D\" is a counterpart to the\n# \"C\" permission which lets you create repos. Which also means that, just\n# like \"C\", it only works for wild repos).\n#\n# There are two kinds of deletions: 'rm' removes a repo completely, while\n# 'trash' moves it to a trashcan which can be recovered later (upto a time\n# limit that your admin will tell you).\n#\n# The 'rm', 'lock', and 'unlock' subcommands:\n# Initially, all repos are \"locked\" against 'rm'. The correct sequence is\n# ssh git@host D unlock repo\n# ssh git@host D rm repo\n# Since the initial condition is always locked, the \"lock\" command is\n# rarely used but it is there if you want it.\n#\n# The 'trash', 'list-trash', and 'restore' subcommands:\n# You can 'trash' a repo, which moves it to a special place:\n# ssh git@host D trash repo\n# You can then 'list-trash'\n# ssh git@host D list-trash\n# which prints something like\n# repo/2012-04-11_05:58:51\n# allowing you to restore by saying\n# ssh git@host D restore repo/2012-04-11_05:58:51\n\ndie() { echo \"$@\" >&2; exit 1; }\nusage() { perl -lne 'print substr($_, 2) if /^# Usage/../^$/' < $0; exit 1; }\n[ -z \"$1\" ] && usage\n[ \"$1\" = \"-h\" ] && usage\n[ \"$1\" != \"list-trash\" ] && [ -z \"$2\" ] && usage\n[ -z \"$GL_USER\" ] && die GL_USER not set\n\n# ----------------------------------------------------------------------\ncmd=$1\nrepo=$2\n# ----------------------------------------------------------------------\nRB=`gitolite query-rc GL_REPO_BASE`; cd $RB\nTRASH_CAN=`gitolite query-rc TRASH_CAN`; tcan=Trash; TRASH_CAN=${TRASH_CAN:-$tcan}\nTRASH_SUFFIX=`gitolite query-rc TRASH_SUFFIX`; tsuf=`date +%Y-%m-%d_%H:%M:%S`; TRASH_SUFFIX=${TRASH_SUFFIX:-$tsuf}\n# ----------------------------------------------------------------------\n\nowner_or_die() {\n gitolite owns \"$repo\" || die You are not authorised\n}\n\n# ----------------------------------------------------------------------\n\nif [ \"$cmd\" = \"rm\" ]\nthen\n\n gitolite query-rc -q D_DISABLE_RM && die \"sorry, 'unlock' and 'rm' are disabled\"\n\n owner_or_die\n [ -f $repo.git/gl-rm-ok ] || die \"'$repo' is locked!\"\n rm -rf $repo.git\n echo \"'$repo' is now gone!\"\n\nelif [ \"$cmd\" = \"lock\" ]\nthen\n\n owner_or_die\n rm -f $repo.git/gl-rm-ok\n echo \"'$repo' is now locked\"\n\nelif [ \"$cmd\" = \"unlock\" ]\nthen\n\n gitolite query-rc -q D_DISABLE_RM && die \"sorry, 'unlock' and 'rm' are disabled\"\n\n owner_or_die\n touch $repo.git/gl-rm-ok\n echo \"'$repo' is now unlocked\"\n\nelif [ \"$cmd\" = \"trash\" ]\nthen\n\n owner_or_die\n mkdir -p $TRASH_CAN/$repo 2>/dev/null || die \"failed creating directory in trashcan\"\n [ -d $TRASH_CAN/$repo/$TRASH_SUFFIX ] && die \"try again in a few seconds...\"\n mv $repo.git $TRASH_CAN/$repo/$TRASH_SUFFIX\n echo \"'$repo' moved to trashcan\"\n\nelif [ \"$cmd\" = \"list-trash\" ]\nthen\n\n cd $TRASH_CAN 2>/dev/null || exit 0\n find . -name gl-creator | sort | while read t\n do\n owner=\n owner=`cat \"$t\"`\n [ \"$owner\" = \"$GL_USER\" ] && dirname $t\n done | cut -c3-\n\nelif [ \"$cmd\" = \"restore\" ]\nthen\n\n owner=\n owner=`cat $TRASH_CAN/$repo/gl-creator 2>/dev/null`\n [ \"$owner\" = \"$GL_USER\" ] || die \"'$repo' is not yours!\"\n\n cd $TRASH_CAN\n realrepo=`dirname $repo`\n [ -d $RB/$realrepo.git ] && die \"'$realrepo' already exists\"\n mv $repo $RB/$realrepo.git\n echo \"'$repo' restored to '$realrepo'\"\n\nelse\n die \"unknown subcommand '$cmd'\"\nfi\n" }, { "path": "src/commands/access", "content": "#!/usr/bin/perl -s\nuse strict;\nuse warnings;\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Rc;\nuse Gitolite::Common;\nuse Gitolite::Conf::Load;\n\nour ( $q, $s, $h ); # quiet, show, help\n\n=for usage\nUsage: gitolite access [-q|-s] \n\nPrint access rights for arguments given. The string printed has the word\nDENIED in it if access was denied. With '-q', returns only an exit code\n(shell truth, not perl truth -- 0 is success). For '-s', see below.\n\n - repo: mandatory\n - user: mandatory\n - perm: defauts to '+'. Valid values: R, W, +, C, D, M\n - ref: defauts to 'any'. See notes below\n\nNotes:\n - ref: something like 'master', or 'refs/tags/v1.0', or even a VREF if you\n know what they look like.\n\n The 'any' ref is special -- it ignores deny rules, thus simulating\n gitolite's behaviour during the pre-git access check (see 'deny-rules'\n section in rules.html for details).\n\n - batch mode: see src/triggers/post-compile/update-git-daemon-access-list\n for a good example that shows how to test several repos in one invocation.\n This is orders of magnitude faster than running the command multiple\n times; you'll notice if you have more than a hundred or so repos.\n\n - '-s' shows the rules (conf file name, line number, and rule) that were\n considered and how they fared.\n\n - you can also test the ability to create wild repos if you set GL_USER to\n the username and use ^C as the permission to check for.\n=cut\n\nusage() if not @ARGV >= 2 or $h;\n\nmy ( $repo, $user, $aa, $ref ) = @ARGV;\n# default access is '+'\n$aa ||= '+';\n# default ref is 'any'\n$ref ||= 'any';\n# fq the ref if needed\n$ref =~ s(^)(refs/heads/) if $ref and $ref ne 'any' and $ref !~ m(^(refs|VREF)/);\n_die \"invalid perm\" if not( $aa and $aa =~ /^(R|W|\\+|C|D|M|\\^C)$/ );\n_die \"invalid ref name\" if not( $ref and $ref =~ $REF_OR_FILENAME_PATT );\n\nmy $ret = '';\n\nif ( $repo ne '%' and $user ne '%' ) {\n # single repo, single user; no STDIN\n $ret = access( $repo, $user, adjust_aa($repo, $aa), $ref );\n\n show($ret) if $s;\n\n # adjust for fallthru in VREFs\n $ret =~ s/DENIED by fallthru/allowed by fallthru/ if $ref =~ m(^VREF/);\n\n if ( $ret =~ /DENIED/ ) {\n print \"$ret\\n\" unless $q;\n exit 1;\n }\n\n print \"$ret\\n\" unless $q;\n exit 0;\n}\n\n$repo = '' if $repo eq '%';\n$user = '' if $user eq '%';\n\n_die \"'-q' and '-s' meaningless in pipe mode\" if $q or $s;\n@ARGV = ();\nwhile (<>) {\n my @in = split;\n my $r = $repo || shift @in;\n my $u = $user || shift @in;\n $ret = access( $r, $u, adjust_aa($r, $aa), $ref );\n print \"$r\\t$u\\t$ret\\n\";\n}\n\nsub adjust_aa {\n my ($repo, $aa) = @_;\n $aa = 'W' if $aa eq 'C' and not option($repo, 'CREATE_IS_C');\n $aa = '+' if $aa eq 'D' and not option($repo, 'DELETE_IS_D');\n $aa = 'W' if $aa eq 'M' and not option($repo, 'MERGE_CHECK');\n return $aa;\n}\n\nsub show {\n my $ret = shift;\n die \"repo already exists; ^C won't work\\n\" if $ret =~ /DENIED by existence/;\n\n my $in = $rc{RULE_TRACE} or die \"this should not happen! $ret\";\n\n print STDERR \"legend:\";\n print STDERR \"\n d => skipped deny rule due to ref unknown or 'any',\n r => skipped due to refex not matching,\n p => skipped due to perm (W, +, etc) not matching,\n D => explicitly denied,\n A => explicitly allowed,\n F => fallthru; access denied for normal refs, allowed for VREFs\n\n\";\n\n my %rule_info = read_ri($in); # get rule info data for all traced rules\n # this means conf filename, line number, and content of the line\n\n # the rule-trace info is a set of pairs of a number plus a string. Only\n # the last character in a string is valid (and has meanings shown above).\n # At the end there may be a final 'f'\n my @in = split ' ', $in;\n while (@in) {\n $in = shift @in;\n if ( $in =~ /^\\d+$/ ) {\n my $res = shift @in or die \"this should not happen either!\";\n my $m = chop($res);\n printf \" %s %20s:%-6s %s\\n\", $m,\n $rule_info{$in}{fn},\n $rule_info{$in}{ln},\n $rule_info{$in}{cl};\n } elsif ( $in eq 'F' ) {\n printf \" %s %20s\\n\", $in, \"(fallthru)\";\n } else {\n die \"and finally, this also should not happen!\";\n }\n }\n print \"\\n\";\n}\n\nsub read_ri {\n my %rules = map { $_ => 1 } $_[0] =~ /(\\d+)/g;\n # contains a series of rule numbers, each of which we must search in\n # $GL_ADMIN_BASE/.gitolite/conf/rule_info\n\n my %rule_info;\n for ( slurp( $ENV{GL_ADMIN_BASE} . \"/conf/rule_info\" ) ) {\n my ( $r, $f, $l ) = split ' ', $_;\n next unless $rules{$r};\n $rule_info{$r}{fn} = $f;\n $rule_info{$r}{ln} = $l;\n $rule_info{$r}{cl} = conf_lines( $f, $l );\n\n # a wee bit of optimisation, in case the rule_info file is huge and\n # what we want is up near the beginning\n delete $rules{$r};\n last unless %rules;\n }\n return %rule_info;\n}\n\n{\n my %conf_lines;\n\n sub conf_lines {\n my ( $file, $line ) = @_;\n $line--;\n\n unless ( $conf_lines{$file} ) {\n $conf_lines{$file} = [ slurp( $ENV{GL_ADMIN_BASE} . \"/conf/$file\" ) ];\n chomp( @{ $conf_lines{$file} } );\n }\n return $conf_lines{$file}[$line];\n }\n}\n" }, { "path": "src/commands/compile-template-data", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\n# read template data to produce gl-perms and gl-repo-groups files in each\n# $repo dir. Create the repo if needed, using the wild repos create logic\n# (with a \"creator\" of \"gitolite-admin\"!), though they're not really wild\n# repos.\n\n# see rule-templates.html in the gitolite documentation site.\n\n# pure text manipulation (and very little of that!), no git or gitolite\n# functions, no access checks, no possibility of a performance drama (or at\n# least not a *complex* performance drama)\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Rc;\nuse Gitolite::Common;\nuse Gitolite::Conf::Load;\nuse Gitolite::Conf::Store;\n\nmy $rb = $rc{GL_REPO_BASE};\n\n@ARGV = `find $rc{GL_ADMIN_BASE}/conf -type f -name \"*.conf\" | sort`; chomp(@ARGV);\n# we don't see the files in the exact same order that gitolite compile sees\n# them, but we don't need to, for the data we are interested in (as long as\n# you don't break up one repo's data across multiple files!)\n\n# XXX We also potentially see more; a conf file may be in the directory, but\n# not pulled in via an 'include' or 'subconf', so it doesn't exist as far as\n# 'gitolite compile' is concerned, but here we *do* pull it in.\n\nmy $repos = '';\nmy $perms = '';\nmy $list = ''; # list of templates to apply\nmy $lip = ''; # line in progress\nwhile (<>) {\n chomp;\n next unless /^=begin template-data$/ .. /^=end$/ and not /^=(begin|end)/;\n\n next unless /\\S/;\n next if /^\\s*#/;\n\n s/\\t/ /g; # all the same to us\n\n # handle continuation lines (backslash as last character)\n if (/\\\\$/) {\n s/\\\\$//;\n $lip .= $_;\n next;\n }\n $_ = $lip . $_;\n $lip = '';\n\n _warn(\"bad line: $_\"), next if m([^ \\w.\\@/=-]); # silently ignore lines that have characters we don't need\n if (/^\\s*repo\\s+(\\S.*)=\\s*(\\S.*)$/) {\n flush($repos, $list, $perms);\n $repos = $1;\n $perms = '';\n $list = $2;\n\n } elsif (/^\\s*(\\S+)\\s*=\\s*(\\S.*)$/) {\n $perms .= \"$1 = $2\\n\";\n } else {\n # probably a blank line or a comment line. If not, well *shrug*\n }\n}\nflush($repos, $list, $perms);\n\nsub flush {\n my ($r, $l, $p) = @_;\n return unless $r and $l and $p;\n $l =~ s/\\s+/ /g;\n\n my @r = split ' ', $r;\n while (@r) {\n my $r1 = shift @r;\n if ($r1 =~ m(^@)) {\n my @g = @{ Gitolite::Conf::Load::list_members($r1) };\n _warn \"undefined group '$r1'\" unless @g;\n unshift @r, @g;\n next;\n }\n\n flush_1($r1, $l, $p);\n }\n}\nsub flush_1 {\n my ($repo, $list, $perms) = @_;\n\n # beware of wild characters!\n return unless $repo =~ $REPONAME_PATT;\n\n if (not -d \"$rb/$repo.git\") {\n new_wild_repo( $repo, 'gitolite-admin', 'template-data' );\n }\n\n _print(\"$rb/$repo.git/gl-repo-groups\", $list);\n\n _print(\"$rb/$repo.git/gl-perms\", $perms);\n}\n" }, { "path": "src/commands/config", "content": "#!/usr/bin/perl\nuse 5.10.0;\n\n# ---- WARNING ----\n\n# If your site makes a distinction between \"right to push the admin repo\" and\n# \"right to run arbitrary commands on the server\" (i.e., if not all of your\n# \"admins\" have shell access to the server), this is a security risk. If that\n# is the case, DO NOT ENABLE THIS COMMAND.\n\n# ----------------------------------------------------------------------\n# gitolite command to allow \"git config\" on repos (with some restrictions)\n\n# (Not to be confused with the 'git-config' command, which is used only in\n# server-side scripts, not remotely.)\n\n# setup:\n# 1. Enable the command by adding it to the COMMANDS section in the ENABLE\n# list in the rc file. (Have you read the warning above?)\n#\n# 2. Specify configs allowed to be changed by the user. This is a space\n# separated regex list. For example:\n\n# repo ...\n# ... (various rules) ...\n# option user-configs = hook\\..* foo.bar[0-9].*\n\nuse strict;\nuse warnings;\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Easy;\nuse Gitolite::Common;\n\n# ----------------------------------------------------------------------\n# usage\n\n=for usage\nUsage: ssh git@host config [git config options]\n\nRuns \"git config\" in the repo. Only the following 3 syntaxes are supported\n(see 'man git-config'):\n\n --add name value\n --get-all name\n --unset-all name\n --list\n\nYour administrator should tell you what keys are allowed for the \"name\".\n=cut\n\n# ----------------------------------------------------------------------\n# arg checks\n\nmy %nargs = qw(\n --add 3\n --get-all 2\n --unset-all 2\n --list 1\n );\n\nusage() if not @ARGV or $ARGV[0] eq '-h';\n\nmy $repo = shift;\n\nmy $op = shift;\nusage() unless $op and exists $nargs{$op};\n\n# ----------------------------------------------------------------------\n# authorisation checks\n\ndie \"sorry, you are not authorised\\n\" unless\n owns($repo)\n or\n ( ( $op eq '--get-all' or $op eq '--list' )\n ? can_read($repo)\n : ( can_write($repo) and option( $repo, 'writer-is-owner' ) )\n );\n\n# ----------------------------------------------------------------------\n# key validity checks\n\nunless ($op eq '--list') {\n my $key = shift;\n\n my $val = '';\n $val = join(\" \", @ARGV) if @ARGV;\n # values with spaces embedded get flattened by sshd when it passes\n # SSH_ORIGINAL_COMMAND to gitolite. In this specific instance, we will\n # pretend we know what the user meant, and join up the last 1+ args into\n # one space-separated arg.\n\n my $user_configs = option( $repo, 'user-configs' );\n # this is a space separated list of allowed config keys\n my @validkeys = split( ' ', ( $user_configs || '' ) );\n my @matched = grep { $key =~ /^$_$/i } @validkeys;\n _die \"config '$key' not allowed\\n\" if ( @matched < 1 );\n\n @ARGV = ($key);\n push @ARGV, $val if $val;\n}\n\n# ----------------------------------------------------------------------\n# go!\n\nunshift @ARGV, $op;\nusage() unless @ARGV == $nargs{$op};\n\n_chdir(\"$rc{GL_REPO_BASE}/$repo.git\");\n_system( \"git\", \"config\", @ARGV );\n" }, { "path": "src/commands/create", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Rc;\nuse Gitolite::Common;\nuse Gitolite::Conf::Load;\nuse Gitolite::Conf::Store;\n\n=for usage\ncreate -- create a wild repo.\n\nUsage:\n ssh git@host create \n=cut\n\nusage() if @ARGV != 1 or $ARGV[0] eq '-h';\n\n$ENV{GL_USER} or _die \"GL_USER not set\";\n\nmy $repo = shift;\n_die \"invalid repo '$repo'\" unless $repo =~ $REPONAME_PATT;\n\nmy $ret = access( $repo, $ENV{GL_USER}, '^C', 'any' );\n_die \"repo already exists or you are not authorised to create it\" if $ret =~ /DENIED/;\n\nnew_wild_repo( $repo, $ENV{GL_USER}, 'create' );\ngl_log( 'create', $repo, $ENV{GL_USER}, 'create' );\n" }, { "path": "src/commands/creator", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Rc;\nuse Gitolite::Common;\nuse Gitolite::Conf::Load;\n\n=for usage\nUsage: gitolite creator [-n] []\n\nPrint the creator name for the repo. A '-n' suppresses the newline.\n\nWhen an optional username is supplied, it checks if the user is the creator of\nthe repo and returns an exit code (shell truth, 0 for success) instead of\nprinting anything, which makes it possible to do this in shell:\n\n if gitolite creator someRepo someUser\n then\n ...\n=cut\n\nusage() if not @ARGV or $ARGV[0] eq '-h';\nmy $nl = \"\\n\";\nif ( $ARGV[0] eq '-n' ) {\n $nl = '';\n shift;\n}\nmy $repo = shift;\nmy $user = shift || '';\n\nmy $creator = '';\n$creator = creator($repo) if not repo_missing($repo);\nif ($user) {\n exit 0 if $creator eq $user;\n exit 1;\n}\nreturn ( $creator eq $user ) if $user;\nprint \"$creator$nl\";\n" }, { "path": "src/commands/desc", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Easy;\n\n=for usage\nUsage: ssh git@host desc \n ssh git@host desc \n\nShow or set description for repo. You need to have write access to the repo\nand the 'writer-is-owner' option must be set for the repo, or it must be a\nuser-created ('wild') repo and you must be the owner.\n=cut\n\nusage() if not @ARGV or @ARGV < 1 or $ARGV[0] eq '-h';\n\nmy $repo = shift;\nmy $text = join( \" \", @ARGV );\nmy $file = 'description';\n\n#<<<\n_die \"you are not authorized\" unless\n ( not $text and can_read($repo) ) or\n ( $text and owns($repo) ) or\n ( $text and can_write($repo) and ( $rc{WRITER_CAN_UPDATE_DESC} or option( $repo, 'writer-is-owner' ) ) );\n#>>>\n\n$text\n ? textfile( file => $file, repo => $repo, text => $text )\n : print textfile( file => $file, repo => $repo );\n\n__END__\n\nkernel.org needs 'desc' to be available to people who have \"RW\" or above, not\njust the \"creator\". In fact they need it for non-wild repos so there *is* no\ncreator. To accommodate this, we created the WRITER_CAN_UPDATE_DESC rc\nvariable.\n\nHowever, that has turned out to be a bit of a blunt instrument for people with\ndifferent types of wild repos -- they don't want to apply this to all of them.\nIt seems easier to do this as an option, so you may have it for one set of\n\"repo ...\" and not have it for others. And if you want it for the whole\nsystem you'd just put it under \"repo @all\".\n\nThe new 'writer-is-owner' option is meant to cover desc, readme, and any other\nrepo-specific text file, so it's also a blunt instrument, though in a\ndifferent dimension :-)\n" }, { "path": "src/commands/fork", "content": "#!/bin/sh\n\n# Usage: ssh git@host fork \n#\n# Forks repo1 to repo2. You must have read permissions on repo1, and create\n# (\"C\") permissions for repo2, which of course must not exist.\n#\n# A fork is functionally the same as cloning repo1 to a client and pushing it\n# to a new repo2. It's just a little more efficient, not just in network\n# traffic but because it uses git clone's \"-l\" option to share the object\n# store also, so it is likely to be almost instantaneous, regardless of how\n# big the repo actually is.\n\ndie() { echo \"$@\" >&2; exit 1; }\nusage() { perl -lne 'print substr($_, 2) if /^# Usage/../^$/' < $0; exit 1; }\n[ -z \"$1\" ] && usage\n[ \"$1\" = \"-h\" ] && usage\n[ -z \"$GL_USER\" ] && die GL_USER not set\n\n# ----------------------------------------------------------------------\nfrom=$1; shift\nto=$1; shift\n[ -z \"$to\" ] && usage\n\ngitolite access -q \"$from\" $GL_USER R any || die \"'$from' does not exist or you are not allowed to read it\"\ngitolite access -q \"$to\" $GL_USER ^C any || die \"'$to' already exists or you are not allowed to create it\"\n\n# ----------------------------------------------------------------------\n# IMPORTANT NOTE: checking whether someone can create a repo is done as above.\n# However, make sure that the env var GL_USER is set, and that too to the same\n# value as arg-2 of the access command), otherwise it won't work.\n\n# Ideally, you'll leave such code to me. There's a reason ^C is not listed in\n# the help message for 'gitolite access'.\n# ----------------------------------------------------------------------\n\n# clone $from to $to\ngit clone --bare -l $GL_REPO_BASE/$from.git $GL_REPO_BASE/$to.git\n[ $? -ne 0 ] && exit 1\n\necho \"$from forked to $to\" >&2\n\n# fix up creator, default role permissions (gl-perms), and hooks\ncd $GL_REPO_BASE/$to.git\necho $GL_USER > gl-creator\n\ngitolite query-rc -q LOCAL_CODE && ln -sf `gitolite query-rc LOCAL_CODE`/hooks/common/* hooks\nln -sf `gitolite query-rc GL_ADMIN_BASE`/hooks/common/* hooks\n\n# record where you came from\necho \"$from\" > gl-forked-from\n\n# cache control, if rc says caching is on\ngitolite query-rc -q CACHE && perl -I$GL_LIBDIR -MGitolite::Cache -e \"cache_control('flush', '$to')\";\n\n# trigger post_create\ngitolite trigger POST_CREATE $to $GL_USER fork\n" }, { "path": "src/commands/git-annex-shell", "content": "#!/usr/bin/perl\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Easy;\n\n# This command requires unrestricted arguments, so add it to the ENABLE list\n# like this:\n# 'git-annex-shell ua',\n\n# This requires git-annex version 20111016 or newer. Older versions won't\n# be secure.\n\nuse strict;\nuse warnings;\n\n# ignore @ARGV and look at the original unmodified command\nmy $cmd = $ENV{SSH_ORIGINAL_COMMAND};\n\n# Expect commands like:\n# git-annex-shell 'configlist' '/~/repo'\n# git-annex-shell 'configlist' '/repo'\n# git-annex-shell 'sendkey' '/~/repo' 'key'\n# The parameters are always single quoted, and the repo path is always\n# the second parameter.\n# Further parameters are not validated here (see below).\ndie \"bad git-annex-shell command: $cmd\"\n unless $cmd =~ m#^(git-annex-shell '\\w+' ')/(?:\\~/)?([0-9a-zA-Z][0-9a-zA-Z._\\@/+-]*)('( .*|))$#;\nmy $start = $1;\nmy $repo = $2;\nmy $end = $3;\n$repo =~ s/\\.git$//;\ndie \"I dont like some of the characters in $repo\\n\" unless $repo =~ $Gitolite::Rc::REPONAME_PATT;\ndie \"I dont like absolute paths in $cmd\\n\" if $repo =~ /^\\//;\ndie \"I dont like '..' paths in $cmd\\n\" if $repo =~ /\\.\\./;\n\n# Modify $cmd, fixing up the path to the repo to include GL_REPO_BASE.\nmy $newcmd = \"$start$rc{GL_REPO_BASE}/$repo$end\";\n\n# Rather than keeping track of which git-annex-shell commands\n# require write access and which are readonly, we tell it\n# when readonly access is needed.\nif ( can_write($repo) ) {\n} elsif ( can_read($repo) ) {\n $ENV{GIT_ANNEX_SHELL_READONLY} = 1;\n} else {\n die \"$repo $ENV{GL_USER} DENIED\\n\";\n}\n# Further limit git-annex-shell to safe commands (avoid it passing\n# unknown commands on to git-shell)\n$ENV{GIT_ANNEX_SHELL_LIMITED} = 1;\n\n# Note that $newcmd does *not* get evaluated by the unix shell.\n# Instead it is passed as a single parameter to git-annex-shell for\n# it to parse and handle the command. This is why we do not need to\n# fully validate $cmd above.\nGitolite::Common::gl_log( $ENV{SSH_ORIGINAL_COMMAND} );\nexec \"git-annex-shell\", \"-c\", $newcmd;\n\n__END__\n\nINSTRUCTIONS... (NEED TO BE VALIDATED BY SOMEONE WHO KNOWS GIT-ANNEX WELL).\n\nbased on http://git-annex.branchable.com/tips/using_gitolite_with_git-annex/\nONLY VARIATIONS FROM THAT PAGE ARE WRITTEN HERE.\n\nsetup\n\n * in the ENABLE list in the rc file, add an entry like this:\n 'git-annex-shell ua',\n\nThat should be it; everything else should be as in that page.\n" }, { "path": "src/commands/git-config", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\nuse Getopt::Long;\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Rc;\nuse Gitolite::Common;\nuse Gitolite::Conf::Load;\n\n=for usage\nUsage: gitolite git-config [-n] [-q] [-r] \n\nPrint git config keys and values for the given repo. The key is either a full\nkey, or, if '-r' is supplied, a regex that is applied to all available keys.\n\n -q exit code only (shell truth; 0 is success)\n -n suppress trailing newline when used as key (not pattern)\n -r treat key as regex pattern (unanchored)\n -ev print keys with empty values also (see below)\n\nExamples:\n gitolite git-config repo gitweb.owner\n gitolite git-config -q repo gitweb.owner\n gitolite git-config -r repo gitweb\n\nNotes:\n\n1. When the key is treated as a pattern, prints:\n\n reponamekeyvalue\n\n Otherwise the output is just the value.\n\n2. By default, keys with empty values (specified as \"\" in the conf file) are\n treated as non-existant. Using '-ev' will print those keys also. Note\n that this only makes sense when the key is treated as a pattern, where\n such keys are printed as:\n\n reponamekey\n\n3. Finally, see the advanced use section of 'gitolite access -h' -- you can\n do something similar here also:\n\n gitolite list-phy-repos | gitolite git-config -r % gitweb\\\\. | cut -f1 > ~/projects.list\n=cut\n\nusage() if not @ARGV;\n\nmy ( $help, $nonl, $quiet, $regex, $ev ) = (0) x 5;\nGetOptions(\n 'n' => \\$nonl,\n 'q' => \\$quiet,\n 'r' => \\$regex,\n 'h' => \\$help,\n 'ev' => \\$ev,\n) or usage();\n\nmy ( $repo, $key ) = @ARGV;\nusage() unless $key;\n\nmy $ret = '';\n\nif ( $repo ne '%' and $key ne '%' ) {\n # single repo, single key; no STDIN\n $key = \"^\\Q$key\\E\\$\" unless $regex;\n\n $ret = git_config( $repo, $key, $ev );\n\n # if the key is not a regex, it should match at most one item\n _die \"found more than one entry for '$key'\" if not $regex and scalar( keys %$ret ) > 1;\n\n # unlike access, there's nothing to print if we don't find any matching keys\n exit 1 unless %$ret;\n\n if ($regex) {\n map { print \"$repo\\t$_\\t\" . $ret->{$_} . \"\\n\" } sort keys %$ret unless $quiet;\n } else {\n map { print $ret->{$_} . ( $nonl ? \"\" : \"\\n\" ) } sort keys %$ret unless $quiet;\n }\n exit 0;\n}\n\n$repo = '' if $repo eq '%';\n$key = '' if $key eq '%';\n\n_die \"'-q' doesn't go with using a pipe\" if $quiet;\n@ARGV = ();\nwhile (<>) {\n my @in = split;\n my $r = $repo || shift @in;\n my $k = $key || shift @in;\n $k = \"^\\Q$k\\E\\$\" unless $regex;\n $ret = git_config( $r, $k, $ev );\n next unless %$ret;\n map { print \"$r\\t$_\\t\" . $ret->{$_} . \"\\n\" } sort keys %$ret;\n}\n" }, { "path": "src/commands/help", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Rc;\nuse Gitolite::Common;\n\n=for usage\nUsage: ssh git@host help # via ssh\n gitolite help # directly on server command line\n\nPrints a list of custom commands available at this gitolite installation.\n\nEach command has (or should have!) its own help, accessed by passing it the\n'-h' option; e.g., \"gitolite access -h\".\n\nNOTE: These commands are found in the commands subdirectory (see the page on\n\"core and non-core gitolite\" in the documentation). Gitolite also has some\nbuilt-in commands; run just \"gitolite\", with no arguments, to see those.\n=cut\n\nusage() if @ARGV;\n\nprint greeting();\n\nmy $user = $ENV{GL_USER} || '';\nprint \"list of \" . ( $user ? \"remote\" : \"gitolite\" ) . \" commands available:\\n\\n\";\n\nmy %list = ( list_x( $ENV{GL_BINDIR} ), list_x( $rc{LOCAL_CODE} || '' ) );\nfor ( sort keys %list ) {\n print \"\\t$list{$_}\" if $ENV{D};\n print \"\\t$_\\n\" if not $user or $rc{COMMANDS}{$_};\n}\n\nprint \"\\n\";\nprint \"$rc{SITE_INFO}\\n\" if $rc{SITE_INFO};\n\nexit 0;\n\n# ------------------------------------------------------------------------------\nsub list_x {\n my $d = shift;\n return unless $d;\n return unless -d \"$d/commands\";\n _chdir \"$d/commands\";\n return map { $_ => $d } grep { -x $_ } map { chomp; s(^./)(); $_ } `find . -type f -o -type l|sort`;\n}\n" }, { "path": "src/commands/htpasswd", "content": "#!/usr/bin/perl\n\nuse strict;\nuse warnings;\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Rc;\nuse Gitolite::Common;\n\n=for usage\nUsage: ssh git@host htpasswd\n\nSets your htpasswd, assuming your admin has enabled it.\n\n(Admins: You need to add HTPASSWD_FILE to the rc file, pointing to an\nexisting, writable, but possibly an initially empty, file, as well as adding\n'htpasswd' to the ENABLE list).\n=cut\n\n# usage and sanity checks\nusage() if @ARGV and $ARGV[0] eq '-h';\n$ENV{GL_USER} or _die \"GL_USER not set\";\nmy $htpasswd_file = $rc{HTPASSWD_FILE} || '';\ndie \"htpasswd not enabled\\n\" unless $htpasswd_file;\ndie \"$htpasswd_file doesn't exist or is not writable\\n\" unless -w $htpasswd_file;\n\n# prompt\n$|++;\nprint <;\n$password =~ s/[\\n\\r]*$//;\ndie \"empty passwords are not allowed\\n\" unless $password;\nmy $res = system( \"htpasswd\", \"-mb\", $htpasswd_file, $ENV{GL_USER}, $password );\ndie \"htpasswd command seems to have failed with return code: $res.\\n\" if $res;\n" }, { "path": "src/commands/info", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\nuse Getopt::Long;\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Rc;\nuse Gitolite::Common;\nuse Gitolite::Conf::Load;\n\n=for args\nUsage: gitolite info [-lc] [-ld] [-json] []\n\nList all existing repos you can access, as well as repo name patterns (see\n\"wild repos\") you have any kind of access to.\n\n '-lc' lists creators as an additional field at the end.\n '-ld' lists description as an additional field at the end.\n '-json' produce JSON output instead of normal output\n '-p' limits output to physical repos only (no wild repo regexes!)\n\nThe optional pattern is an unanchored regex that will limit the repos\nsearched, in both cases. It might speed up things a little if you have more\nthan a few thousand repos.\n=cut\n\n# these are globals\nmy ( $lc, $ld, $json, $p, $patt ) = args();\nmy %out; # holds info to be json'd\n\n$ENV{GL_USER} or _die \"GL_USER not set\";\nif ($json) {\n greeting(\\%out);\n} else {\n print greeting();\n}\n\nprint_patterns() unless $p; # repos he can create for himself\nprint_phy_repos(); # repos already created\n\nif ( $rc{SITE_INFO} ) {\n $json\n ? $out{SITE_INFO} = $rc{SITE_INFO}\n : print \"\\n$rc{SITE_INFO}\\n\";\n}\n\nprint JSON::to_json( \\%out, { utf8 => 1, pretty => 1 } ) if $json;\n\n# ----------------------------------------------------------------------\n\nsub args {\n my ( $lc, $ld, $json, $p, $patt ) = ( '', '', '', '' );\n my $help = '';\n\n GetOptions(\n 'lc' => \\$lc,\n 'ld' => \\$ld,\n 'json' => \\$json,\n 'p' => \\$p,\n 'h' => \\$help,\n ) or usage();\n\n usage() if @ARGV > 1 or $help;\n $patt = shift @ARGV || '.';\n\n require JSON if $json;\n\n return ( $lc, $ld, $json, $p, $patt );\n}\n\nsub print_patterns {\n my ( $repos, @aa );\n\n my $lm = \\&Gitolite::Conf::Load::list_members;\n\n # find repo patterns only, call them with ^C flag included\n @$repos = grep { !/$REPONAME_PATT/ } map { /^@/ ? @{ $lm->($_) } : $_ } @{ lister_dispatch('list-repos')->() };\n @aa = qw(R W ^C);\n listem( $repos, '', '', @aa );\n # but squelch the 'lc' and 'ld' flags for these\n}\n\nsub print_phy_repos {\n my ( $repos, @aa );\n\n # now get the actual repos and get R or W only\n _chdir( $rc{GL_REPO_BASE} );\n $repos = list_phy_repos(1);\n @aa = qw(R W);\n listem( $repos, $lc, $ld, @aa );\n}\n\nsub listem {\n my ( $repos, $lc, $ld, @aa ) = @_;\n my @list;\n my $mlr = 0; # max length of reponame\n my $mlc = 0; # ...and creator\n for my $repo (@$repos) {\n next unless $repo =~ /$patt/;\n my $creator = '';\n my $desc = '';\n my $perm = '';\n $creator = creator($repo) if $lc;\n\n if ($ld) {\n # use config value first, else 'description' file as second choice\n my $k = 'gitweb.description';\n my $d = \"$ENV{GL_REPO_BASE}/$repo.git/description\";\n $desc = git_config( $repo, $k )->{$k} || '';\n if ( !$desc and -r $d ) {\n $desc = slurp($d);\n chomp($desc);\n }\n }\n\n for my $aa (@aa) {\n my $ret = access( $repo, $ENV{GL_USER}, $aa, 'any' );\n $perm .= ( $ret =~ /DENIED/ ? \" \" : \" $aa\" );\n }\n $perm =~ s/\\^//;\n next unless $perm =~ /\\S/;\n\n if ($json) {\n $out{repos}{$repo}{creator} = $creator if $lc;\n $out{repos}{$repo}{description} = $desc if $ld;\n $out{repos}{$repo}{perms} = _hash($perm);\n } else {\n $mlr = length($repo) if ( $lc or $ld ) and $mlr < length($repo);\n $mlc = length($creator) if $lc and $ld and $mlc < length($creator);\n push @list, [ $perm, $repo, $creator, $desc ];\n }\n }\n return if $json;\n\n my $fmt = \"%s\\t%-${mlr}s\\t%-${mlc}s\\t%s\\n\";\n map { s/\\t\\t/\\t/; s/\\s*$/\\n/; print } map { sprintf $fmt, @$_ } @list;\n}\n\nsub _hash {\n my $in = shift;\n my %out = map { $_ => 1 } ( $in =~ /(\\S)/g );\n return \\%out;\n}\n" }, { "path": "src/commands/list-dangling-repos", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Common;\nuse Gitolite::Conf::Load;\n\n=for usage\nUsage: gitolite list-dangling-repos\n\nList all existing repos that no one can access remotely any more. They could\nbe normal repos that were taken out of \"repo\" statements in the conf file, or\nwildcard repos whose matching \"wild\" pattern was taken out or changed so it no\nlonger matches.\n\nI would advise caution if you use this as a basis for deleting repos from the\nfile system. A bug in this program could cause you to lose important data!\n=cut\n\nusage() if @ARGV and $ARGV[0] eq '-h';\n\n# get the two lists we need. %repos is the list of repos in \"repo\" statements\n# in the conf file. %phy_repos is the list of actual repos on disk. Our job\n# is to cull %phy_repos of all keys that have a matching key in %repos, where\n# \"matching\" means \"string equal\" or \"regex match\".\nmy %repos = map { chomp; $_ => 1 } `gitolite list-repos`;\nfor my $r ( grep /^@/, keys %repos ) {\n map { chomp; $repos{$_} = 1; } `gitolite list-members $r`;\n}\nmy %phy_repos = map { chomp; $_ => 1 } `gitolite list-phy-repos`;\n\n# Remove exact matches. But for repo names like \"gtk+\", you could have\n# collapsed this into the next step (the regex match).\nfor my $pr ( keys %phy_repos ) {\n next unless exists $repos{$pr};\n delete $repos{$pr};\n delete $phy_repos{$pr};\n}\n\n# Remove regex matches.\nfor my $pr ( keys %phy_repos ) {\n my $matched = 0;\n my $pr2 = Gitolite::Conf::Load::generic_name($pr);\n for my $r ( keys %repos ) {\n if ( $pr =~ /^$r$/ or $pr2 =~ /^$r$/ ) {\n $matched = 1;\n next;\n }\n }\n delete $phy_repos{$pr} if $matched;\n}\n\n# what's left in %phy_repos are dangling repos.\nprint join( \"\\n\", sort keys %phy_repos ), \"\\n\";\n" }, { "path": "src/commands/lock", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\nuse Getopt::Long;\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Rc;\nuse Gitolite::Common;\nuse Gitolite::Conf::Load;\n\n# gitolite command to lock and unlock (binary) files and deal with locks.\n\n=for usage\nUsage: ssh git@host lock -l # lock a file\n ssh git@host lock -u # unlock a file\n ssh git@host lock --break # break someone else's lock\n ssh git@host lock -ls # list locked files for repo\n\nSee doc/locking.mkd for other details.\n=cut\n\nusage() if not @ARGV or $ARGV[0] eq '-h';\n$ENV{GL_USER} or _die \"GL_USER not set\";\n\nmy $op = '';\n$op = 'lock' if $ARGV[0] eq '-l';\n$op = 'unlock' if $ARGV[0] eq '-u';\n$op = 'break' if $ARGV[0] eq '--break';\n$op = 'list' if $ARGV[0] eq '-ls';\nusage() if not $op;\nshift;\n\nmy $repo = shift;\n_die \"You are not authorised\" if access( $repo, $ENV{GL_USER}, 'W', 'any' ) =~ /DENIED/;\n_die \"You are not authorised\" if $op eq 'break' and access( $repo, $ENV{GL_USER}, '+', 'any' ) =~ /DENIED/;\n\nmy $file = shift || '';\nusage() if $op ne 'list' and not $file;\n\n_chdir( $ENV{GL_REPO_BASE} );\n_chdir(\"$repo.git\");\n\n_die \"aborting, file '$file' not found in any branch\" if $file and not object_exists($file);\n\nmy $ff = \"gl-locks\";\n\nif ( $op eq 'lock' ) {\n f_lock( $repo, $file );\n} elsif ( $op eq 'unlock' ) {\n f_unlock( $repo, $file );\n} elsif ( $op eq 'break' ) {\n f_break( $repo, $file );\n} elsif ( $op eq 'list' ) {\n f_list($repo);\n}\n\n# ----------------------------------------------------------------------\n# For a given path, return 1 if object exists in any branch, 0 if not.\n# This is to prevent locking invalid objects.\n\nsub object_exists {\n my $file = shift;\n\n my @branches = `git for-each-ref refs/heads '--format=%(refname)'`;\n foreach my $b (@branches) {\n chomp($b);\n system(\"git cat-file -e $b:$file 2>/dev/null\") or return 1;\n # note that with system(), the return value is \"shell truth\", so\n # you check for success with \"or\", not \"and\"\n }\n return 0; # report object not found\n}\n\n# ----------------------------------------------------------------------\n# everything below assumes we have already chdir'd to \"$repo.git\". Also, $ff\n# is used as a global.\n\nsub f_lock {\n my ( $repo, $file ) = @_;\n\n my %locks = get_locks();\n _die \"'$file' locked by '$locks{$file}{USER}' since \" . localtime( $locks{$file}{TIME} ) if $locks{$file}{USER};\n $locks{$file}{USER} = $ENV{GL_USER};\n $locks{$file}{TIME} = time;\n put_locks(%locks);\n}\n\nsub f_unlock {\n my ( $repo, $file ) = @_;\n\n my %locks = get_locks();\n _die \"'$file' not locked by '$ENV{GL_USER}'\" if ( $locks{$file}{USER} || '' ) ne $ENV{GL_USER};\n delete $locks{$file};\n put_locks(%locks);\n}\n\nsub f_break {\n my ( $repo, $file ) = @_;\n\n my %locks = get_locks();\n _die \"'$file' was not locked\" unless $locks{$file};\n push @{ $locks{BREAKS} }, time . \" $ENV{GL_USER} $locks{$file}{USER} $locks{$file}{TIME} $file\";\n delete $locks{$file};\n put_locks(%locks);\n}\n\nsub f_list {\n my $repo = shift;\n\n my %locks = get_locks();\n print \"\\n# locks held:\\n\\n\";\n map { print \"$locks{$_}{USER}\\t$_\\t(\" . scalar( localtime( $locks{$_}{TIME} ) ) . \")\\n\" } grep { $_ ne 'BREAKS' } sort keys %locks;\n print \"\\n# locks broken:\\n\\n\";\n for my $b ( @{ $locks{BREAKS} } ) {\n my ( $when, $who, $whose, $how_old, $what ) = split ' ', $b;\n print \"$who\\t$what\\t(\" . scalar( localtime($when) ) . \")\\t(locked by $whose at \" . scalar( localtime($how_old) ) . \")\\n\";\n }\n}\n\nsub get_locks {\n if ( -f $ff ) {\n our %locks;\n\n my $t = slurp($ff);\n eval $t;\n _die \"do '$ff' failed with '$@', contact your administrator\" if $@;\n\n return %locks;\n }\n return ();\n}\n\nsub put_locks {\n my %locks = @_;\n\n use Data::Dumper;\n $Data::Dumper::Indent = 1;\n $Data::Dumper::Sortkeys = 1;\n\n my $dumped_data = Data::Dumper->Dump( [ \\%locks ], [qw(*locks)] );\n _print( $ff, $dumped_data );\n}\n" }, { "path": "src/commands/mirror", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\nmy $tid;\n\nBEGIN {\n $tid = $ENV{GL_TID} || 0;\n delete $ENV{GL_TID};\n}\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Rc;\nuse Gitolite::Common;\nuse Gitolite::Conf::Load;\n\n=for usage\nUsage 1: gitolite mirror push \n gitolite mirror status \n gitolite mirror status all \n gitolite mirror status all all\nUsage 2: ssh git@master-server mirror push \n ssh git@master-server mirror status \n\nForces a push of one repo to one copy.\n\nUsage 1 is directly on the master server. Nothing is checked; if the copy\naccepts it, the push happens, even if the copy is not in any copies\noption. This is how you do delayed or lagged pushes to servers that do not\nneed real-time updates or have bandwidth/connectivity issues.\n\nUsage 2 can be initiated by *any* user who has *any* gitolite access to the\nmaster server, but it checks that the copy is in one of the copies options\nbefore doing the push.\n\nMIRROR STATUS: The usage examples above show what can be done. The 'status\nall ' usage checks the status of all the copies defined for the given\nrepo. The 'status all all' usage is special, in that it only prints a list of\nrepos that have *some* error, instead of dumping all the error info itself.\n\nSERVER LIST: 'gitolite mirror list master ' and 'gitolite mirror\nlist copies ' will show you the name of the master server, and list\nthe copy servers, for the repo. They only work on the server command line\n(any server), but not remotely (from a normal user).\n=cut\n\nusage() if not @ARGV or $ARGV[0] eq '-h';\n\n_die \"HOSTNAME not set\" if not $rc{HOSTNAME};\n\nmy ( $cmd, $host, $repo ) = @ARGV;\n$host = 'copies' if $host eq 'slaves';\n$repo =~ s/\\.git$//;\nusage() if not $repo;\n\nif ( $cmd eq 'push' ) {\n valid_copy( $host, $repo ) if exists $ENV{GL_USER};\n # will die if host not in copies for repo\n\n trace( 1, \"TID=$tid host=$host repo=$repo\", \"gitolite mirror push started\" );\n _chdir( $rc{GL_REPO_BASE} );\n _chdir(\"$repo.git\");\n\n if ( -f \"gl-creator\" ) {\n # try to propagate the wild repo, including creator name and gl-perms\n my $creator = `cat gl-creator`; chomp($creator);\n trace( 1, `cat gl-perms 2>/dev/null | ssh $host CREATOR=$creator perms -c \\\\'$repo\\\\' 2>/dev/null` );\n }\n\n my $errors = 0;\n my $glss = '';\n for (`git push --mirror $host:$repo 2>&1`) {\n $errors = 1 if $?;\n print STDERR \"$_\" if -t STDERR or exists $ENV{GL_USER};\n $glss .= $_;\n chomp;\n if (/FATAL/) {\n $errors = 1;\n gl_log( 'mirror', $_ );\n } else {\n trace( 1, \"mirror: $_\" );\n }\n }\n # save the mirror push status for this copy if the word 'fatal' is found,\n # else remove the status file. We don't store \"success\" output messages;\n # you can always get those from the log files if you really need them.\n if ( $glss =~ /fatal/i ) {\n my $glss_prefix = Gitolite::Common::gen_ts() . \"\\t$ENV{GL_TID}\\t\";\n $glss =~ s/^/$glss_prefix/gm;\n _print(\"gl-copy-$host.status\", $glss);\n } else {\n unlink \"gl-copy-$host.status\";\n }\n\n exit $errors;\n} elsif ($cmd eq 'status') {\n if (not exists $ENV{GL_USER} and $repo eq 'all') {\n # this means 'gitolite mirror status all all'; in this case we only\n # return a list of repos that *have* status files (indicating some\n # problem). It's upto you what you do with that list. This is not\n # allowed to be run remotely; far too wide ranging, sorry.\n _chdir( $rc{GL_REPO_BASE} );\n my $phy_repos = list_phy_repos(1);\n for my $repo ( @{$phy_repos} ) {\n my @x = glob(\"$rc{GL_REPO_BASE}/$repo.git/gl-copy-*.status\");\n print \"$repo\\n\" if @x;\n }\n exit 0;\n }\n\n valid_copy( $host, $repo ) if exists $ENV{GL_USER};\n # will die if host not in copies for repo\n\n _chdir( $rc{GL_REPO_BASE} );\n _chdir(\"$repo.git\");\n\n $host = '*' if $host eq 'all';\n map { print_status($repo, $_) } sort glob(\"gl-copy-$host.status\");\n} else {\n # strictly speaking, we could allow some of the possible commands remotely\n # also, at least for admins. However, these commands are mainly intended\n # for server-side scripting so I don't care.\n usage() if $ENV{GL_USER};\n\n server_side_commands(@ARGV);\n}\n\n# ----------------------------------------------------------------------\n\nsub valid_copy {\n my ( $host, $repo ) = @_;\n _die \"invalid repo '$repo'\" unless $repo =~ $REPONAME_PATT;\n\n my %list = repo_copies($repo);\n _die \"'$host' not a valid copy for '$repo'\" unless $list{$host};\n}\n\nsub repo_copies {\n my $repo = shift;\n\n my $ref = git_config( $repo, \"^gitolite-options\\\\.mirror\\\\.copies.*\" );\n my %list = map { $_ => 1 } map { split } values %$ref;\n\n return %list;\n}\n\nsub repo_master {\n my $repo = shift;\n\n my $ref = git_config( $repo, \"^gitolite-options\\\\.mirror\\\\.master\\$\" );\n my @list = map { split } values %$ref;\n _die \"'$repo' seems to have more than one master\" if @list > 1;\n\n return $list[0] || '';\n}\n\nsub print_status {\n my $repo = shift;\n my $file = shift;\n return unless -f $file;\n my $copy = $1 if $file =~ /^gl-copy-(.+)\\.status$/;\n print \"----------\\n\";\n print \"WARNING: previous mirror push of repo '$repo' to host '$copy' failed, status is:\\n\";\n print slurp($file);\n print \"----------\\n\";\n}\n\n# ----------------------------------------------------------------------\n# server side commands. Very little error checking.\n# gitolite mirror list master \n# gitolite mirror list copies \n\nsub server_side_commands {\n if ( $cmd eq 'list' ) {\n if ( $host eq 'master' ) {\n say repo_master($repo);\n } elsif ( $host eq 'copies' ) {\n my %list = repo_copies($repo);\n say join( \" \", sort keys %list );\n } else {\n _die \"gitolite mirror list master|copies \";\n }\n } else {\n _die \"invalid command\";\n }\n}\n" }, { "path": "src/commands/motd", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Easy;\n\n=for usage\nUsage: ssh git@host motd rm\n cat | ssh git@host motd set\n\nRemove or set the motd file for repo or the whole system.\n\nFor a repo: you need to have write access to the repo and the\n'writer-is-owner' option must be set for the repo, or it must be a\nuser-created ('wild') repo and you must be the owner.\n\nFor the whole system: you need to be an admin (have write access to the\ngitolite-admin repo). Use @all in place of the repo name.\n\nPLEASE NOTE that if you're using http mode, the motd will only appear for\ngitolite commands, not for normal git operations. This in turn means that\nonly the system wide motd can be seen; repo level motd's never show up.\n=cut\n\nusage() if not @ARGV or @ARGV < 1 or $ARGV[0] eq '-h';\n\nmy $repo = shift;\nmy $op = shift || '';\nusage() if $op ne 'rm' and $op ne 'set';\nmy $file = \"gl-motd\";\n\n#<<<\n_die \"you are not authorized\" unless\n ( $repo eq '@all' and is_admin() ) or\n ( $repo ne '@all' and owns($repo) ) or\n ( $repo ne '@all' and can_write($repo) and option( $repo, 'writer-is-owner' ) );\n#>>>\n\nmy @out =\n $repo eq '@all'\n ? ( dir => $rc{GL_ADMIN_BASE} )\n : ( repo => $repo );\n\nif ( $op eq 'rm' ) {\n $repo eq '@all'\n ? unlink \"$rc{GL_ADMIN_BASE}/$file\"\n : unlink \"$rc{GL_REPO_BASE}/$repo.git/$file\";\n} elsif ( $op eq 'set' ) {\n textfile( file => $file, @out, prompt => '' );\n} else {\n print textfile( file => $file, @out, );\n}\n" }, { "path": "src/commands/newbranch", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Easy;\n\n=for usage\nUsage: ssh git@host newbranch \n\nCreate a new branch and set it to existing branch or tag. You should have\nwrite access to that branch.\n\nNOTE: runs \"git branch arg-2 arg-3\" in repo given by arg-1, which means you\nshould NOT prefix arguments with \"refs/heads/\" or \"refs/tags/\".\n\n----\n\nThis is for people who have restrictions on what files they can \"touch\". When\nyou fork a branch and change a file, even if you changed only the files you're\nallowed to, gitolite thinks you changed *all* the files in the repo because\nthe \"old SHA\" is basically empty.\n\nThis helps get around that by first creating the new branch, so that you can\nthen push to it.\n\nTo enable this command, add it to the rc file as a 'command'.\n\nTODO: handle deletes also (less commonly encountered and left as an \"exercise\nfor the reader\" for now!)\n=cut\n\nusage() if not @ARGV or @ARGV < 3 or $ARGV[0] eq '-h';\n\nmy $repo = shift;\nmy $newbr = shift;\nmy $oldref = shift;\n\n_die \"you are not authorized\" unless can_write($repo, \"W\", \"refs/heads/$newbr\");\n\nGitolite::Common::_system(\"git\", \"branch\", $newbr, $oldref);\n" }, { "path": "src/commands/option", "content": "#!/usr/bin/perl\n\n# ----------------------------------------------------------------------\n# gitolite command to allow repo \"owners\" to set \"options\" on repos\n\n# This command can be run by a user to set \"options\" for any repo that she\n# owns.\n#\n# However, gitolite does *not* have the concept of an incremental \"compile\",\n# and options are only designed to be specified in the gitolite.conf file\n# (which a user should not be able to even see!). Therefore, we allow one\n# specific file (conf/options.conf) to be manipulated by a remote user in a\n# *controlled* fashion, and this file is \"include\"d in the main gitolite.conf\n# file.\n\n# WARNINGS:\n# 1. Runs \"gitolite compile\" at the end. On really huge systems (where the\n# sum total of the conf files is in the order of tens of thousands of\n# lines) this may take a second or two :)\n# 2. Since \"options.conf\" is not part of the admin repo, you may need to\n# back it up separately, just like you currently back up gl-creator and\n# gl-perms files from individual repos.\n# 3. \"options.conf\" is formatted very strictly because it's not meant to be\n# human edited. If you edit it directly on the server, be careful.\n\n# Relevant gitolite doc links:\n# \"wild\" repos and \"owners\"\n# http://gitolite.com/gitolite/wild.html\n# http://gitolite.com/gitolite/wild.html#specifying-owners\n# http://gitolite.com/gitolite/wild.html#appendix-1-owner-and-creator\n# gitolite \"options\"\n# http://gitolite.com/gitolite/options.html\n# the \"include\" statement\n# http://gitolite.com/gitolite/conf.html#include-files\n\n# setup:\n# 1. Enable the command by adding it to the ENABLE list in the rc file.\n#\n# 2. Make sure your gitolite.conf has this line at the end:\n#\n# include \"options.conf\"\n#\n# then add/commit/push.\n#\n# Do NOT add a file called \"options.conf\" to your gitolite-admin repo!\n# This means every time you compile (push the admin repo) you will get a\n# warning about the missing file.\n#\n# You can either \"touch ~/.gitolite/conf/options.conf\" on the server, or\n# take *any* wild repo and add *any* option to create it.\n#\n# 3. Specify options allowed to be changed by the user. For example:\n#\n# repo foo/..*\n# C = blah blah\n# ...other rules...\n# option user-options = hook\\..* foo bar[0-9].*\n#\n# Users can then set any of these options, but no others.\n\n# ----------------------------------------------------------------------\n\nuse strict;\nuse warnings;\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Easy;\nuse Gitolite::Common;\n\n# ----------------------------------------------------------------------\n# usage and arg checks\n\n=for usage\nUsage: ssh git@host option add \n ssh git@host option del \n ssh git@host option list\n\nAdd, delete, or list options for wild repos. Keys must match one of the\nallowed patterns; your system administrator will tell you what they are.\n\nDoesn't check things like adding a key that already exists (simply overwrites\nwithout warning), deleting a key that doesn't, etc.\n=cut\n\nusage() if not @ARGV or $ARGV[0] eq '-h';\n\nmy $OPTIONS = \"$ENV{HOME}/.gitolite/conf/options.conf\";\n\nmy $repo = shift;\ndie \"sorry, you are not authorised\\n\" unless owns($repo);\n\nmy $op = shift; usage() unless $op =~ /^(add|del|list)$/;\nmy $key = shift; usage() if not $key and $op ne 'list';\nmy $val = shift; usage() if not $val and $op eq 'add';\n\n_print( $OPTIONS, \"\" ) unless -f $OPTIONS; # avoid error on first run\nmy $options = slurp($OPTIONS);\n\n# ----------------------------------------------------------------------\n# get 'list' out of the way first\nif ( $op eq 'list' ) {\n print \"$1\\t$2\\n\" while $options =~ /^repo $repo\\n option (\\S+) = (.*)/mg;\n exit 0;\n}\n\n# ----------------------------------------------------------------------\n# that leaves 'add' or 'del'\n\n# NOTE: sanity check on characters in key and val not needed;\n# REMOTE_COMMAND_PATT is more restrictive than UNSAFE_PATT anyway!\n\n# check if the key is allowed\nmy $user_options = option( $repo, 'user-options' );\n# this is a space separated list of allowed option keys\nmy @validkeys = split( ' ', ( $user_options || '' ) );\nmy @matched = grep { $key =~ /^$_$/i } @validkeys;\n_die \"option '$key' not allowed\\n\" if ( @matched < 1 );\n\n# delete anyway\n$options =~ s/^repo $repo\\n option $key = .*\\n//m;\n# then re-add if needed\n$options .= \"repo $repo\\n option $key = $val\\n\" if $op eq 'add';\n\n# ----------------------------------------------------------------------\n# save and compile\n_print( $OPTIONS, $options );\nsystem(\"gitolite compile\");\n" }, { "path": "src/commands/owns", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Easy;\n\n=for usage\nUsage: gitolite owns \n\nChecks if $GL_USER is an owner of the repo and returns an exit code (shell\ntruth, 0 for success), which makes it possible to do this in shell:\n\n if gitolite owns someRepo\n then\n ...\n=cut\n\nusage() if not @ARGV or $ARGV[0] eq '-h';\nmy $repo = shift;\n\nexit not owns($repo);\n" }, { "path": "src/commands/perms", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Rc;\nuse Gitolite::Common;\nuse Gitolite::Easy;\n\n=for usage\nperms -- list or set permissions for user-created (\"wild\") repo.\n\nUsage summary:\n ssh git@host perms -l\n # list current permissions on repo\n ssh git@host perms -lr\n # list available roles and their access rights\n\n ssh git@host perms + \n # change permissions: add a user to a role\n ssh git@host perms - \n # change permissions: remove a user from a role\n\nExamples:\n ssh git@host perms my/repo + READERS alice\n ssh git@host perms my/repo + WRITERS bob\n\n----\nThere is also a batch mode useful for scripting and bulk loading; see the\nsource code of the perms command for details.\n=cut\n\n# BATCH MODE: DO NOT combine this with the +/- mode above. This mode also\n# creates the repo if it does not already exist (assuming $GL_USER has\n# permissions to create it).\n#\n# Example:\n# cat copy-of-backed-up-gl-perms | ssh git@host perms -c \n\nusage() if not @ARGV or $ARGV[0] eq '-h' or @ARGV < 2;\n\n$ENV{GL_USER} or _die \"GL_USER not set\";\n\nmy $generic_error = \"repo does not exist, or you are not authorised\";\n\nif ( $ARGV[1] eq '-l' ) {\n getperms($ARGV[0]); # doesn't return\n}\n\n# auto-create the repo if -c passed and repo doesn't exist\nif ( $ARGV[0] eq '-c' ) {\n shift;\n my $repo = $ARGV[0] or usage();\n _die \"invalid repo '$repo'\" unless $repo =~ $REPONAME_PATT;\n\n if ( not -d \"$rc{GL_REPO_BASE}/$repo.git\" ) {\n unless ($ENV{GL_BYPASS_CREATOR_CHECK}) {\n my $ret = Gitolite::Conf::Load::access( $repo, $ENV{GL_USER}, '^C', 'any' );\n _die $generic_error if $ret =~ /DENIED/;\n }\n\n require Gitolite::Conf::Store;\n Gitolite::Conf::Store->import;\n new_wild_repo( $repo, $ENV{GL_USER}, 'perms-c' );\n gl_log( 'create', $repo, $ENV{GL_USER}, 'perms-c' );\n }\n}\n\nmy $repo = shift;\n\nif ( @ARGV and $ARGV[0] eq '-lr' ) {\n list_roles();\n exit 0;\n} else {\n setperms(@ARGV);\n}\n\n# cache control\nif ($rc{CACHE}) {\n require Gitolite::Cache;\n Gitolite::Cache::cache_control('flush', $repo);\n}\n\n_system( \"gitolite\", \"trigger\", \"POST_CREATE\", $repo, $ENV{GL_USER}, 'perms' );\n\n# ----------------------------------------------------------------------\n\nsub getperms {\n my $repo = shift;\n _die $generic_error if not owns($repo);\n my $pf = \"$rc{GL_REPO_BASE}/$repo.git/gl-perms\";\n\n print slurp($pf) if -f $pf;\n\n exit 0;\n}\n\nsub setperms {\n _die $generic_error if not owns($repo);\n my $pf = \"$rc{GL_REPO_BASE}/$repo.git/gl-perms\";\n\n if ( not @_ ) {\n # legacy mode; pipe data in\n print STDERR \"'batch' mode started, waiting for input (run with '-h' for details).\\n\";\n print STDERR \"Please enter 'cancel' to abort if you did not intend to do this.\\n\";\n @ARGV = ();\n my @a;\n while (<>) {\n _die \"CANCELLED\" if /^\\s*cancel\\s*$/i;\n invalid_role($1) if /(\\S+)/ and not $rc{ROLES}{$1};\n push @a, $_;\n }\n\n _print( $pf, @a );\n return;\n }\n\n _die \"Invalid syntax. Please re-run with '-h' for detailed usage\" if @_ != 3;\n my ( $op, $role, $user ) = @_;\n _die \"Invalid syntax. Please re-run with '-h' for detailed usage\" if $op ne '+' and $op ne '-';\n _die \"Invalid user '$user'\" if not $user =~ $USERNAME_PATT;\n\n my $text = '';\n my @text = slurp($pf) if -f $pf;\n\n my $present = grep { $_ eq \"$role $user\\n\" } @text;\n\n if ( $op eq '-' ) {\n if ( not $present ) {\n _warn \"'$role $user' was not present in file\";\n } else {\n @text = grep { $_ ne \"$role $user\\n\" } @text;\n _print( $pf, @text );\n }\n } else {\n invalid_role($role) unless grep { $_->[3] eq $role } load_roles();\n if ($present) {\n _warn \"'$role $user' already present in file\";\n } else {\n push @text, \"$role $user\\n\";\n @text = sort @text;\n _print( $pf, @text );\n }\n }\n}\n\nmy @rules;\n\nsub load_roles {\n return @rules if @rules;\n\n require Gitolite::Conf::Load;\n Gitolite::Conf::Load::load($repo);\n\n my %repos = %Gitolite::Conf::Load::repos;\n my @repo_memberships = Gitolite::Conf::Load::memberships('repo', $repo);\n\n for my $rp (@repo_memberships) {\n my $hr = $repos{$rp};\n for my $r ( keys %$hr ) {\n next unless $r =~ s/^@//;\n next unless $rc{ROLES}{$r};\n map { $_->[3] = $r } @{ $hr->{\"\\@$r\"} };\n push @rules, @{ $hr->{\"\\@$r\"} };\n }\n }\n return @rules;\n}\n\nsub invalid_role {\n my $role = shift;\n\n print STDERR \"Invalid role '$role'; valid roles for this repo:\\n\";\n open(STDOUT, '>&', \\*STDERR); # make list_roles print to STDERR\n list_roles();\n exit 1;\n}\n\nsub list_roles {\n\n my @rules = sort { $a->[0] <=> $b->[0] } load_roles();\n\n for (@rules) {\n $_->[2] =~ s(^refs/heads/)();\n $_->[2] = '--any--' if $_->[2] eq 'refs/.*';\n }\n\n my $max = 0;\n map { $max = $_ if $_ > $max } map { length($_->[2]) } @rules;\n printf(\"\\t%s\\t%*s\\t \\t%s\\n\", \"perm\", -$max, \"ref\", \"role\");\n printf(\"\\t%s\\t%*s\\t \\t%s\\n\", \"----\", -$max, \"---\", \"----\");\n printf(\"\\t%s\\t%*s\\t=\\t%s\\n\", $_->[1], -$max, $_->[2], $_->[3]) for @rules;\n}\n" }, { "path": "src/commands/print-default-rc", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Rc;\n\nprint glrc('default-text');\n" }, { "path": "src/commands/push", "content": "#!/bin/sh\n\nexport GL_BYPASS_ACCESS_CHECKS=1\n\ngit push \"$@\"\n" }, { "path": "src/commands/readme", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Easy;\n\n# README.html files work similar to \"description\" files. For further\n# information see\n# https://www.kernel.org/pub/software/scm/git/docs/gitweb.html\n# under \"Per-repository gitweb configuration\".\n\n=for usage\nUsage: ssh git@host readme \n ssh git@host readme rm\n cat | ssh git@host readme set\n\nShow, remove or set the README.html file for repo.\n\nYou need to have write access to the repo and the 'writer-is-owner' option\nmust be set for the repo, or it must be a user-created ('wild') repo and you\nmust be the owner.\n=cut\n\nusage() if not @ARGV or @ARGV < 1 or $ARGV[0] eq '-h';\n\nmy $repo = shift;\nmy $op = shift || '';\nusage() if $op and $op ne 'rm' and $op ne 'set';\nmy $file = 'README.html';\n\n#<<<\n_die \"you are not authorized\" unless\n ( not $op and can_read($repo) ) or\n ( $op and owns($repo) ) or\n ( $op and can_write($repo) and option( $repo, 'writer-is-owner' ) );\n#>>>\n\nif ( $op eq 'rm' ) {\n unlink \"$rc{GL_REPO_BASE}/$repo.git/$file\";\n} elsif ( $op eq 'set' ) {\n textfile( file => $file, repo => $repo, prompt => '' );\n} else {\n print textfile( file => $file, repo => $repo );\n}\n\n__END__\n\nThe WRITER_CAN_UPDATE_README option is gone now; it applies to all the repos\nin the system. Much better to add 'option writer-is-owner = 1' to repos or\nrepo groups that you want this to apply to.\n\nThis option is meant to cover desc, readme, and any other repo-specific text\nfile, so it's also a blunt instrument, though in a different dimension :-)\n" }, { "path": "src/commands/rsync", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Easy;\n\n=for admins\n\nBUNDLE SUPPORT\n\n (1) For each repo in gitolite.conf for which you want bundle support (or\n '@all', if you wish), add the following line:\n\n option bundle = 1\n\n Or you can say:\n\n option bundle.ttl = \n\n A bundle file that is more than seconds old (default value\n 86400, i.e., 1 day) is recreated on the next bundle request. Increase\n this if your repo is not terribly active.\n\n Note: a bundle file is also deleted and recreated if it contains a ref\n that was then either deleted or rewound in the repo. This is checked\n on every invocation.\n\n (2) Add 'rsync' to the ENABLE list in the rc file\n\n=cut\n\n=for usage\nrsync helper for gitolite\n\nBUNDLE SUPPORT\n\n Admins: see src/commands/rsync for setup instructions\n\n Users:\n rsync git@host:repo.bundle .\n # downloads a file called \".bundle\"; repeat as\n # needed till the whole thing is downloaded\n git clone repo.bundle repo\n cd repo\n git remote set-url origin git@host:repo\n git fetch origin # and maybe git pull, etc. to freshen the clone\n\n NOTE on options to the rsync command: you are only allowed to use the\n \"-v\", \"-n\", \"-q\", and \"-P\" options.\n\n=cut\n\nusage() if not @ARGV or $ARGV[0] eq '-h';\n\n# rsync driver program. Several things can be done later, but for now it\n# drives just the 'bundle' transfer.\n\nif ( $ENV{SSH_ORIGINAL_COMMAND} =~ /^rsync --server --sender (?:-[vn]*(?:e\\d*\\.\\w*)? )?\\. (\\S+)\\.bundle$/ ) {\n\n my $repo = $1;\n $repo =~ s/\\.git$//;\n\n # all errors have the same message to avoid leaking info\n can_read($repo) or _die \"you are not authorised\";\n my %config = config( $repo, \"gitolite-options.bundle\" ) or _die \"you are not authorised\";\n\n my $ttl = $config{'gitolite-options.bundle.ttl'} || 86400; # in seconds (default 1 day)\n\n my $bundle = bundle_create( $repo, $ttl );\n\n $ENV{SSH_ORIGINAL_COMMAND} =~ s( \\S+\\.bundle)( $bundle);\n trace( 1, \"rsync bundle\", $ENV{SSH_ORIGINAL_COMMAND} );\n Gitolite::Common::_system( split ' ', $ENV{SSH_ORIGINAL_COMMAND} );\n exit 0;\n}\n\n_warn \"Sorry, you are only allowed to use the '-v', '-n', '-q', and '-P' options.\";\nusage();\n\n# ----------------------------------------------------------------------\n# helpers\n# ----------------------------------------------------------------------\n\nsub bundle_create {\n my ( $repo, $ttl ) = @_;\n my $bundle = \"$repo.bundle\";\n $bundle =~ s(.*/)();\n my $recreate = 0;\n\n my ( %b, %r );\n if ( -f $bundle ) {\n %b = map { chomp; reverse split; } `git ls-remote --heads --tags $bundle`;\n %r = map { chomp; reverse split; } `git ls-remote --heads --tags .`;\n\n for my $ref ( sort keys %b ) {\n\n my $mtime = ( stat $bundle )[9];\n if ( time() - $mtime > $ttl ) {\n trace( 1, \"bundle too old\" );\n $recreate++;\n last;\n }\n\n if ( not $r{$ref} ) {\n trace( 1, \"ref '$ref' deleted in repo\" );\n $recreate++;\n last;\n }\n\n if ( $r{$ref} eq $b{$ref} ) {\n # same on both sides; ignore\n delete $r{$ref};\n delete $b{$ref};\n next;\n }\n\n `git rev-list --count --left-right $b{$ref}...$r{$ref}` =~ /^(\\d+)\\s+(\\d+)$/ or _die \"git too old\";\n if ($1) {\n trace( 1, \"ref '$ref' rewound in repo\" );\n $recreate++;\n last;\n }\n\n }\n\n } else {\n trace( 1, \"no bundle found\" );\n $recreate++;\n }\n\n return $bundle if not $recreate;\n\n trace( 1, \"creating bundle for '$repo'\" );\n -f $bundle and ( unlink $bundle or die \"a horrible death\" );\n system(\"git bundle create $bundle --branches --tags >&2\");\n\n return $bundle;\n}\n\nsub trace {\n Gitolite::Common::trace(@_);\n}\n" }, { "path": "src/commands/sshkeys-lint", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\n# complete rewrite of the sshkeys-lint program. Usage has changed, see\n# usage() function or run without arguments.\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Common;\n\nuse Getopt::Long;\nmy $admin = 0;\nmy $quiet = 0;\nmy $help = 0;\nGetOptions( 'admin|a=s' => \\$admin, 'quiet|q' => \\$quiet, 'help|h' => \\$help );\n\nuse Data::Dumper;\n$Data::Dumper::Deepcopy = 1;\n$|++;\n\nmy $in_gl_section = 0;\nmy $warnings = 0;\nmy $KEYTYPE_REGEX = qr/\\b(?:ssh-(?:rsa|dss|ed25519)|ecdsa-sha2-nistp(?:256|384|521))\\b/;\n\nsub msg {\n my $warning = shift;\n return if $quiet and not $warning;\n $warnings++ if $warning;\n print \"sshkeys-lint: \" . ( $warning ? \"WARNING: \" : \"\" ) . $_ for @_;\n}\n\nusage() if $help;\n\nour @pubkeyfiles = @ARGV; @ARGV = ();\nmy $kd = \"$ENV{HOME}/.gitolite/keydir\";\nif ( not @pubkeyfiles ) {\n chomp( @pubkeyfiles = `find $kd -type f -name \"*.pub\" | sort` );\n}\n\nif ( -t STDIN ) {\n @ARGV = (\"$ENV{HOME}/.ssh/authorized_keys\");\n}\n\n# ------------------------------------------------------------------------\n\nmy @authkeys;\nmy %seen_fprints;\nmy %pkf_by_fp;\nmsg 0, \"==== checking authkeys file:\\n\";\nfill_authkeys(); # uses up STDIN\n\nif ($admin) {\n my $fp = fprint(\"$admin.pub\");\n my $fpu = ( $fp && $seen_fprints{$fp}{user} || 'no access' );\n # dbg(\"fpu = $fpu, admin=$admin\");\n #<<<\n die \"\\t\\t*** FATAL ***\\n\" .\n \"$admin.pub maps to $fpu, not $admin.\\n\" .\n \"You will not be able to access gitolite with this key.\\n\" .\n \"Look for the 'ssh troubleshooting' link in http://gitolite.com/gitolite/ssh.html.\\n\"\n if $fpu ne \"user $admin\";\n #>>>\n}\n\nmsg 0, \"==== checking pubkeys:\\n\" if @pubkeyfiles;\nfor my $pkf (@pubkeyfiles) {\n # get the short name for the pubkey file\n ( my $pkfsn = $pkf ) =~ s(^$kd/)();\n\n my $fp = fprint($pkf);\n next unless $fp;\n msg 1, \"$pkfsn appears to be a COPY of $pkf_by_fp{$fp}\\n\" if $pkf_by_fp{$fp};\n $pkf_by_fp{$fp} ||= $pkfsn;\n my $fpu = ( $seen_fprints{$fp}{user} || 'no access' );\n msg 0, \"$pkfsn maps to $fpu\\n\";\n}\n\nif ($warnings) {\n print \"\\n$warnings warnings found\\n\";\n}\n\nexit $warnings;\n\n# ------------------------------------------------------------------------\nsub fill_authkeys {\n while (<>) {\n my $seq = $.;\n next if ak_comment($_); # also sets/clears $in_gl_section global\n my $fp = fprint($_);\n my $user = user($_);\n\n check( $seq, $fp, $user );\n\n $authkeys[$seq]{fprint} = $fp;\n $authkeys[$seq]{ustatus} = $user;\n }\n}\n\nsub check {\n my ( $seq, $fp, $user ) = @_;\n\n msg 1, \"line $seq, $user key found *outside* gitolite section!\\n\"\n if $user =~ /^user / and not $in_gl_section;\n\n msg 1, \"line $seq, $user key found *inside* gitolite section!\\n\"\n if $user !~ /^user / and $in_gl_section;\n\n if ( $seen_fprints{$fp} ) {\n #<<<\n msg 1, \"authkeys line $seq ($user) will be ignored by sshd; \" .\n \"same key found on line \" .\n $seen_fprints{$fp}{seq} . \" (\" .\n $seen_fprints{$fp}{user} . \")\\n\";\n return;\n #>>>\n }\n\n $seen_fprints{$fp}{seq} = $seq;\n $seen_fprints{$fp}{user} = $user;\n}\n\nsub user {\n my $user = '';\n $user ||= \"user $1\" if /^command=.*gitolite-shell (.*?)\"/;\n $user ||= \"unknown command\" if /^command/;\n $user ||= \"shell access\" if /$KEYTYPE_REGEX/;\n\n return $user;\n}\n\nsub ak_comment {\n local $_ = shift;\n $in_gl_section = 1 if /^# gitolite start/;\n $in_gl_section = 0 if /^# gitolite end/;\n die \"gitosis? what's that?\\n\" if /^#.*gitosis/;\n return /^\\s*(#|$)/;\n}\n\nsub fprint {\n local $_ = shift;\n my ($fp, $output);\n if ( /$KEYTYPE_REGEX/ ) {\n # an actual key was passed. ssh-keygen CAN correctly handle options on\n # the front of the key, so don't bother to strip them at all.\n ($fp, $output) = ssh_fingerprint_line($_);\n } else {\n # a filename was passed\n ($fp, $output) = ssh_fingerprint_file($_);\n # include the line of input as well, as it won't always be included by the ssh-keygen command\n warn \"Bad line: $_\\n\" unless $fp;\n }\n # sshkeys-lint should only be run by a trusted admin, so we can give the output here.\n warn \"$output\\n\" unless $fp;\n return $fp;\n}\n\n# ------------------------------------------------------------------------\n=for usage\n\nUsage: gitolite sshkeys-lint [-q] [optional list of pubkey filenames]\n (optionally, STDIN can be a pipe or redirected from a file; see below)\n\nLook for potential problems in ssh keys.\n\nsshkeys-lint expects:\n - the contents of an authorized_keys file via STDIN, otherwise it uses\n \\$HOME/.ssh/authorized_keys\n - one or more pubkey filenames as arguments, otherwise it uses all the keys\n found (recursively) in \\$HOME/.gitolite/keydir\n\nThe '-q' option will print only warnings instead of all mappings.\n\nNote that this runs ssh-keygen -l for each line in the authkeys file and each\npubkey in the argument list, so be wary of running it on something huge. This\nis meant for troubleshooting.\n\n=cut\n" }, { "path": "src/commands/sskm", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Rc;\nuse Gitolite::Common;\n\n=for usage\nUsage for this command is not that simple. Please read the full documentation\nin doc/sskm.mkd or online at http://gitolite.com/gitolite/contrib/sskm.html.\n=cut\n\nusage() if @ARGV and $ARGV[0] eq '-h';\n\nmy $rb = $rc{GL_REPO_BASE};\nmy $ab = $rc{GL_ADMIN_BASE};\n# get to the keydir\n_chdir(\"$ab/keydir\");\n\n# save arguments for later\nmy $operation = shift || 'list';\nmy $keyid = shift || '';\n# keyid must fit a very specific pattern\n$keyid and $keyid !~ /^@[-0-9a-z_]+$/i and die \"invalid keyid $keyid\\n\";\n\n# get the actual userid and keytype\nmy $gl_user = $ENV{GL_USER};\nmy $keytype = '';\n$keytype = $1 if $gl_user =~ s/^zzz-marked-for-(...)-//;\nprint STDERR \"hello $gl_user, you are currently using \"\n . (\n $keytype\n ? \"a key in the 'marked for $keytype' state\\n\"\n : \"a normal (\\\"active\\\") key\\n\"\n );\n\n# ----\n# first collect the keys\n\nmy ( @pubkeys, @marked_for_add, @marked_for_del );\n# get the list of pubkey files for this user, including pubkeys marked for\n# add/delete\n\nfor my $pubkey (`find . -type f -name \"*.pub\" | sort`) {\n chomp($pubkey);\n $pubkey =~ s(^./)(); # artifact of the find command\n\n my $user = $pubkey;\n $user =~ s(.*/)(); # foo/bar/baz.pub -> baz.pub\n $user =~ s/(\\@[^.]+)?\\.pub$//; # baz.pub, baz@home.pub -> baz\n\n next unless $user eq $gl_user or $user =~ /^zzz-marked-for-...-$gl_user/;\n\n if ( $user =~ m(^zzz-marked-for-add-) ) {\n push @marked_for_add, $pubkey;\n } elsif ( $user =~ m(^zzz-marked-for-del-) ) {\n push @marked_for_del, $pubkey;\n } else {\n push @pubkeys, $pubkey;\n }\n}\n\n# ----\n# list mode; just do it and exit\nsub print_keylist {\n my ( $message, @list ) = @_;\n return unless @list;\n print \"== $message ==\\n\";\n my $count = 1;\n for (@list) {\n my $fp = fingerprint($_);\n s/zzz-marked(\\/|-for-...-)//g;\n print $count++ . \": $fp : $_\\n\";\n }\n}\nif ( $operation eq 'list' ) {\n print \"you have the following keys:\\n\";\n print_keylist( \"active keys\", @pubkeys );\n print_keylist( \"keys marked for addition/replacement\", @marked_for_add );\n print_keylist( \"keys marked for deletion\", @marked_for_del );\n print \"\\n\\n\";\n exit;\n}\n\n# ----\n# please see docs for details on how a user interacts with this\n\nif ( $keytype eq '' ) {\n # user logging in with a normal key\n die \"valid operations: add, del, undo-add, confirm-del\\n\" unless $operation =~ /^(add|del|confirm-del|undo-add)$/;\n if ( $operation eq 'add' ) {\n print STDERR \"please supply the new key on STDIN. (I recommend you\n don't try to do this interactively, but use a pipe)\\n\";\n kf_add( $gl_user, $keyid, safe_stdin() );\n } elsif ( $operation eq 'del' ) {\n kf_del( $gl_user, $keyid );\n } elsif ( $operation eq 'confirm-del' ) {\n die \"you dont have any keys marked for deletion\\n\" unless @marked_for_del;\n kf_confirm_del( $gl_user, $keyid );\n } elsif ( $operation eq 'undo-add' ) {\n die \"you dont have any keys marked for addition\\n\" unless @marked_for_add;\n kf_undo_add( $gl_user, $keyid );\n }\n} elsif ( $keytype eq 'del' ) {\n # user is using a key that was marked for deletion. The only possible use\n # for this is that she changed her mind for some reason (maybe she marked\n # the wrong key for deletion) or is not able to get her client-side sshd\n # to stop using this key\n die \"valid operations: undo-del\\n\" unless $operation eq 'undo-del';\n\n # reinstate the key\n kf_undo_del( $gl_user, $keyid );\n} elsif ( $keytype eq 'add' ) {\n die \"valid operations: confirm-add\\n\" unless $operation eq 'confirm-add';\n # user is trying to validate a key that has been previously marked for\n # addition. This isn't interactive, but it *could* be... if someone asked\n kf_confirm_add( $gl_user, $keyid );\n}\n\nexit;\n\n# ----\n\n# make a temp clone and switch to it\nour $TEMPDIR;\nBEGIN { $TEMPDIR = `mktemp -d -t tmp.XXXXXXXXXX`; }\nEND { `/bin/rm -rf $TEMPDIR`; }\n\nsub cd_temp_clone {\n chomp($TEMPDIR);\n hushed_git( \"clone\", \"$rb/gitolite-admin.git\", \"$TEMPDIR\" );\n chdir($TEMPDIR);\n my $hostname = `hostname`; chomp($hostname);\n hushed_git( \"config\", \"--get\", \"user.email\" ) and hushed_git( \"config\", \"user.email\", $ENV{USER} . \"@\" . $hostname );\n hushed_git( \"config\", \"--get\", \"user.name\" ) and hushed_git( \"config\", \"user.name\", \"$ENV{USER} on $hostname\" );\n}\n\nsub fingerprint {\n my ($fp, $output) = ssh_fingerprint_file(shift);\n # Do not print the output of $output to an untrusted destination.\n die \"does not seem to be a valid pubkey\\n\" unless $fp;\n return $fp;\n}\n\nsub safe_stdin {\n # read one line from STDIN\n my $data;\n my $ret = read STDIN, $data, 4096;\n # current pubkeys are approx 400 bytes so we go a little overboard\n die \"could not read pubkey data\" . ( defined($ret) ? \"\" : \": $!\" ) . \"\\n\" unless $ret;\n die \"pubkey data seems to have more than one line\\n\" if $data =~ /\\n./;\n return $data;\n}\n\nsub hushed_git {\n local (*STDOUT) = \\*STDOUT;\n local (*STDERR) = \\*STDERR;\n open( STDOUT, \">\", \"/dev/null\" );\n open( STDERR, \">\", \"/dev/null\" );\n system( \"git\", @_ );\n}\n\nsub highlander {\n # there can be only one\n my ( $keyid, $die_if_empty, @a ) = @_;\n # too many?\n if ( @a > 1 ) {\n print STDERR \"\nmore than one key satisfies this condition, and I can't deal with that!\nThe keys are:\n\n\";\n print STDERR \"\\t\" . join( \"\\n\\t\", @a ), \"\\n\\n\";\n exit 1;\n }\n # too few?\n die \"no keys with \" . ( $keyid || \"empty\" ) . \" keyid found\\n\" if $die_if_empty and not @a;\n\n return @a;\n}\n\nsub kf_add {\n my ( $gl_user, $keyid, $keymaterial ) = @_;\n\n # add a new \"marked for addition\" key for $gl_user.\n cd_temp_clone();\n chdir(\"keydir\");\n\n mkdir(\"zzz-marked\");\n _print( \"zzz-marked/zzz-marked-for-add-$gl_user$keyid.pub\", $keymaterial );\n hushed_git( \"add\", \".\" ) and die \"git add failed\\n\";\n my $fp = fingerprint(\"zzz-marked/zzz-marked-for-add-$gl_user$keyid.pub\");\n hushed_git( \"commit\", \"-m\", \"sskm: add $gl_user$keyid ($fp)\" ) and die \"git commit failed\\n\";\n system(\"gitolite push >/dev/null 2>/dev/null\") and die \"git push failed\\n\";\n}\n\nsub kf_confirm_add {\n my ( $gl_user, $keyid ) = @_;\n # find entries in both @pubkeys and @marked_for_add whose basename matches $gl_user$keyid\n my @pk = highlander( $keyid, 0, grep { m(^(.*/)?$gl_user$keyid.pub$) } @pubkeys );\n my @mfa = highlander( $keyid, 1, grep { m(^zzz-marked/zzz-marked-for-add-$gl_user$keyid.pub$) } @marked_for_add );\n\n cd_temp_clone();\n chdir(\"keydir\");\n\n my $fp = fingerprint( $mfa[0] );\n if ( $pk[0] ) {\n hushed_git( \"mv\", \"-f\", $mfa[0], $pk[0] );\n hushed_git( \"commit\", \"-m\", \"sskm: confirm-add (replace) $pk[0] ($fp)\" ) and die \"git commit failed\\n\";\n } else {\n hushed_git( \"mv\", \"-f\", $mfa[0], \"$gl_user$keyid.pub\" );\n hushed_git( \"commit\", \"-m\", \"sskm: confirm-add $gl_user$keyid ($fp)\" ) and die \"git commit failed\\n\";\n }\n system(\"gitolite push >/dev/null 2>/dev/null\") and die \"git push failed\\n\";\n}\n\nsub kf_undo_add {\n # XXX some code at start is shared with kf_confirm_add\n my ( $gl_user, $keyid ) = @_;\n my @mfa = highlander( $keyid, 1, grep { m(^zzz-marked/zzz-marked-for-add-$gl_user$keyid.pub$) } @marked_for_add );\n\n cd_temp_clone();\n chdir(\"keydir\");\n\n my $fp = fingerprint( $mfa[0] );\n hushed_git( \"rm\", $mfa[0] );\n hushed_git( \"commit\", \"-m\", \"sskm: undo-add $gl_user$keyid ($fp)\" ) and die \"git commit failed\\n\";\n system(\"gitolite push >/dev/null 2>/dev/null\") and die \"git push failed\\n\";\n}\n\nsub kf_del {\n my ( $gl_user, $keyid ) = @_;\n\n cd_temp_clone();\n chdir(\"keydir\");\n\n mkdir(\"zzz-marked\");\n my @pk = highlander( $keyid, 1, grep { m(^(.*/)?$gl_user$keyid.pub$) } @pubkeys );\n\n my $fp = fingerprint( $pk[0] );\n hushed_git( \"mv\", $pk[0], \"zzz-marked/zzz-marked-for-del-$gl_user$keyid.pub\" ) and die \"git mv failed\\n\";\n hushed_git( \"commit\", \"-m\", \"sskm: del $pk[0] ($fp)\" ) and die \"git commit failed\\n\";\n system(\"gitolite push >/dev/null 2>/dev/null\") and die \"git push failed\\n\";\n}\n\nsub kf_confirm_del {\n my ( $gl_user, $keyid ) = @_;\n my @mfd = highlander( $keyid, 1, grep { m(^zzz-marked/zzz-marked-for-del-$gl_user$keyid.pub$) } @marked_for_del );\n\n cd_temp_clone();\n chdir(\"keydir\");\n\n my $fp = fingerprint( $mfd[0] );\n hushed_git( \"rm\", $mfd[0] );\n hushed_git( \"commit\", \"-m\", \"sskm: confirm-del $gl_user$keyid ($fp)\" ) and die \"git commit failed\\n\";\n system(\"gitolite push >/dev/null 2>/dev/null\") and die \"git push failed\\n\";\n}\n\nsub kf_undo_del {\n my ( $gl_user, $keyid ) = @_;\n\n my @mfd = highlander( $keyid, 1, grep { m(^zzz-marked/zzz-marked-for-del-$gl_user$keyid.pub$) } @marked_for_del );\n\n print STDERR \"\nYou're undeleting a key that is currently marked for deletion.\n Hit ENTER to undelete this key\n Hit Ctrl-C to cancel the undelete\nPlease see documentation for caveats on the undelete process as well as how to\nactually delete it.\n\";\n <>; # yeay... always wanted to do that -- throw away user input!\n\n cd_temp_clone();\n chdir(\"keydir\");\n\n my $fp = fingerprint( $mfd[0] );\n hushed_git( \"mv\", \"-f\", $mfd[0], \"$gl_user$keyid.pub\" );\n hushed_git( \"commit\", \"-m\", \"sskm: undo-del $gl_user$keyid ($fp)\" ) and die \"git commit failed\\n\";\n system(\"gitolite push >/dev/null 2>/dev/null\") and die \"git push failed\\n\";\n}\n" }, { "path": "src/commands/sudo", "content": "#!/bin/sh\n\n# Usage: ssh git@host sudo \n#\n# Let super-user run commands as any other user. \"Super-user\" is defined as\n# \"have write access to the gitolite-admin repo\".\n\ndie() { echo \"$@\" >&2; exit 1; }\nusage() { perl -lne 'print substr($_, 2) if /^# Usage/../^$/' < $0; exit 1; }\n[ -z \"$2\" ] && usage\n[ \"$1\" = \"-h\" ] && usage\n[ -z \"$GL_USER\" ] && die GL_USER not set\n\ngitolite access -q gitolite-admin $GL_USER W any || die \"You are not authorised\"\n\nuser=\"$1\"; shift\ncmd=\"$1\"; shift\n\n# switch user\nGL_USER=\"$user\"\n\n# figure out if the command is allowed from a remote user\ngitolite query-rc -q COMMANDS $cmd || die \"Command '$cmd' not allowed\"\ngitolite $cmd \"$@\"\n" }, { "path": "src/commands/svnserve", "content": "#!/usr/bin/perl\n\nuse strict;\nuse warnings;\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Rc;\nmy $svnserve = $rc{SVNSERVE} || '';\n$svnserve ||= \"/usr/bin/svnserve -r /var/svn/ -t --tunnel-user=%u\";\n\nmy $cmd = $ENV{SSH_ORIGINAL_COMMAND};\n\ndie \"expecting 'svnserve -t', got '$cmd'\\n\" unless $cmd eq 'svnserve -t';\n\n$svnserve =~ s/%u/$ENV{GL_USER}/g;\nexec $svnserve;\ndie \"svnserve exec failed\\n\";\n" }, { "path": "src/commands/symbolic-ref", "content": "#!/bin/sh\n\n# Usage: ssh git@host symbolic-ref \n#\n# allow 'git symbolic-ref' over a gitolite connection\n\n# Security: remember all arguments to commands must match a very conservative\n# pattern. Once that is assured, the symbolic-ref command has no security\n# related side-effects, so we don't check arguments at all.\n\n# Note: because of the restriction on allowed characters in arguments, you\n# can't supply an arbitrary string to the '-m' option. The simplest\n# work-around is-to-just-use-join-up-words-like-this if you feel the need to\n# supply a \"reason\" string. In any case this is useless by default; you'd\n# have to have core.logAllRefUpdates set for it to have any meaning.\n\ndie() { echo \"$@\" >&2; exit 1; }\nusage() { perl -lne 'print substr($_, 2) if /^# Usage/../^$/' < $0; exit 1; }\n[ -z \"$1\" ] && usage\n[ \"$1\" = \"-h\" ] && usage\n[ -z \"$GL_USER\" ] && die GL_USER not set\n\n# ----------------------------------------------------------------------\nrepo=$1; shift\nrepo=${repo%.git}\ngitolite access -q \"$repo\" $GL_USER W any || die You are not authorised\n\n# change head\ncd $GL_REPO_BASE/$repo.git\n\ngit symbolic-ref \"$@\"\n" }, { "path": "src/commands/who-pushed", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Easy;\n\nusage() if not @ARGV;\nusage($ARGV[1]) if $ARGV[1] and $ARGV[1] =~ /^[\\w-]+$/ and $ARGV[0] eq '-h';\n\n( my $logdir = $ENV{GL_LOGFILE} ) =~ s(/[^/]+$)();\n\n# deal with migrate\nmy %gl_log_lines_buffer;\nmy $countr = 0;\nmy $countl = 0;\nmigrate(@ARGV) if $ARGV[0] eq '--migrate'; # won't return; exits right there\n\n# tip search?\nmy $tip_search = 0;\nif ($ARGV[0] eq '--tip') {\n shift;\n $tip_search = 1;\n}\n\n# the normal who-pushed\nusage() if @ARGV < 2 or $ARGV[0] eq '-h';\nusage() if $ARGV[1] !~ /^[0-9a-f]+$/i;\n\nmy $repo = shift;\nmy $sha = shift; $sha =~ tr/A-F/a-f/;\n\n$ENV{GL_USER} and ( can_read($repo) or die \"no read permissions on '$repo'\" );\n\n# ----------------------------------------------------------------------\n\nmy $repodir = \"$ENV{GL_REPO_BASE}/$repo.git\";\nchdir $repodir or die \"repo '$repo' missing\";\n\nmy @logfiles = reverse glob(\"$logdir/*\");\n@logfiles = ( \"$repodir/gl-log\" ) if -f \"$repodir/gl-log\";\n\nfor my $logfile ( @logfiles ) {\n @ARGV = ($logfile);\n for my $line ( reverse grep { m(\\tupdate\\t($repo|$repodir)\\t) } <> ) {\n chomp($line);\n my @fields = split /\\t/, $line;\n my ( $ts, $pid, $who, $ref, $d_old, $new ) = @fields[ 0, 1, 4, 6, 7, 8 ];\n\n # d_old is what you display\n my $old = $d_old;\n $old = \"\" if $d_old eq ( \"0\" x 40 );\n $old = \"$old..\" if $old;\n\n if ($tip_search) {\n print \"$ts $pid $who $ref $d_old $new\\n\" if $new =~ /^$sha/;\n } else {\n system(\"git rev-list $old$new 2>/dev/null | grep ^$sha >/dev/null && echo '$ts $pid $who $ref $d_old $new'\");\n }\n }\n}\n\n# ----------------------------------------------------------------------\n# migration\n\nsub migrate {\n chdir $ENV{GL_REPO_BASE};\n my @repos = `gitolite list-phy-repos`; chomp @repos;\n\n my $count = scalar( grep { -f \"$_.git/gl-log\" } @repos );\n if ( $count and ( $_[1] || '' ) ne '--force' ) {\n say2 \"$count repo(s) already have gl-log files. To confirm overwriting, please re-run as:\";\n say2 \"\\tgitolite who-pushed --migrate --force\";\n say2 \"see help ('-h', '-h logfiles', or '-h migrate') for details.\";\n exit 1;\n }\n\n foreach my $r (@repos) {\n _print(\"$r.git/gl-log\", '');\n }\n\n my %repo_exists = map { $_ => 1 } @repos;\n @ARGV = sort ( glob(\"$logdir/*\") );\n while (<>) {\n say2 \"processed '$ARGV'\" if eof(ARGV);\n next unless /\\tupdate\\t/;\n my @f = split /\\t/;\n my $repo = $f[3];\n if ($repo =~ m(^/)) {\n $repo =~ s/^$ENV{GL_REPO_BASE}\\///;\n $repo =~ s/\\.git$//;\n }\n\n gen_gl_log($repo, $_) if $repo_exists{$repo};\n }\n flush_gl_log();\n\n exit 0;\n}\nsub gen_gl_log {\n my ($repo, $l) = @_;\n\n $countr++ unless $gl_log_lines_buffer{$repo}; # new repo, not yet seen\n $countl++;\n $gl_log_lines_buffer{$repo} .= $l;\n\n # once we have buffered log lines for about 100 repos, or about 10,000 log\n # lines, we flush them\n flush_gl_log() if $countr >= 100 or $countl >= 10_000;\n}\nsub flush_gl_log {\n while (my ($r, $l) = each %gl_log_lines_buffer) {\n open my $fh, \">>\", \"$r.git/gl-log\" or _die \"open flush_gl_log failed: $!\";\n print $fh $l;\n close $fh;\n }\n %gl_log_lines_buffer = ();\n say2 \"flushed $countl lines to $countr repos...\";\n $countr = $countl = 0;\n}\n\n__END__\n\n=for usage\nusage: ssh git@host who-pushed [--tip] \n\nDetermine who pushed the given commit. The first few hex digits of the SHA\nshould suffice. If the '--tip' option is supplied, it'll only look for the\nSHA among \"tip\" commits (i.e., search the \"new SHA\"s, without running the\nexpensive 'git rev-parse' for each push).\n\nEach line of the output contains the following fields: timestamp, a\ntransaction ID, username, refname, and the old and new SHAs for the ref.\n\nNote on the \"transaction ID\" field: if looking at the log file doesn't help\nyou figure out what its purpose is, please just ignore it.\n\nTO SEE ADDITIONAL HELP, run with options \"-h logfiles\" or \"-h migrate\".\n=cut\n\n=for logfiles\nThere are 2 places that gitolite logs to, based on the value give to the\nLOG_DEST rc variable. By default, log files go to ~/.gitolite/logs, but you\ncan choose to send them to syslog instead (in which case 'who-pushed' will not\nwork), or to both syslog and the normal log files.\n\nIn addition, gitolite can also be told to log just the \"update\" records to a\nspecial \"gl-log\" file in the bare repo directory. This makes 'who-pushed'\n**much** faster (thanks to milki for the problem *and* the simple solution).\n\n'who-pushed' will look for that special file first and use only that if it is\nfound. Otherwise it will look in the normal gitolite log files, which will of\ncourse be much slower.\n=cut\n\n=for migrate\nIf you installed gitolite before v3.6.4, and you wish to use the new, more\nefficient logging that helps who-pushed run faster, you should first update\nthe rc file (see http://gitolite.com/gitolite/rc.html for notes on that) to\nspecify a suitable value for LOG_DEST.\n\nAfter that you should probably do a one-time generation of the repo-specific\n'gl-log' files from the normal log files. This can only be done from the\nserver command line, even if the 'who-pushed' command has been enabled for\nremote access.\n\nTo do this, just run 'gitolite who-pushed --migrate'. If some of your repos\nalready had gl-log files, it will warn you, and tell you how to override.\nYou're only supposed to to use this *once* after upgrading to v3.6.4 and\nsetting LOG_DEST in the rc file anyway.\n=cut\n\n" }, { "path": "src/commands/writable", "content": "#!/usr/bin/perl\nuse strict;\nuse warnings;\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Easy;\n\n=for usage\nUsage: gitolite writable |@all on|off|status\n\nDisable/re-enable pushes to all repos or named repo. Useful to run\nnon-git-aware backups and so on.\n\n'on' enables, 'off' disables, writes (pushes) to the named repo or all repos.\n'status' returns the current status as shell truth (i.e., exit code 0 for\nwritable, 1 for not writable).\n\nWith 'off', any subsequent text is taken to be the message to be shown to\nusers when their pushes get rejected. If it is not supplied, it will take it\nfrom STDIN; this allows longer messages.\n=cut\n\nusage() if not @ARGV or @ARGV < 2 or $ARGV[0] eq '-h';\nusage() if $ARGV[1] ne 'on' and $ARGV[1] ne 'off' and $ARGV[1] ne 'status';\n\nmy $repo = shift;\nmy $op = shift; # on|off|status\n\nif ( $repo eq '@all' ) {\n _die \"you are not authorized\" if $ENV{GL_USER} and not is_admin();\n} else {\n _die \"you are not authorized\" if $ENV{GL_USER} and not( owns($repo) or is_admin() or ( can_write($repo) and $op eq 'status' ) );\n}\n\nmy $msg = join( \" \", @ARGV );\n# try STDIN only if no msg found in args *and* it's an 'off' command\nif ( not $msg and $op eq 'off' ) {\n say2 \"...please type the message to be shown to users:\";\n $msg = join( \"\", <> );\n}\n\nmy $sf = \".gitolite.down\";\nmy $rb = $ENV{GL_REPO_BASE};\n\nif ( $repo eq '@all' ) {\n target( $ENV{HOME} );\n} else {\n target(\"$rb/$repo.git\");\n target( $ENV{HOME} ) if $op eq 'status';\n}\n\nexit 0;\n\nsub target {\n my $repodir = shift;\n if ( $op eq 'status' ) {\n exit 1 if -e \"$repodir/$sf\";\n } elsif ( $op eq 'on' ) {\n unlink \"$repodir/$sf\";\n } elsif ( $op eq 'off' ) {\n _print( \"$repodir/$sf\", $msg );\n }\n}\n" }, { "path": "src/gitolite", "content": "#!/usr/bin/perl\n\n# all gitolite CLI tools run as sub-commands of this command\n# ----------------------------------------------------------------------\n\n=for args\nUsage: gitolite [sub-command] [options]\n\nThe following built-in subcommands are available; they should all respond to\n'-h' if you want further details on each:\n\n setup 1st run: initial setup; all runs: hook fixups\n compile compile gitolite.conf\n\n query-rc get values of rc variables\n\n list-groups list all group names in conf\n list-users list all users/user groups in conf\n list-repos list all repos/repo groups in conf\n list-phy-repos list all repos actually on disk\n list-memberships list all groups a name is a member of\n list-members list all members of a group\n\nIn addition, running 'gitolite help' should give you a list of custom commands\navailable. They may or may not respond to '-h', depending on how they were\nwritten, but it's worth a try, at least the first time you use a command.\n=cut\n\n# ----------------------------------------------------------------------\n\nuse FindBin;\n\nBEGIN { $ENV{GL_BINDIR} = $FindBin::RealBin; }\nBEGIN { $ENV{GL_LIBDIR} = \"$ENV{GL_BINDIR}/lib\"; }\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Rc;\nuse Gitolite::Common;\n\nuse strict;\nuse warnings;\n\n# ----------------------------------------------------------------------\n\nmy ( $command, @args ) = @ARGV;\ngl_log( 'cli', 'gitolite', @ARGV ) if -d $rc{GL_ADMIN_BASE} and $$ == ( $ENV{GL_TID} || 0 );\nargs();\n\n# the first two commands need options via @ARGV, as they have their own\n# GetOptions calls and older perls don't have 'GetOptionsFromArray'\n\nif ( $command eq 'setup' ) {\n shift @ARGV;\n require Gitolite::Setup;\n Gitolite::Setup->import;\n setup();\n\n} elsif ( $command eq 'query-rc' ) {\n shift @ARGV;\n query_rc(); # doesn't return\n\n# the rest don't need @ARGV per se\n\n} elsif ( $command eq 'compile' ) {\n require Gitolite::Conf;\n Gitolite::Conf->import;\n compile(@args);\n\n} elsif ( $command eq 'trigger' ) {\n my $s = $args[0];\n _die \"trigger section '$s' not found in rc\"\n unless $s eq 'POST_COMPILE'\n or $s eq 'POST_CREATE'\n or ( exists $rc{$s} and ref( $rc{$s} ) eq 'ARRAY' );\n trigger(@args);\n\n} elsif ( my $c = _which( \"commands/$command\", 'x' ) ) {\n trace( 2, \"attempting gitolite command $c\" );\n _system( $c, @args );\n\n} elsif ( $command eq 'list-phy-repos' ) {\n _chdir( $rc{GL_REPO_BASE} );\n print \"$_\\n\" for ( @{ list_phy_repos(@args) } );\n\n} elsif ( $command =~ /^list-/ ) {\n trace( 2, \"attempting lister command $command\" );\n require Gitolite::Conf::Load;\n Gitolite::Conf::Load->import;\n my $fn = lister_dispatch($command);\n print \"$_\\n\" for ( @{ $fn->(@args) } );\n\n} else {\n _die \"unknown gitolite sub-command\";\n}\n\ngl_log('END') if $$ == $ENV{GL_TID};\n\nexit 0;\n\nsub args {\n usage() if not $command or $command eq '-h';\n}\n\n# ----------------------------------------------------------------------\n" }, { "path": "src/gitolite-shell", "content": "#!/usr/bin/perl\n\n# gitolite shell, invoked from ~/.ssh/authorized_keys\n# ----------------------------------------------------------------------\n\nuse FindBin;\n\nBEGIN { $ENV{GL_BINDIR} = $FindBin::RealBin; }\nBEGIN { $ENV{GL_LIBDIR} = \"$ENV{GL_BINDIR}/lib\"; }\nuse lib $ENV{GL_LIBDIR};\n\n# set HOME\nBEGIN { $ENV{HOME} = $ENV{GITOLITE_HTTP_HOME} if $ENV{GITOLITE_HTTP_HOME}; }\n\nuse Gitolite::Rc;\nuse Gitolite::Common;\nuse Gitolite::Conf::Load;\n\nuse strict;\nuse warnings;\n\n# the main() sub expects ssh-ish things; set them up...\nmy $id = '';\nif ( exists $ENV{G3T_USER} ) {\n $id = in_file(); # file:// masquerading as ssh:// for easy testing\n} elsif ( exists $ENV{SSH_CONNECTION} ) {\n $id = in_ssh();\n} elsif ( exists $ENV{REQUEST_URI} ) {\n $id = in_http();\n} else {\n _die \"who the *heck* are you?\";\n}\n\n# sanity...\nmy $soc = $ENV{SSH_ORIGINAL_COMMAND};\n$soc =~ s/[\\n\\r]+/<>/g;\n_die \"I don't like newlines in the command: '$soc'\\n\" if $ENV{SSH_ORIGINAL_COMMAND} ne $soc;\n\n# allow gitolite-shell to be used as \"$SHELL\". Experts only; no support, no docs\nif (@ARGV and $ARGV[0] eq '-c') {\n shift;\n $ARGV[0] =~ s/^$0 // or _die \"unknown git/gitolite command: '$ARGV[0]'\";\n}\n\n# the INPUT trigger massages @ARGV and $ENV{SSH_ORIGINAL_COMMAND} as needed\ntrigger('INPUT');\n\nmain($id);\n\ngl_log('END') if $$ == $ENV{GL_TID};\n\nexit 0;\n\n# ----------------------------------------------------------------------\n\nsub in_file {\n gl_log( 'file', \"ARGV=\" . join( \",\", @ARGV ), \"SOC=$ENV{SSH_ORIGINAL_COMMAND}\" );\n\n if ( $ENV{SSH_ORIGINAL_COMMAND} =~ /git-\\w+-pack/ ) {\n print STDERR \"TRACE: gsh(\", join( \")(\", @ARGV ), \")\\n\";\n print STDERR \"TRACE: gsh(SOC=$ENV{SSH_ORIGINAL_COMMAND})\\n\";\n }\n return 'file';\n}\n\nsub in_http {\n http_setup_die_handler();\n\n _die \"GITOLITE_HTTP_HOME not set\" unless $ENV{GITOLITE_HTTP_HOME};\n\n _die \"fallback to DAV not supported\" if $ENV{REQUEST_METHOD} eq 'PROPFIND';\n\n # fake out SSH_ORIGINAL_COMMAND and SSH_CONNECTION when called via http,\n # so the rest of the code stays the same (except the exec at the end).\n http_simulate_ssh_connection();\n $ENV{SSH_ORIGINAL_COMMAND} ||= '';\n\n $ENV{REMOTE_USER} ||= $rc{HTTP_ANON_USER};\n @ARGV = ( $ENV{REMOTE_USER} );\n\n my $ip;\n ( $ip = $ENV{SSH_CONNECTION} || '(no-IP)' ) =~ s/ .*//;\n\n gl_log( 'http', \"ARGV=\" . join( \",\", @ARGV ), \"SOC=\" . ( $ENV{SSH_ORIGINAL_COMMAND} || '' ), \"FROM=$ip\" );\n\n return 'http';\n}\n\nsub in_ssh {\n my $ip;\n ( $ip = $ENV{SSH_CONNECTION} || '(no-IP)' ) =~ s/ .*//;\n\n gl_log( 'ssh', \"ARGV=\" . join( \",\", @ARGV ), \"SOC=\" . ( $ENV{SSH_ORIGINAL_COMMAND} || '' ), \"FROM=$ip\" );\n\n $ENV{SSH_ORIGINAL_COMMAND} ||= '';\n\n return $ip;\n}\n\n# ----------------------------------------------------------------------\n\n# call this once you are sure arg-1 is the username and SSH_ORIGINAL_COMMAND\n# has been setup (even if it's not actually coming via ssh).\nsub main {\n my $id = shift;\n\n # set up the user\n my $user = $ENV{GL_USER} = shift @ARGV;\n\n # set up the repo and the attempted access\n my ( $verb, $repo ) = parse_soc(); # returns only for git commands\n Gitolite::Conf::Load::sanity($repo, $REPONAME_PATT);\n $ENV{GL_REPO} = $repo;\n my $aa = ( $verb =~ 'upload' ? 'R' : 'W' );\n\n # set up env vars from options set for this repo\n env_options($repo);\n\n # auto-create?\n if ( repo_missing($repo) and access( $repo, $user, '^C', 'any' ) !~ /DENIED/ ) {\n require Gitolite::Conf::Store;\n Gitolite::Conf::Store->import;\n new_wild_repo( $repo, $user, $aa );\n gl_log( 'create', $repo, $user, $aa );\n }\n\n # a ref of 'any' signifies that this is a pre-git check, where we don't\n # yet know the ref that will be eventually pushed (and even that won't\n # apply if it's a read operation). See the matching code in access() for\n # more information.\n unless ( $ENV{GL_BYPASS_ACCESS_CHECKS} ) {\n my $ret = access( $repo, $user, $aa, 'any' );\n trigger( 'ACCESS_1', $repo, $user, $aa, 'any', $ret );\n _die $ret . \"\\n(or you mis-spelled the reponame)\" if $ret =~ /DENIED/;\n\n gl_log( \"pre_git\", $repo, $user, $aa, 'any', $ret );\n }\n\n trigger( 'PRE_GIT', $repo, $user, $aa, 'any', $verb );\n if ( $ENV{REQUEST_URI} ) {\n _system( \"git\", \"http-backend\" );\n } else {\n my $repodir = \"'$rc{GL_REPO_BASE}/$repo.git'\";\n _system( \"git\", \"shell\", \"-c\", \"$verb $repodir\" );\n }\n trigger( 'POST_GIT', $repo, $user, $aa, 'any', $verb );\n}\n\n# ----------------------------------------------------------------------\n\nsub parse_soc {\n my $soc = $ENV{SSH_ORIGINAL_COMMAND};\n $soc ||= 'info';\n\n my $git_commands = \"git-upload-pack|git-receive-pack|git-upload-archive\";\n # simplify the regex; we'll handle all the reponame nuances later\n if ( $soc =~ m(^($git_commands) '?/?(.*?)'?$) ) {\n my ( $verb, $repo ) = ( $1, $2 );\n trace( 2, \"git command\", $soc );\n\n # clean up the repo name; first extract the trace level if supplied\n # (and no, you can't have a trace level *and* a trailing slash).\n $ENV{D} = $1 if $repo =~ s/\\.git(\\d)$//;\n # and then the git-daemon-compatibility trailers\n $repo =~ s(/$)();\n $repo =~ s(\\.git$)();\n\n _die \"invalid repo name: '$repo'\" if $repo !~ $REPONAME_PATT;\n return ( $verb, $repo );\n }\n\n # after this we should not return; caller expects us to handle it all here\n # and exit out\n\n my @words = split ' ', $soc;\n if ( $rc{COMMANDS}{ $words[0] } ) {\n if ( $rc{COMMANDS}{ $words[0] } ne 'ua' ) {\n _die \"suspicious characters loitering about '$soc'\" if $soc !~ $REMOTE_COMMAND_PATT;\n _die \"no relative paths allowed anywhere!\" if $soc =~ m(\\.\\./);\n }\n trace( 2, \"gitolite command\", $soc );\n _system( \"gitolite\", @words );\n exit 0;\n }\n\n _die \"unknown git/gitolite command: '$soc'\";\n}\n\n# ----------------------------------------------------------------------\n# helper functions for \"in_http\"\n\nsub http_setup_die_handler {\n\n $SIG{__DIE__} = sub {\n my $service = ( $ENV{SSH_ORIGINAL_COMMAND} =~ /git-receive-pack/ ? 'git-receive-pack' : 'git-upload-pack' );\n my $message = shift; chomp($message);\n print STDERR \"$message\\n\";\n\n http_print_headers($service);\n\n # format the service response, then the message. With initial\n # help from Ilari and then a more detailed email from Shawn...\n $service = \"# service=$service\\n\"; $message = \"ERR $message\\n\";\n $service = sprintf( \"%04X\", length($service) + 4 ) . \"$service\"; # no CRLF on this one\n $message = sprintf( \"%04X\", length($message) + 4 ) . \"$message\";\n\n print $service;\n print \"0000\"; # flush-pkt, apparently\n print $message;\n print STDERR $service;\n print STDERR $message;\n exit 0; # if it's ok for die_webcgi in git.git/http-backend.c, it's ok for me ;-)\n }\n}\n\nsub http_simulate_ssh_connection {\n # these patterns indicate normal git usage; see \"services[]\" in\n # http-backend.c for how I got that. Also note that \"info\" is overloaded;\n # git uses \"info/refs...\", while gitolite uses \"info\" or \"info?...\". So\n # there's a \"/\" after info in the list below\n if ( $ENV{PATH_INFO} =~ m(^/(.*)/(HEAD$|info/refs$|objects/|git-(?:upload|receive)-pack$)) ) {\n my $repo = $1;\n my $verb = ( $ENV{REQUEST_URI} =~ /git-receive-pack/ ) ? 'git-receive-pack' : 'git-upload-pack';\n $ENV{SSH_ORIGINAL_COMMAND} = \"$verb '$repo'\";\n } else {\n # this is one of our custom commands; could be anything really,\n # because of the adc feature\n my ($verb) = ( $ENV{PATH_INFO} =~ m(^/(\\S+)) );\n my $args = $ENV{QUERY_STRING};\n $args =~ s/\\+/ /g;\n $args =~ s/%([0-9A-Fa-f]{2})/chr(hex($1))/eg;\n $ENV{SSH_ORIGINAL_COMMAND} = $verb;\n $ENV{SSH_ORIGINAL_COMMAND} .= \" $args\" if $args;\n http_print_headers(); # in preparation for the eventual output!\n\n # we also need to pipe STDERR out via STDOUT, else the user doesn't see those messages!\n open(STDERR, \">&STDOUT\") or _die \"Can't dup STDOUT: $!\";\n }\n $ENV{SSH_CONNECTION} = \"$ENV{REMOTE_ADDR} $ENV{REMOTE_PORT} $ENV{SERVER_ADDR} $ENV{SERVER_PORT}\";\n}\n\nmy $http_headers_printed = 0;\n\nsub http_print_headers {\n my ( $service, $code, $text ) = @_;\n\n return if $http_headers_printed++;\n $code ||= 200;\n $text ||= \"OK - gitolite\";\n\n $|++;\n print \"Status: $code $text\\r\\n\";\n print \"Expires: Fri, 01 Jan 1980 00:00:00 GMT\\r\\n\";\n print \"Pragma: no-cache\\r\\n\";\n print \"Cache-Control: no-cache, max-age=0, must-revalidate\\r\\n\";\n if ($service) {\n print \"Content-Type: application/x-$service-advertisement\\r\\n\";\n } else {\n print \"Content-Type: text/plain\\r\\n\";\n }\n print \"\\r\\n\";\n}\n" }, { "path": "src/lib/Gitolite/Cache.pm", "content": "package Gitolite::Cache;\n\n# cache stuff using an external database (redis)\n# ----------------------------------------------------------------------\n\n@EXPORT = qw(\n cache_control\n cache_wrap\n);\n\nuse Exporter 'import';\n\nuse Gitolite::Common;\nuse Gitolite::Rc;\nuse Storable qw(freeze thaw);\nuse Redis;\n\nmy $redis;\n\nmy $redis_sock = \"$ENV{HOME}/.redis-gitolite.sock\";\nif ( -S $redis_sock ) {\n _connect_redis();\n} else {\n _start_redis();\n _connect_redis();\n\n # this redis db is a transient, caching only, db, so let's not\n # accidentally use any stale data when if we're just starting up\n cache_control('stop');\n cache_control('start');\n}\n\n# ----------------------------------------------------------------------\n\nmy %wrapped;\nmy $ttl = ( $rc{CACHE_TTL} || ( $rc{GROUPLIST_PGM} ? 900 : 90000 ) );\n\nsub cache_control {\n my $op = shift;\n if ( $op eq 'stop' ) {\n $redis->flushall();\n } elsif ( $op eq 'start' ) {\n $redis->set( 'cache-up', 1 );\n } elsif ( $op eq 'flush' ) {\n flush_repo(@_);\n }\n}\n\nsub cache_wrap {\n my $sub = shift;\n my $tname = $sub; # this is what will show up in the trace output\n trace( 3, \"wrapping '$sub'\" );\n $sub = ( caller 1 )[0] . \"::\" . $sub if $sub !~ /::/;\n return if $wrapped{$sub}++; # in case somehow it gets called twice for the same sub!\n\n # collect names of wrapped subs into a redis 'set'\n $redis->sadd( \"SUBWAY\", $sub ); # subway? yeah well they wrap subs don't they?\n\n my $cref = eval '\\&' . $sub;\n my %opt = @_;\n # rest of the options come in as a hash. 'list' says this functions\n # returns a list. 'ttl' is a number to override the default ttl for\n # the cached value.\n\n no strict 'refs';\n no warnings 'redefine';\n *{$sub} = sub { # the wrapper function\n my $key = join( \", \", @_ );\n trace( 2, \"$tname.args\", @_ );\n\n if ( cache_up() and defined( my $val = $redis->get(\"$sub: $key\") ) ) {\n # cache is up and we got a hit, return value from cache\n if ( $opt{list} ) {\n trace( 2, \"$tname.getl\", @{ thaw($val) } );\n return @{ thaw($val) };\n } else {\n trace( 2, \"$tname.get\", $val );\n return $val;\n }\n } else {\n # cache is down or we got a miss, compute\n my ( $r, @r );\n if ( $opt{list} ) {\n @r = $cref->(@_); # provide list context\n trace( 2, \"$tname.setl\", @r );\n } else {\n $r = $cref->(@_); # provide scalar context\n trace( 2, \"$tname.set\", $r );\n }\n\n # store computed value in cache if cache is up\n if ( cache_up() ) {\n $redis->set( \"$sub: $key\", ( $opt{list} ? freeze( \\@r ) : $r ) );\n $redis->expire( \"$sub: $key\", $opt{ttl} || $ttl );\n trace( 2, \"$tname.ttl\", ( $opt{ttl} || $ttl ) );\n }\n\n return @r if $opt{list};\n return $r;\n }\n };\n trace( 3, \"wrapped '$sub'\" );\n}\n\nsub cache_up {\n return $redis->exists('cache-up');\n}\n\nsub flush_repo {\n my $repo = shift;\n\n my @wrapped = $redis->smembers(\"SUBWAY\");\n for my $func (@wrapped) {\n # if we wrap any more functions, make sure they're functions where the\n # first argument is 'repo'\n my @keys = $redis->keys(\"$func: $repo, *\");\n $redis->del( @keys ) if @keys;\n }\n}\n\n# ----------------------------------------------------------------------\n\nsub _start_redis {\n my $conf = join( \"\", );\n $conf =~ s/%HOME/$ENV{HOME}/g;\n\n open( REDIS, \"|-\", \"/usr/sbin/redis-server\", \"-\" ) or die \"start redis server failed: $!\";\n print REDIS $conf;\n close REDIS;\n\n # give it a little time to come up\n select( undef, undef, undef, 0.2 );\n}\n\nsub _connect_redis {\n $redis = Redis->new( sock => $redis_sock, encoding => undef ) or die \"redis new failed: $!\";\n $redis->ping or die \"redis ping failed: $!\";\n}\n\n1;\n\n__DATA__\n# resources\nmaxmemory 50MB\nport 0\nunixsocket %HOME/.redis-gitolite.sock\nunixsocketperm 700\ntimeout 0\ndatabases 1\n\n# daemon\ndaemonize yes\npidfile %HOME/.redis-gitolite.pid\ndbfilename %HOME/.redis-gitolite.rdb\ndir %HOME\n\n# feedback\nloglevel notice\nlogfile %HOME/.redis-gitolite.log\n\n# we don't save\n" }, { "path": "src/lib/Gitolite/Common.pm", "content": "package Gitolite::Common;\n\n# common (non-gitolite-specific) functions\n# ----------------------------------------------------------------------\n\n#<<<\n@EXPORT = qw(\n print2 dbg _mkdir _open ln_sf tsh_rc sort_u\n say _warn _chdir _print tsh_text list_phy_repos\n say2 _die _system slurp tsh_lines\n trace cleanup_conf_line tsh_try\n usage tsh_run\n gen_lfn\n gl_log\n\n dd\n t_start\n t_lap\n\n ssh_fingerprint_file\n ssh_fingerprint_line\n\n update_hook_present\n);\n#>>>\nuse Exporter 'import';\nuse File::Path qw(mkpath);\nuse File::Temp qw(tempfile);\nuse Carp qw(carp cluck croak confess);\n\nuse strict;\nuse warnings;\n\n# ----------------------------------------------------------------------\n\nsub print2 {\n local $/ = \"\\n\";\n print STDERR @_;\n}\n\nsub say {\n local $/ = \"\\n\";\n print @_, \"\\n\";\n}\n\nsub say2 {\n local $/ = \"\\n\";\n print STDERR @_, \"\\n\";\n}\n\nsub trace {\n gl_log( \"\\t\" . join( \",\", @_[ 1 .. $#_ ] ) ) if $_[0] <= 1 and defined $Gitolite::Rc::rc{LOG_EXTRA};\n\n return unless defined( $ENV{D} );\n\n my $level = shift; return if $ENV{D} < $level;\n my $sub = ( caller 1 )[3] || ''; $sub =~ s/.*://;\n if ( not $sub ) {\n $sub = (caller)[1];\n $sub =~ s(.*/(.*))(($1));\n }\n $sub .= ' ' x ( 31 - length($sub) );\n say2 \"$level\\t$sub\\t\", join( \"\\t\", @_ );\n}\n\nsub dbg {\n use Data::Dumper;\n return unless defined( $ENV{D} );\n for my $i (@_) {\n print STDERR \"DBG: \" . Dumper($i);\n }\n}\n\nsub dd {\n local $ENV{D} = 1;\n dbg(@_);\n}\n\n{\n my %start_times;\n\n eval \"require Time::HiRes\";\n # we just ignore any errors from this; nothing needs to be done as long as\n # no code *calls* either of the next two functions.\n\n sub t_start {\n my $name = shift || 'default';\n $start_times{$name} = [ Time::HiRes::gettimeofday() ];\n }\n\n sub t_lap {\n my $name = shift || 'default';\n return Time::HiRes::tv_interval( $start_times{$name} );\n }\n}\n\nsub _warn {\n gl_log( 'warn', @_ );\n if ( $ENV{D} and $ENV{D} >= 3 ) {\n cluck \"WARNING: \", @_, \"\\n\";\n } elsif ( defined( $ENV{D} ) ) {\n carp \"WARNING: \", @_, \"\\n\";\n } else {\n warn \"WARNING: \", @_, \"\\n\";\n }\n}\n$SIG{__WARN__} = \\&_warn;\n\nsub _die {\n gl_log( 'die', @_ );\n if ( $ENV{D} and $ENV{D} >= 3 ) {\n confess \"FATAL: \" . join( \",\", @_ ) . \"\\n\" if defined( $ENV{D} );\n } elsif ( defined( $ENV{D} ) ) {\n croak \"FATAL: \" . join( \",\", @_ ) . \"\\n\";\n } else {\n die \"FATAL: \" . join( \",\", @_ ) . \"\\n\";\n }\n}\n$SIG{__DIE__} = \\&_die;\n\nsub usage {\n my $script = (caller)[1];\n my $function = shift if @_ and $_[0] =~ /^[\\w-]+$/;\n $function ||= ( ( ( caller(1) )[3] ) || ( ( caller(0) )[3] ) );\n $function =~ s/.*:://;\n my $code = slurp($script);\n $code =~ /^=for $function\\b(.*?)^=cut/sm;\n say( $1 ? $1 : \"...no usage message for '$function' in $script\" );\n exit 1;\n}\n\nsub _mkdir {\n # It's not an error if the directory exists, but it is an error if it\n # doesn't exist and we can't create it. This includes not guaranteeing\n # dead symlinks or if mkpath traversal is blocked by a file.\n my $dir = shift;\n my $perm = shift; # optional\n return if -d $dir;\n mkpath($dir);\n chmod $perm, $dir if $perm;\n return 1;\n}\n\nsub _chdir {\n chdir( $_[0] || $ENV{HOME} ) or _die \"chdir $_[0] failed: $!\\n\";\n}\n\nsub _system {\n # run system(), catch errors. Be verbose only if $ENV{D} exists. If not,\n # exit with if it applies, else just \"exit 1\".\n trace( 1, 'system', @_ );\n if ( system(@_) != 0 ) {\n trace( 1, \"system() failed\", @_, \"-> $?\" );\n if ( $? == -1 ) {\n die \"failed to execute: $!\\n\" if $ENV{D};\n } elsif ( $? & 127 ) {\n die \"child died with signal \" . ( $? & 127 ) . \"\\n\" if $ENV{D};\n } else {\n die \"child exited with value \" . ( $? >> 8 ) . \"\\n\" if $ENV{D};\n exit( $? >> 8 );\n }\n exit 1;\n }\n}\n\nsub _open {\n open( my $fh, $_[0], $_[1] ) or _die \"open $_[1] failed: $!\\n\";\n return $fh;\n}\n\nsub _print {\n my ( $file, @text ) = @_;\n my $fh = _open( \">\", \"$file.$$\" );\n print $fh @text;\n close($fh) or _die \"close $file failed: $! at \", (caller)[1], \" line \", (caller)[2], \"\\n\";\n my $oldmode = ( ( stat $file )[2] );\n rename \"$file.$$\", $file;\n chmod $oldmode, $file if $oldmode;\n}\n\nsub slurp {\n return unless defined wantarray;\n local $/ = undef unless wantarray;\n my $fh = _open( \"<\", $_[0] );\n return <$fh>;\n}\n\nsub dos2unix {\n # WARNING: when calling this, make sure you supply a list context\n s/\\r\\n/\\n/g for @_;\n return @_;\n}\n\nsub ln_sf {\n trace( 3, @_ );\n my ( $srcdir, $glob, $dstdir ) = @_;\n for my $hook ( glob(\"$srcdir/$glob\") ) {\n $hook =~ s/$srcdir\\///;\n unlink \"$dstdir/$hook\";\n symlink \"$srcdir/$hook\", \"$dstdir/$hook\" or croak \"could not symlink $srcdir/$hook to $dstdir\\n\";\n }\n}\n\nsub sort_u {\n my %uniq;\n my $listref = shift;\n return [] unless @{$listref};\n undef @uniq{ @{$listref} }; # expect a listref\n my @sort_u = sort keys %uniq;\n return \\@sort_u;\n}\n\nsub cleanup_conf_line {\n my $line = shift;\n return $line if $line =~ /^# \\S+ \\d+$/;\n\n # kill comments, but take care of \"#\" inside *simple* strings\n $line =~ s/^((\".*?\"|[^#\"])*)#.*/$1/;\n # normalise whitespace; keeps later regexes very simple\n $line =~ s/=/ = /;\n $line =~ s/\\s+/ /g;\n $line =~ s/^ //;\n $line =~ s/ $//;\n return $line;\n}\n\n{\n my @phy_repos = ();\n\n sub list_phy_repos {\n # use cached value only if it exists *and* no arg was received (i.e.,\n # receiving *any* arg invalidates cache)\n return \\@phy_repos if ( @phy_repos and not @_ );\n\n my $cmd = 'find . ' . ($Gitolite::Rc::rc{REPO_SYMLINKS} || '') . ' -name \"*.git\" -prune';\n for my $repo (`$cmd`) {\n chomp($repo);\n $repo =~ s/\\.git$//;\n $repo =~ s(^\\./)();\n next if $repo =~ m(/$);\n # tolerate non-bare repos within ~/repositories but silently ignore them\n push @phy_repos, $repo;\n }\n trace( 3, scalar(@phy_repos) . \" physical repos found\" );\n return sort_u( \\@phy_repos );\n }\n}\n\n# 2025-06-12 -- this function is the only one in \"core\" gitolite [1] to have\n# support for Windows systems. This is because one of gitolite's\n# \"contributed\" features, which is nevertheless very useful, is the \"testconf\"\n# feature [2] and [3]. The thing is, testconf is designed to run gitolite **on the\n# client machine**, which is at least for some people, Windows.\n# So yeah, a bit of tail wagging the dog, allowing a \"contrib\" feature to make\n# changes to \"core\" gitolite, and that too for an OS we don't support as a\n# server, but it is what it is. At least we have managed to isolate the\n# change sufficiently.\n\n# [1]: https://gitolite.com/gitolite/internals.html#what-is-core\n# [2]: https://gitolite.com/gitolite/conf-2.html#appendix-3-embedding-test-code-in-your-conf\n# [3]: https://github.com/sitaramc/gitolite/blob/master/contrib/utils/testconf\nsub update_hook_present {\n my $repo = shift;\n\n return 1 unless -d \"$ENV{GL_REPO_BASE}/$repo.git\"; # non-existent repo is fine\n\n my $repo_hook = \"$ENV{GL_REPO_BASE}/$repo.git/hooks/update\";\n my $common_hook = \"$ENV{GL_ADMIN_BASE}/hooks/common/update\";\n\n if ($^O eq 'msys') {\n # No symlinks on Windows. Please see important note placed just before this function.\n my $repo_update_text = slurp($repo_hook) if -f $repo_hook;\n my $common_update_text = slurp($common_hook) if -f $common_hook;\n\n return 1 if $repo_update_text and $common_update_text and $repo_update_text eq $common_update_text;\n\n return 0;\n }\n\n my $x = readlink($repo_hook);\n return 1 if $x and $x eq $common_hook;\n\n return 0;\n}\n\n# generate a timestamp\nsub gen_ts {\n my ( $s, $min, $h, $d, $m, $y ) = (localtime)[ 0 .. 5 ];\n $y += 1900; $m++; # usual adjustments\n for ( $s, $min, $h, $d, $m ) {\n $_ = \"0$_\" if $_ < 10;\n }\n my $ts = \"$y-$m-$d.$h:$min:$s\";\n\n return $ts;\n}\n\n# generate a log file name\nsub gen_lfn {\n my ( $s, $min, $h, $d, $m, $y ) = (localtime)[ 0 .. 5 ];\n $y += 1900; $m++; # usual adjustments\n for ( $s, $min, $h, $d, $m ) {\n $_ = \"0$_\" if $_ < 10;\n }\n\n my ($template) = shift;\n # substitute template parameters and set the logfile name\n $template =~ s/%y/$y/g;\n $template =~ s/%m/$m/g;\n $template =~ s/%d/$d/g;\n\n return $template;\n}\n\nmy $log_dest;\nmy $syslog_opened = 0;\nEND { closelog() if $syslog_opened; }\nsub gl_log {\n # the log filename and the timestamp come from the environment. If we get\n # called even before they are set, we have no choice but to dump to STDERR\n # (and probably call \"logger\").\n\n # tab sep if there's more than one field\n my $msg = join( \"\\t\", @_ );\n $msg =~ s/[\\n\\r]+/<>/g;\n\n my $ts = gen_ts();\n my $tid = $ENV{GL_TID} ||= $$;\n\n $log_dest = $Gitolite::Rc::rc{LOG_DEST} || '' if not defined $log_dest;\n\n # log (update records only) to \"gl-log\" in the bare repo dir; this is to\n # make 'who-pushed' more efficient. Since this is only for the update\n # records, it is not a replacement for the other two types of logging.\n if ($log_dest =~ /repo-log/ and $_[0] eq 'update') {\n # if the log line is 'update', we're already in the bare repo dir\n open my $lfh, \">>\", \"gl-log\" or _die \"open gl-log failed: $!\";\n print $lfh \"$ts\\t$tid\\t$msg\\n\";\n close $lfh;\n }\n\n # syslog\n if ($log_dest =~ /syslog/) { # log_dest *includes* syslog\n if ($syslog_opened == 0) {\n require Sys::Syslog;\n Sys::Syslog->import(qw(:standard));\n\n openlog(\"gitolite\" . ( $ENV{GL_TID} ? \"[$ENV{GL_TID}]\" : \"\" ), \"pid\", $Gitolite::Rc::rc{LOG_FACILITY} || 'local0');\n $syslog_opened = 1;\n }\n\n # gl_log is called either directly, or, if the rc variable LOG_EXTRA\n # is set, from trace(1, ...). The latter use is considered additional\n # info for troubleshooting. Trace prefixes a tab to the arguments\n # before calling gl_log, to visually set off such lines in the log\n # file. Although syslog eats up that leading tab, we use it to decide\n # the priority/level of the syslog message.\n syslog( ( $msg =~ /^\\t/ ? 'debug' : 'info' ), \"%s\", $msg);\n\n return if $log_dest !~ /normal/;\n }\n\n my $fh;\n logger_plus_stderr( \"errors found before logging could be setup\", \"$msg\" ) if not $ENV{GL_LOGFILE};\n open my $lfh, \">>\", $ENV{GL_LOGFILE}\n or logger_plus_stderr( \"errors found but logfile could not be created\", \"$ENV{GL_LOGFILE}: $!\", \"$msg\" );\n print $lfh \"$ts\\t$tid\\t$msg\\n\";\n close $lfh;\n}\n\nsub logger_plus_stderr {\n open my $fh, \"|-\", \"logger\" or confess \"it's really not my day is it...?\\n\";\n for (@_) {\n print STDERR \"FATAL: $_\\n\";\n print $fh \"FATAL: $_\\n\";\n }\n exit 1;\n}\n\n# ----------------------------------------------------------------------\n# Get the SSH fingerprint of a file\n# If the fingerprint cannot be parsed, it will be undef\n# In a scalar context, returns the fingerprint\n# In a list context, returns (fingerprint, output) where output\n# is the raw output of the ssh-keygen command\nsub ssh_fingerprint_file {\n my $in = shift;\n -f $in or die \"file not found: $in\\n\";\n my $fh;\n open( $fh, \"ssh-keygen -l -f $in 2>&1 |\" ) or die \"could not fork: $!\\n\";\n my $output = <$fh>;\n chomp $output;\n # dbg(\"fp = $fp\");\n close $fh;\n # Return a valid fingerprint or undef\n my $fp = undef;\n if($output =~ /((?:MD5:)?(?:[0-9a-f]{2}:){15}[0-9a-f]{2})/i or\n $output =~ m{((?:RIPEMD|SHA)\\d+:[A-Za-z0-9+/=]+)}i) {\n $fp = $1;\n }\n return wantarray ? ($fp, $output) : $fp;\n}\n\n# Get the SSH fingerprint of a line of text\n# If the fingerprint cannot be parsed, it will be undef\n# In a scalar context, returns the fingerprint\n# In a list context, returns (fingerprint, output) where output\n# is the raw output of the ssh-keygen command\nsub ssh_fingerprint_line {\n my ( $fh, $fn ) = tempfile();\n print $fh shift() . \"\\n\";\n close $fh;\n my ($fp,$output) = ssh_fingerprint_file($fn);\n unlink $fn;\n return wantarray ? ($fp,$output) : $fp;\n}\n\n# ----------------------------------------------------------------------\n\n# bare-minimum subset of 'Tsh' (see github.com/sitaramc/tsh)\n{\n my ( $rc, $text );\n sub tsh_rc { return $rc || 0; }\n sub tsh_text { return $text || ''; }\n sub tsh_lines { return split /\\n/, $text; }\n\n sub tsh_try {\n my $cmd = shift; die \"try: expects only one argument\" if @_;\n $text = `( $cmd ) 2>&1; printf RC=\\$?`;\n if ( $text =~ s/RC=(\\d+)$// ) {\n $rc = $1;\n trace( 3, $text );\n return ( not $rc );\n }\n die \"couldnt find RC= in result; this should not happen:\\n$text\\n\\n...\\n\";\n }\n\n sub tsh_run {\n open( my $fh, \"-|\", @_ ) or die \"popen failed: $!\";\n local $/ = undef; $text = <$fh>;\n close $fh; warn \"pclose failed: $!\" if $!;\n $rc = ( $? >> 8 );\n trace( 3, $text );\n return $text;\n }\n}\n\n1;\n" }, { "path": "src/lib/Gitolite/Conf/Explode.pm", "content": "package Gitolite::Conf::Explode;\n\n# include/subconf processor\n# ----------------------------------------------------------------------\n\n@EXPORT = qw(\n explode\n);\n\nuse Exporter 'import';\n\nuse Gitolite::Rc;\nuse Gitolite::Common;\n\nuse strict;\nuse warnings;\n\n# ----------------------------------------------------------------------\n\n# 'seen' for include/subconf files\nmy %included = ();\n# 'seen' for group names on LHS\nmy %prefixed_groupname = ();\n\nsub explode {\n trace( 3, @_ );\n my ( $file, $subconf, $out ) = @_;\n\n # seed the 'seen' list if it's empty\n $included{ device_inode(\"gitolite.conf\") }++ unless %included;\n\n my $fh = _open( \"<\", $file );\n while (<$fh>) {\n my $line = cleanup_conf_line($_);\n next unless $line =~ /\\S/;\n\n # subst %HOSTNAME word if rc defines a hostname, else leave as is\n $line =~ s/%HOSTNAME\\b/$rc{HOSTNAME}/g if $rc{HOSTNAME};\n\n $line = prefix_groupnames( $line, $subconf ) if $subconf ne 'master';\n\n if ( $line =~ /^(include|subconf) (?:(\\S+) )?(\\S.+)$/ ) {\n incsub( $1, $2, $3, $subconf, $out );\n } else {\n # normal line, send it to the callback function\n push @{$out}, \"# $file $.\";\n push @{$out}, $line;\n }\n }\n}\n\nsub incsub {\n my $is_subconf = ( +shift eq 'subconf' );\n my ( $new_subconf, $include_glob, $current_subconf, $out ) = @_;\n\n _die \"subconf '$current_subconf' attempting to run 'subconf'\\n\" if $is_subconf and $current_subconf ne 'master';\n\n _die \"invalid include/subconf file/glob '$include_glob'\"\n unless $include_glob =~ /^\"(.+)\"$/\n or $include_glob =~ /^'(.+)'$/;\n $include_glob = $1;\n\n trace( 3, $is_subconf, $include_glob );\n\n for my $file ( glob($include_glob) ) {\n _warn(\"included file not found: '$file'\"), next unless -f $file;\n _die \"invalid include/subconf filename '$file'\" unless $file =~ m(([^/]+).conf$);\n my $basename = $1;\n\n next if already_included($file);\n\n if ($is_subconf) {\n push @{$out}, \"subconf \" . ( $new_subconf || $basename );\n explode( $file, ( $new_subconf || $basename ), $out );\n push @{$out}, \"subconf $current_subconf\";\n } else {\n explode( $file, $current_subconf, $out );\n }\n }\n}\n\nsub prefix_groupnames {\n my ( $line, $subconf ) = @_;\n\n my $lhs = '';\n # save 'foo' if it's an '@foo = list' line\n $lhs = $1 if $line =~ /^@(\\S+) = /;\n # prefix all @groups in the line\n $line =~ s/(^| )(@\\S+)(?= |$)/ $1 . ($prefixed_groupname{$subconf}{$2} || $2) /ge;\n # now prefix the LHS and store it if needed\n if ($lhs) {\n $line =~ s/^@\\S+ = /\"\\@$subconf.$lhs = \"/e;\n $prefixed_groupname{$subconf}{\"\\@$lhs\"} = \"\\@$subconf.$lhs\";\n trace( 3, \"prefixed_groupname.$subconf.\\@$lhs = \\@$subconf.$lhs\" );\n }\n\n return $line;\n}\n\nsub already_included {\n my $file = shift;\n\n my $file_id = device_inode($file);\n return 0 unless $included{$file_id}++;\n\n _warn(\"$file already included\");\n trace( 3, \"$file already included\" );\n return 1;\n}\n\nsub device_inode {\n my $file = shift;\n trace( 3, $file, ( stat $file )[ 0, 1 ] );\n return join( \"/\", ( stat $file )[ 0, 1 ] );\n}\n\n1;\n\n" }, { "path": "src/lib/Gitolite/Conf/Load.pm", "content": "package Gitolite::Conf::Load;\n\n# load conf data from stored files\n# ----------------------------------------------------------------------\n\n@EXPORT = qw(\n load\n\n access\n git_config\n env_options\n\n option\n repo_missing\n creator\n\n vrefs\n lister_dispatch\n);\n\nuse Exporter 'import';\nuse Cwd;\n\nuse Gitolite::Rc;\nuse Gitolite::Common;\n\nuse strict;\nuse warnings;\n\n# ----------------------------------------------------------------------\n\n# our variables, because they get loaded by a 'do'\nour $data_version = '';\nour %repos;\nour %one_repo;\nour %groups;\nour %patterns;\nour %configs;\nour %one_config;\nour %split_conf;\n\nmy $subconf = 'master';\n\nmy %listers = (\n 'list-groups' => \\&list_groups,\n 'list-users' => \\&list_users,\n 'list-repos' => \\&list_repos,\n 'list-memberships' => \\&list_memberships,\n 'list-members' => \\&list_members,\n);\n\n# helps maintain the \"cache\" in both \"load_common\" and \"load_1\"\nmy $last_repo = '';\n\n# ----------------------------------------------------------------------\n\n{\n my $loaded_repo = '';\n\n sub load {\n my $repo = shift or _die \"load() needs a reponame\";\n trace( 3, \"$repo\" );\n if ( $repo ne $loaded_repo ) {\n load_common();\n load_1($repo);\n $loaded_repo = $repo;\n }\n }\n}\n\nsub access {\n my ( $repo, $user, $aa, $ref ) = @_;\n trace( 2, $repo, $user, $aa, $ref );\n _die \"invalid user '$user'\" if not( $user and $user =~ $USERNAME_PATT );\n sanity($repo);\n return \"$aa any $repo $user DENIED by fallthru\" unless update_hook_present($repo);\n\n my @rules;\n my $deny_rules;\n\n load($repo);\n @rules = rules( $repo, $user );\n $deny_rules = option( $repo, 'deny-rules' );\n\n # sanity check the only piece the user can control\n _die \"invalid characters in ref or filename: '$ref'\\n\" unless $ref =~ m(^VREF/NAME/) or $ref =~ $REF_OR_FILENAME_PATT;\n # apparently we can't always force sanity; at least what we *return*\n # should be sane/safe. This pattern is based on REF_OR_FILENAME_PATT.\n ( my $safe_ref = $ref ) =~ s([^-0-9a-zA-Z._\\@/+ :,])(.)g;\n trace( 3, \"safe_ref\", $safe_ref ) if $ref ne $safe_ref;\n\n # when a real repo doesn't exist, ^C is a pre-requisite for any other\n # check to give valid results.\n if ( $aa ne '^C' and $repo !~ /^\\@/ and $repo =~ $REPONAME_PATT and repo_missing($repo) ) {\n my $iret = access( $repo, $user, '^C', $ref );\n $iret =~ s/\\^C/$aa/;\n return $iret if $iret =~ /DENIED/;\n }\n # similarly, ^C must be denied if the repo exists\n if ( $aa eq '^C' and not repo_missing($repo) ) {\n trace( 2, \"DENIED by existence\" );\n return \"$aa $safe_ref $repo $user DENIED by existence\";\n }\n\n trace( 3, scalar(@rules) . \" rules found\" );\n\n $rc{RULE_TRACE} = '';\n for my $r (@rules) {\n $rc{RULE_TRACE} .= \" \" . $r->[0] . \" \";\n\n my $perm = $r->[1];\n my $refex = $r->[2]; $refex =~ s(/USER/)(/$user/);\n trace( 3, \"perm=$perm, refex=$refex\" );\n\n $rc{RULE_TRACE} .= \"d\";\n # skip 'deny' rules if the ref is not (yet) known\n next if $perm eq '-' and $ref eq 'any' and not $deny_rules;\n\n $rc{RULE_TRACE} .= \"r\";\n # rule matches if ref matches or ref is any (see gitolite-shell)\n next unless $ref =~ /^$refex/ or $ref eq 'any';\n\n $rc{RULE_TRACE} .= \"D\";\n trace( 2, \"DENIED by $refex\" ) if $perm eq '-';\n return \"$aa $safe_ref $repo $user DENIED by $refex\" if $perm eq '-';\n\n # For repo creation, perm will be C and aa will be \"^C\". For branch\n # access, $perm can be RW\\+?(C|D|CD|DC)?M?, and $aa can be W, +, C or\n # D, or any of these followed by \"M\".\n\n # We need to turn $aa into a regex that can match a suitable $perm.\n # This is trivially true for \"^C\", \"W\" and \"D\", but the others (+, C,\n # M) need some tweaking.\n\n # first, quote the '+':\n ( my $aaq = $aa ) =~ s/\\+/\\\\+/;\n # if aa is just \"C\", the user is trying to create a *branch* (not a\n # *repo*), so let's make the pattern clearer to reflect that.\n $aaq = \"RW.*C\" if $aaq eq \"C\";\n # if the aa is, say \"WM\", make this \"W.*M\" because the perm could be\n # 'RW+M', 'RW+CDM' etc, and they are all valid:\n $aaq =~ s/M/.*M/;\n\n $rc{RULE_TRACE} .= \"A\";\n\n # as far as *this* ref is concerned we're ok\n return $refex if ( $perm =~ /$aaq/ );\n\n $rc{RULE_TRACE} .= \"p\";\n }\n $rc{RULE_TRACE} .= \" F\";\n\n trace( 2, \"DENIED by fallthru\" );\n return \"$aa $safe_ref $repo $user DENIED by fallthru\";\n}\n\n# cache control\nif ($rc{CACHE}) {\n require Gitolite::Cache;\n Gitolite::Cache::cache_wrap('Gitolite::Conf::Load::access');\n}\n\nsub git_config {\n my ( $repo, $key, $empty_values_OK ) = @_;\n $key ||= '.';\n\n if ( repo_missing($repo) ) {\n load_common();\n } else {\n load($repo);\n }\n\n # read comments bottom up\n my %ret =\n # and take the second and third elements to make up your new hash\n map { $_->[1] => $_->[2] }\n # keep only the ones where the second element matches your key\n grep { $_->[1] =~ qr($key) }\n # sort this list of listrefs by the first element in each list ref'd to\n sort { $a->[0] <=> $b->[0] }\n # dereference it (into a list of listrefs)\n map { @$_ }\n # take the value of that entry\n map { $configs{$_} }\n # if it has an entry in %configs\n grep { $configs{$_} }\n # for each \"repo\" that represents us\n memberships( 'repo', $repo );\n\n # %configs looks like this (for each 'foo' that is in memberships())\n # 'foo' => [ [ 6, 'foo.bar', 'repo' ], [ 7, 'foodbar', 'repoD' ], [ 8, 'foo.czar', 'jule' ] ],\n # the first map gets you the value\n # [ [ 6, 'foo.bar', 'repo' ], [ 7, 'foodbar', 'repoD' ], [ 8, 'foo.czar', 'jule' ] ],\n # the deref gets you\n # [ 6, 'foo.bar', 'repo' ], [ 7, 'foodbar', 'repoD' ], [ 8, 'foo.czar', 'jule' ]\n # the sort rearranges it (in this case it's already sorted but anyway...)\n # the grep gets you this, assuming the key is foo.bar (and \".\" is regex \".')\n # [ 6, 'foo.bar', 'repo' ], [ 7, 'foodbar', 'repoD' ]\n # and the final map does this:\n # 'foo.bar'=>'repo' , 'foodbar'=>'repoD'\n\n # now some of these will have an empty key; we need to delete them unless\n # we're told empty values are OK\n unless ($empty_values_OK) {\n my ( $k, $v );\n while ( ( $k, $v ) = each %ret ) {\n delete $ret{$k} if not $v;\n }\n }\n\n my ( $k, $v );\n my $creator = creator($repo);\n while ( ( $k, $v ) = each %ret ) {\n $v =~ s/%GL_REPO/$repo/g;\n $v =~ s/%GL_CREATOR/$creator/g if $creator;\n $ret{$k} = $v;\n }\n\n map { trace( 3, \"$_\", \"$ret{$_}\" ) } ( sort keys %ret ) if $ENV{D};\n return \\%ret;\n}\n\nsub env_options {\n return unless -f \"$rc{GL_ADMIN_BASE}/conf/gitolite.conf-compiled.pm\";\n # prevent catch-22 during initial install\n\n my $cwd = getcwd();\n\n my $repo = shift;\n map { delete $ENV{$_} } grep { /^GL_OPTION_/ } keys %ENV;\n my $h = git_config( $repo, '^gitolite-options.ENV\\.' );\n while ( my ( $k, $v ) = each %$h ) {\n next unless $k =~ /^gitolite-options.ENV\\.(\\w+)$/;\n $ENV{ \"GL_OPTION_\" . $1 } = $v;\n }\n\n chdir($cwd);\n}\n\nsub option {\n my ( $repo, $option ) = @_;\n $option = \"gitolite-options.$option\";\n my $ret = git_config( $repo, \"^\\Q$option\\E\\$\" );\n return '' unless %$ret;\n return $ret->{$option};\n}\n\nsub sanity {\n my ($repo, $patt) = @_;\n $patt ||= $REPOPATT_PATT;\n\n _die \"invalid repo '$repo'\" if not( $repo and $repo =~ $patt );\n _die \"'$repo' ends with a '/'\" if $repo =~ m(/$);\n _die \"'$repo' contains '..'\" if $repo =~ $REPONAME_PATT and $repo =~ m(\\.\\.);\n _die \"'$repo' contains '.git/'\" if $repo =~ $REPONAME_PATT and $repo =~ m(\\.git/);\n _die \"'$repo' ends with '.git'\" if $repo =~ m(\\.git$);\n}\n\nsub repo_missing {\n my $repo = shift;\n sanity($repo);\n\n return not -d \"$rc{GL_REPO_BASE}/$repo.git\";\n}\n\n# ----------------------------------------------------------------------\n\nsub load_common {\n\n _chdir( $rc{GL_ADMIN_BASE} );\n\n # we take an unusual approach to caching this function!\n # (requires that first call to load_common is before first call to load_1)\n if ( $last_repo and $split_conf{$last_repo} ) {\n delete $repos{$last_repo};\n delete $configs{$last_repo};\n return;\n }\n\n my $cc = \"./conf/gitolite.conf-compiled.pm\";\n\n _die \"parse '$cc' failed: \" . ( $! or $@ ) unless do $cc;\n\n if ( data_version_mismatch() ) {\n _system(\"gitolite setup\");\n _die \"parse '$cc' failed: \" . ( $! or $@ ) unless do $cc;\n _die \"data version update failed; this is serious\" if data_version_mismatch();\n }\n}\n\nsub load_1 {\n my $repo = shift;\n return if $repo =~ /^\\@/;\n trace( 3, $repo );\n\n if ( repo_missing($repo) ) {\n trace( 1, \"repo '$repo' missing\" ) if $repo =~ $REPONAME_PATT;\n return;\n }\n _chdir(\"$rc{GL_REPO_BASE}/$repo.git\");\n\n if ( $repo eq $last_repo ) {\n $repos{$repo} = $one_repo{$repo};\n $configs{$repo} = $one_config{$repo} if $one_config{$repo};\n return;\n }\n\n if ( -f \"gl-conf\" ) {\n return if not $split_conf{$repo} and not $rc{ALLOW_ORPHAN_GL_CONF};\n\n my $cc = \"./gl-conf\";\n _die \"parse '$cc' failed: \" . ( $@ or $! ) unless do $cc;\n\n $last_repo = $repo;\n $repos{$repo} = $one_repo{$repo};\n $configs{$repo} = $one_config{$repo} if $one_config{$repo};\n } else {\n _die \"split conf set, gl-conf not present for '$repo'\" if $split_conf{$repo};\n }\n}\n\n{\n my $lastrepo = '';\n my $lastuser = '';\n my @cached = ();\n\n sub rules {\n my ( $repo, $user ) = @_;\n trace( 3, $repo, $user );\n\n return @cached if ( $lastrepo eq $repo and $lastuser eq $user and @cached );\n\n my @rules = ();\n\n my @repos = memberships( 'repo', $repo );\n my @users = memberships( 'user', $user, $repo );\n trace( 3, \"memberships: \" . scalar(@repos) . \" repos and \" . scalar(@users) . \" users found\" );\n\n for my $r (@repos) {\n for my $u (@users) {\n push @rules, @{ $repos{$r}{$u} } if exists $repos{$r} and exists $repos{$r}{$u};\n }\n }\n\n @rules = sort { $a->[0] <=> $b->[0] } @rules;\n\n $lastrepo = $repo;\n $lastuser = $user;\n @cached = @rules;\n\n # however if the repo was missing, invalidate the cache\n $lastrepo = '' if repo_missing($repo);\n\n return @rules;\n }\n\n sub vrefs {\n my ( $repo, $user ) = @_;\n # fill the cache if needed\n rules( $repo, $user ) unless ( $lastrepo eq $repo and $lastuser eq $user and @cached );\n\n my %seen;\n my @vrefs = grep { /^VREF\\// and not $seen{$_}++ } map { $_->[2] } @cached;\n return @vrefs;\n }\n}\n\nsub memberships {\n trace( 3, @_ );\n my ( $type, $base, $repo ) = @_;\n $repo ||= '';\n my @ret;\n my $base2 = '';\n\n @ret = ( $base, '@all' );\n\n if ( $type eq 'repo' ) {\n # first, if a repo, say, pub/sitaram/project, has a gl-creator file\n # that says \"sitaram\", find memberships for pub/CREATOR/project also\n $base2 = generic_name($base);\n\n # second, you need to check in %repos also\n for my $i ( keys %repos, keys %configs ) {\n if ( $base eq $i or $base =~ /^$i$/ or $base2 and ( $base2 eq $i or $base2 =~ /^$i$/ ) ) {\n push @ret, $i;\n }\n }\n\n # add in any group names explicitly given in (GIT_DIR)/gl-repo-groups\n push @ret,\n map { s/^\\@?/\\@/; $_ }\n grep { ! /[^\\w@-]/ }\n split (' ', slurp(\"$ENV{GL_REPO_BASE}/$base.git/gl-repo-groups\"))\n if -f \"$ENV{GL_REPO_BASE}/$base.git/gl-repo-groups\";\n }\n\n push @ret, @{ $groups{$base} } if exists $groups{$base};\n push @ret, @{ $groups{$base2} } if $base2 and exists $groups{$base2};\n if ($type eq 'repo') {\n # regexes can only be used for repos, not for users\n for my $i ( keys %{ $patterns{groups} } ) {\n if ( $base =~ /^$i$/ or $base2 and ( $base2 =~ /^$i$/ ) ) {\n push @ret, @{ $groups{$i} };\n }\n }\n }\n\n push @ret, @{ ext_grouplist($base) } if $type eq 'user' and $rc{GROUPLIST_PGM};\n\n if ( $type eq 'user' and $repo and not repo_missing($repo) ) {\n # find the roles this user has when accessing this repo and add those\n # in as groupnames he is a member of. You need the already existing\n # memberships for this; see below this function for an example\n push @ret, user_roles( $base, $repo, @ret );\n }\n\n @ret = @{ sort_u( \\@ret ) };\n trace( 3, sort @ret );\n return @ret;\n}\n\n=for example\n\nconf/gitolite.conf:\n @g1 = u1\n @g2 = u1\n # now user is a member of both g1 and g2\n\ngl-perms for repo being accessed:\n READERS @g1\n\nThis should result in @READERS being added to the memberships that u1 has\n(when accessing this repo). So we send the current list (@g1, @g2) to\nuser_roles(), otherwise it has to redo that logic.\n\n=cut\n\nsub data_version_mismatch {\n return $data_version ne glrc('current-data-version');\n}\n\nsub user_roles {\n my ( $user, $repo, @eg ) = @_;\n\n # eg == existing groups (that user is already known to be a member of)\n my %eg = map { $_ => 1 } @eg;\n\n my %ret = ();\n my $f = \"$rc{GL_REPO_BASE}/$repo.git/gl-perms\";\n my @roles = ();\n if ( -f $f ) {\n my $fh = _open( \"<\", $f );\n chomp( @roles = <$fh> );\n }\n push @roles, \"CREATOR = \" . creator($repo);\n for (@roles) {\n # READERS u3 u4 @g1\n s/^\\s+//; s/ +$//; s/=/ /; s/\\s+/ /g; s/^\\@//;\n next if /^#/;\n next unless /\\S/;\n my ( $role, @members ) = split;\n # role = READERS, members = u3, u4, @g1\n if ( $role ne 'CREATOR' and not $rc{ROLES}{$role} ) {\n _warn \"role '$role' not allowed, ignoring\";\n next;\n }\n for my $m (@members) {\n if ( $m !~ $USERNAME_PATT ) {\n _warn \"ignoring '$m' in perms line\";\n next;\n }\n # if user eq u3/u4, or is a member of @g1, he has role READERS\n $ret{ '@' . $role } = 1 if $m eq $user or $eg{$m};\n }\n }\n\n return keys %ret;\n}\n\nsub generic_name {\n my $base = shift;\n my $base2 = '';\n my $creator;\n\n # get the creator name. For not-yet-born repos this is $ENV{GL_USER},\n # which should be set in all cases that we care about, viz., where we are\n # checking ^C permissions before new_wild_repo(), and the info command.\n # In particular, 'gitolite access' can't be used to check ^C perms on wild\n # repos that contain \"CREATOR\" if GL_USER is not set.\n $creator = creator($base);\n\n $base2 = $base;\n $base2 =~ s(\\b$creator\\b)(CREATOR) if $creator;\n $base2 = '' if $base2 eq $base; # if there was no change\n\n return $base2;\n}\n\nsub creator {\n my $repo = shift;\n sanity($repo);\n\n return ( $ENV{GL_USER} || '' ) if repo_missing($repo);\n my $f = \"$rc{GL_REPO_BASE}/$repo.git/gl-creator\";\n my $creator = '';\n chomp( $creator = slurp($f) ) if -f $f;\n return $creator;\n}\n\n{\n my %cache = ();\n\n sub ext_grouplist {\n my $user = shift;\n my $pgm = $rc{GROUPLIST_PGM};\n return [] if not $pgm;\n\n return $cache{$user} if $cache{$user};\n my @extgroups = map { s/^@?/@/; $_; } split ' ', `$rc{GROUPLIST_PGM} $user`;\n return ( $cache{$user} = \\@extgroups );\n }\n}\n\n# ----------------------------------------------------------------------\n# api functions\n# ----------------------------------------------------------------------\n\nsub lister_dispatch {\n my $command = shift;\n\n my $fn = $listers{$command} or _die \"unknown gitolite sub-command\";\n return $fn;\n}\n\n=for list_groups\nUsage: gitolite list-groups\n\n - lists all group names in conf\n - no options, no flags\n=cut\n\nsub list_groups {\n usage() if @_;\n\n load_common();\n\n my @g = ();\n while ( my ( $k, $v ) = each(%groups) ) {\n push @g, @{$v};\n }\n return ( sort_u( \\@g ) );\n}\n\n=for list_users\nUsage: gitolite list-users []\n\nList all users and groups explicitly named in a rule.\n\n- you will have to run 'list-members' on each group name to expand it -- for\n details and caveats on that please see its help message.\n- User names not mentioned in an access rule will not show up at all (for\n example, if you have users who only have access via an '@all' rule).\n\nWARNING: may be slow if you have thousands of repos. The optional repo name\npattern is an unanchored regex; it can speed things up if you're interested\nonly in users of a matching set of repos. This is only an optimisation, not\nan actual access list; you will still have to pipe it to 'gitolite access'\nwith appropriate arguments to get an actual access list.\n\nNOTE: If you're running in ssh mode, it may be simpler to parse the authorized\nkeys file in ~/.ssh, like so:\n perl -lne '/ ([a-z0-9]+)\"/; print $1 if $1' < ~/.ssh/authorized_keys | sort -u\nIf you're running in http mode, only your web server knows all the potential\nuser names.\n=cut\n\nsub list_users {\n my $patt = shift || '.';\n usage() if $patt eq '-h' or @_;\n my $count = 0;\n my $total = 0;\n\n load_common();\n\n my @u = map { keys %{$_} } values %repos;\n $total = scalar( grep { /$patt/ } keys %split_conf );\n warn \"WARNING: you have $total repos to check; this could take some time!\\n\" if $total > 100;\n for my $one ( grep { /$patt/ } keys %split_conf ) {\n load_1($one);\n $count++; print STDERR \"$count / $total\\r\" if not( $count % 100 ) and timer(5);\n push @u, map { keys %{$_} } values %one_repo;\n }\n print STDERR \"\\n\" if $count >= 100;\n return ( sort_u( \\@u ) );\n}\n\n=for list_repos\nUsage: gitolite list-repos\n\n - lists all repos/repo groups in conf\n - no options, no flags\n=cut\n\nsub list_repos {\n usage() if @_;\n\n load_common();\n\n my @r = keys %repos;\n push @r, keys %split_conf;\n\n return ( sort_u( \\@r ) );\n}\n\n=for list_memberships\nUsage: gitolite list-memberships -u|-r \n\nList all groups a name is a member of. One of the flags '-u' or '-r' is\nmandatory, to specify if the name is a user or a repo.\n\nFor users, the output includes the result from GROUPLIST_PGM, if it is\ndefined. For repos, the output includes any repo patterns that the repo name\nmatches, as well as any groups that contain those patterns.\n=cut\n\nsub list_memberships {\n require Getopt::Long;\n\n my ( $user, $repo, $help );\n\n Getopt::Long::GetOptionsFromArray(\n \\@_,\n 'user|u=s' => \\$user,\n 'repo|r=s' => \\$repo,\n 'help|h' => \\$help,\n );\n usage() if $help or ( not $user and not $repo );\n\n load_common();\n my @m;\n\n if ( $user and $repo ) {\n # unsupported/undocumented except via \"in_role()\" in Easy.pm\n @m = memberships( 'user', $user, $repo );\n } elsif ($user) {\n @m = memberships( 'user', $user );\n } elsif ($repo) {\n @m = memberships( 'repo', $repo );\n }\n\n @m = grep { $_ ne '@all' and $_ ne ( $user || $repo ) } @m;\n return ( sort_u( \\@m ) );\n}\n\n=for list_members\nUsage: gitolite list-members \n\n - list all members of a group\n - takes one group name\n\n'@all' is not expandable in this context. Also, if you have GROUPLIST_PGM set\nin your rc file[1], gitolite cannot expand group names completely; only your\nexternal database can.\n\n[1]: http://gitolite.com/gitolite/conf.html#getting-user-group-info-from-ldap\n\n=cut\n\nsub list_members {\n usage() if @_ and $_[0] eq '-h' or not @_;\n\n my $name = shift;\n\n load_common();\n\n my @m = ();\n while ( my ( $k, $v ) = each(%groups) ) {\n for my $g ( @{$v} ) {\n push @m, $k if $g eq $name;\n }\n }\n\n return ( sort_u( \\@m ) );\n}\n\n# ----------------------------------------------------------------------\n\n{\n my $start_time = 0;\n\n sub timer {\n unless ($start_time) {\n $start_time = time();\n return 0;\n }\n my $elapsed = shift;\n return 0 if time() - $start_time < $elapsed;\n $start_time = time();\n return 1;\n }\n}\n\n1;\n\n" }, { "path": "src/lib/Gitolite/Conf/Store.pm", "content": "package Gitolite::Conf::Store;\n\n# receive parsed conf data and store it\n# ----------------------------------------------------------------------\n\n@EXPORT = qw(\n add_to_group\n set_repolist\n parse_refs\n parse_users\n add_rule\n add_config\n set_subconf\n\n expand_list\n new_repos\n new_repo\n new_wild_repo\n hook_repos\n store\n parse_done\n);\n\nuse Exporter 'import';\nuse Data::Dumper;\n$Data::Dumper::Indent = 1;\n$Data::Dumper::Sortkeys = 1;\n\nuse Gitolite::Rc;\nuse Gitolite::Common;\nuse Gitolite::Hooks::Update;\nuse Gitolite::Hooks::PostUpdate;\n\nuse strict;\nuse warnings;\n\n# ----------------------------------------------------------------------\n\nmy %repos;\nmy %groups;\nmy %configs;\nmy %split_conf;\n\nmy @repolist; # current repo list; reset on each 'repo ...' line\nmy $subconf = 'master';\nmy $nextseq = 0;\nmy %ignored;\n\n# ----------------------------------------------------------------------\n\nsub add_to_group {\n my ( $lhs, @rhs ) = @_;\n _die \"bad group '$lhs'\" unless $lhs =~ $REPONAME_PATT;\n map { _die \"bad expansion '$_'\" unless $_ =~ $REPOPATT_PATT } @rhs;\n\n # store the group association, but overload it to keep track of when\n # the group was *first* created by using $subconf as the *value*\n do { $groups{$lhs}{$_} ||= $subconf }\n for ( expand_list(@rhs) );\n\n # create the group hash even if empty\n $groups{$lhs} = {} unless $groups{$lhs};\n}\n\nsub set_repolist {\n my @in = @_;\n @repolist = ();\n # ...sanity checks\n while (@in) {\n $_ = shift @in;\n if ( check_subconf_repo_disallowed( $subconf, $_ ) ) {\n if ( exists $groups{$_} ) {\n # groupname disallowed; try individual members now\n ( my $g = $_ ) =~ s/^\\@$subconf\\./\\@/;\n _warn \"expanding '$g'; this *may* slow down compilation\";\n unshift @in, keys %{ $groups{$_} };\n next;\n }\n $ignored{$subconf}{$_} = 1;\n next;\n }\n\n _warn \"explicit '.git' extension ignored for $_.git\" if s/\\.git$//;\n _die \"bad reponame '$_'\" if $_ !~ $REPOPATT_PATT;\n\n push @repolist, $_;\n }\n}\n\nsub parse_refs {\n my $refs = shift;\n my @refs; @refs = split( ' ', $refs ) if $refs;\n @refs = expand_list(@refs);\n\n # if no ref is given, this PERM applies to all refs\n @refs = qw(refs/.*) unless @refs;\n\n # fully qualify refs that dont start with \"refs/\" or \"VREF/\";\n # prefix them with \"refs/heads/\"\n @refs = map { m(^(refs|VREF)/) or s(^)(refs/heads/); $_ } @refs;\n\n return @refs;\n}\n\nsub parse_users {\n my $users = shift;\n my @users = split ' ', $users;\n do { _die \"bad username '$_'\" unless $_ =~ $USERNAME_PATT }\n for @users;\n\n return @users;\n}\n\nsub add_rule {\n my ( $perm, $ref, $user, $fname, $lnum ) = @_;\n _warn \"doesn't make sense to supply a ref ('$ref') for 'R' rule\"\n if $perm eq 'R' and $ref ne 'refs/.*';\n _warn \"possible undeclared group '$user'\"\n if $user =~ /^@/\n and not $groups{$user}\n and not $rc{GROUPLIST_PGM}\n and not special_group($user);\n _die \"bad ref '$ref'\" unless $ref =~ $REPOPATT_PATT;\n _die \"bad user '$user'\" unless $user =~ $USERNAME_PATT;\n\n $nextseq++;\n store_rule_info( $nextseq, $fname, $lnum );\n for my $repo (@repolist) {\n push @{ $repos{$repo}{$user} }, [ $nextseq, $perm, $ref ];\n }\n\n sub special_group {\n # ok perl doesn't really have lexical subs (at least not the older\n # perls I want to support) but let's pretend...\n my $g = shift;\n $g =~ s/^\\@//;\n return 1 if $g eq 'all' or $g eq 'CREATOR';\n return 1 if $rc{ROLES}{$g};\n return 0;\n }\n\n}\n\nsub add_config {\n my ( $n, $key, $value ) = @_;\n\n $nextseq++;\n for my $repo (@repolist) {\n push @{ $configs{$repo} }, [ $nextseq, $key, $value ];\n }\n}\n\nsub set_subconf {\n $subconf = shift;\n _die \"bad subconf '$subconf'\" unless $subconf =~ /^[-\\w.]+$/;\n}\n\n# ----------------------------------------------------------------------\n\nsub expand_list {\n my @list = @_;\n my @new_list = ();\n\n for my $item (@list) {\n if ( $item =~ /^@/ and $item ne '@all' ) # nested group\n {\n _die \"undefined group '$item'\" unless $groups{$item};\n # add those names to the list\n push @new_list, sort keys %{ $groups{$item} };\n } else {\n push @new_list, $item;\n }\n }\n\n return @new_list;\n}\n\nsub new_repos {\n trace(3);\n _chdir( $rc{GL_REPO_BASE} );\n\n # normal repos\n my @repos = grep { $_ =~ $REPONAME_PATT and not /^@/ } ( sort keys %repos, sort keys %configs );\n # add in members of repo groups\n map { push @repos, keys %{ $groups{$_} } } grep { /^@/ and $_ ne '@all' } keys %repos;\n\n for my $repo ( @{ sort_u( \\@repos ) } ) {\n next unless $repo =~ $REPONAME_PATT; # skip repo patterns\n next if $repo =~ m(^\\@|EXTCMD/); # skip groups and fake repos\n\n # use gl-conf as a sentinel; if it exists, all is well\n next if -f \"$repo.git/gl-conf\";\n\n if (-d \"$repo.git\") {\n # directory exists but sentinel missing? Maybe a freshly imported repo?\n hook_1($repo);\n } else {\n push @{ $rc{NEW_REPOS_CREATED} }, $repo;\n trigger( 'PRE_CREATE', $repo );\n new_repo($repo);\n }\n }\n}\n\nsub new_repo {\n my $repo = shift;\n trace( 3, $repo );\n\n _mkdir(\"$repo.git\");\n _chdir(\"$repo.git\");\n _system(\"git init --bare >&2\");\n unlink \"description\";\n _chdir( $rc{GL_REPO_BASE} );\n hook_1($repo);\n}\n\nsub new_wild_repo {\n my ( $repo, $user, $aa ) = @_;\n _chdir( $rc{GL_REPO_BASE} );\n\n trigger( 'PRE_CREATE', $repo, $user, $aa );\n new_repo($repo);\n _print( \"$repo.git/gl-creator\", $user );\n trigger( 'POST_CREATE', $repo, $user, $aa );\n\n _chdir( $rc{GL_ADMIN_BASE} );\n}\n\nsub hook_repos {\n trace(3);\n\n # all repos, all hooks\n _chdir( $rc{GL_REPO_BASE} );\n my $phy_repos = list_phy_repos(1);\n\n for my $repo ( @{$phy_repos} ) {\n hook_1($repo);\n }\n}\n\nsub store {\n trace(3);\n\n # first write out the ones for the physical repos\n _chdir( $rc{GL_REPO_BASE} );\n\n # list of repos (union of keys of %repos plus %configs)\n my %kr_kc;\n @kr_kc{ keys %repos } = ();\n @kr_kc{ keys %configs } = ();\n for my $repo ( keys %kr_kc ) {\n store_1($repo);\n }\n\n _chdir( $rc{GL_ADMIN_BASE} );\n store_common();\n}\n\nsub parse_done {\n for my $ig ( sort keys %ignored ) {\n _warn \"subconf '$ig' attempting to set access for \" . join( \", \", sort keys %{ $ignored{$ig} } );\n }\n\n close_rule_info();\n}\n\n# ----------------------------------------------------------------------\n\nsub check_subconf_repo_disallowed {\n # trying to set access for $repo (='foo')...\n my ( $subconf, $repo ) = @_;\n trace( 2, $subconf, $repo );\n\n # processing the master config, not a subconf\n return 0 if $subconf eq 'master';\n # subconf is also called 'foo' (you're allowed to have a\n # subconf that is only concerned with one repo)\n return 0 if $subconf eq $repo;\n # same thing in big-config-land; foo is just @foo now\n return 0 if ( \"\\@$subconf\" eq $repo );\n my @matched = grep { $repo =~ /^$_$/ }\n grep { $groups{\"\\@$subconf\"}{$_} eq 'master' }\n sort keys %{ $groups{\"\\@$subconf\"} };\n return 0 if @matched > 0;\n\n trace( 2, \"-> disallowed\" );\n return 1;\n}\n\nsub store_1 {\n # warning: writes and *deletes* it from %repos and %configs\n my ($repo) = shift;\n trace( 3, $repo );\n return unless -d \"$repo.git\";\n\n my ( %one_repo, %one_config );\n\n my $dumped_data = '';\n if ( $repos{$repo} ) {\n $one_repo{$repo} = $repos{$repo};\n delete $repos{$repo};\n $dumped_data = Data::Dumper->Dump( [ \\%one_repo ], [qw(*one_repo)] );\n }\n\n if ( $configs{$repo} ) {\n $one_config{$repo} = $configs{$repo};\n delete $configs{$repo};\n $dumped_data .= Data::Dumper->Dump( [ \\%one_config ], [qw(*one_config)] );\n }\n\n _print( \"$repo.git/gl-conf\", $dumped_data );\n\n $split_conf{$repo} = 1;\n}\n\nsub store_common {\n trace(3);\n my $cc = \"conf/gitolite.conf-compiled.pm\";\n my $compiled_fh = _open( \">\", \"$cc.new\" );\n\n my %patterns = ();\n\n my $data_version = glrc('current-data-version');\n trace( 3, \"data_version = $data_version\" );\n print $compiled_fh Data::Dumper->Dump( [$data_version], [qw(*data_version)] );\n\n my $dumped_data = Data::Dumper->Dump( [ \\%repos ], [qw(*repos)] );\n $dumped_data .= Data::Dumper->Dump( [ \\%configs ], [qw(*configs)] ) if %configs;\n\n print $compiled_fh $dumped_data;\n\n if (%groups) {\n my %groups = %{ inside_out( \\%groups ) };\n $dumped_data = Data::Dumper->Dump( [ \\%groups ], [qw(*groups)] );\n print $compiled_fh $dumped_data;\n\n # save patterns in %groups for faster handling of multiple repos, such\n # as happens in the various POST_COMPILE scripts\n for my $k ( keys %groups ) {\n $patterns{groups}{$k} = 1 unless $k =~ $REPONAME_PATT;\n }\n }\n\n print $compiled_fh Data::Dumper->Dump( [ \\%patterns ], [qw(*patterns)] ) if %patterns;\n\n print $compiled_fh Data::Dumper->Dump( [ \\%split_conf ], [qw(*split_conf)] ) if %split_conf;\n\n close $compiled_fh or _die \"close compiled-conf failed: $!\\n\";\n rename \"$cc.new\", $cc;\n}\n\n{\n my $hook_reset = 0;\n\n sub hook_1 {\n my $repo = shift;\n trace( 3, $repo );\n\n # reset the gitolite supplied hooks, in case someone fiddled with\n # them, but only once per run\n if ( not $hook_reset ) {\n _mkdir(\"$rc{GL_ADMIN_BASE}/hooks/common\");\n _mkdir(\"$rc{GL_ADMIN_BASE}/hooks/gitolite-admin\");\n _print( \"$rc{GL_ADMIN_BASE}/hooks/common/update\", update_hook() );\n _print( \"$rc{GL_ADMIN_BASE}/hooks/gitolite-admin/post-update\", post_update_hook() );\n chmod 0755, \"$rc{GL_ADMIN_BASE}/hooks/common/update\";\n chmod 0755, \"$rc{GL_ADMIN_BASE}/hooks/gitolite-admin/post-update\";\n $hook_reset++;\n }\n\n # propagate user-defined (custom) hooks to all repos\n ln_sf( \"$rc{LOCAL_CODE}/hooks/common\", \"*\", \"$repo.git/hooks\" ) if $rc{LOCAL_CODE};\n\n # override/propagate gitolite defined hooks for all repos\n ln_sf( \"$rc{GL_ADMIN_BASE}/hooks/common\", \"*\", \"$repo.git/hooks\" );\n # override/propagate gitolite defined hooks for the admin repo\n ln_sf( \"$rc{GL_ADMIN_BASE}/hooks/gitolite-admin\", \"*\", \"$repo.git/hooks\" ) if $repo eq 'gitolite-admin';\n }\n}\n\nsub inside_out {\n my $href = shift;\n # input conf: @aa = bb cc @bb = @aa dd\n\n my %ret = ();\n while ( my ( $k, $v ) = each( %{$href} ) ) {\n # $k is '@aa', $v is a href\n for my $k2 ( keys %{$v} ) {\n # $k2 is bb, then cc\n push @{ $ret{$k2} }, $k;\n }\n }\n return \\%ret;\n # %groups = ( 'bb' => [ '@bb', '@aa' ], 'cc' => [ '@bb', '@aa' ], 'dd' => [ '@bb' ]);\n}\n\n{\n my $ri_fh = '';\n\n sub store_rule_info {\n $ri_fh = _open( \">\", $rc{GL_ADMIN_BASE} . \"/conf/rule_info\" ) unless $ri_fh;\n # $nextseq, $fname, $lnum\n print $ri_fh join( \"\\t\", @_ ) . \"\\n\";\n }\n\n sub close_rule_info {\n close $ri_fh or die \"close rule_info file failed: $!\";\n }\n}\n\n1;\n\n" }, { "path": "src/lib/Gitolite/Conf/Sugar.pm", "content": "# and now for something completely different...\n\npackage SugarBox;\n\nsub run_sugar_script {\n my ( $ss, $lref ) = @_;\n do $ss if -r $ss;\n $lref = sugar_script($lref);\n return $lref;\n}\n\n# ----------------------------------------------------------------------\n\npackage Gitolite::Conf::Sugar;\n\n# syntactic sugar for the conf file, including site-local macros\n# ----------------------------------------------------------------------\n\n@EXPORT = qw(\n sugar\n);\n\nuse Exporter 'import';\n\nuse Gitolite::Rc;\nuse Gitolite::Common;\nuse Gitolite::Conf::Explode;\n\nuse strict;\nuse warnings;\n\n# ----------------------------------------------------------------------\n\nsub sugar {\n # gets a filename, returns a listref\n\n my @lines = ();\n explode( shift, 'master', \\@lines );\n\n my $lines;\n $lines = \\@lines;\n\n # run through the sugar stack one by one\n\n # first, user supplied sugar:\n if ( exists $rc{SYNTACTIC_SUGAR} ) {\n if ( ref( $rc{SYNTACTIC_SUGAR} ) ne 'ARRAY' ) {\n _warn \"bad syntax for specifying sugar scripts; see docs\";\n } else {\n for my $s ( @{ $rc{SYNTACTIC_SUGAR} } ) {\n\n # perl-ism; apart from keeping the full path separate from the\n # simple name, this also protects %rc from change by implicit\n # aliasing, which would happen if you touched $s itself\n my $sfp = _which( \"syntactic-sugar/$s\", 'r' );\n\n _warn(\"skipped sugar script '$s'\"), next if not -r $sfp;\n $lines = SugarBox::run_sugar_script( $sfp, $lines );\n $lines = [ grep /\\S/, map { cleanup_conf_line($_) } @$lines ];\n }\n }\n }\n\n # then our stuff:\n\n $lines = rw_cdm($lines);\n $lines = option($lines); # must come after rw_cdm\n $lines = owner_desc($lines);\n $lines = name_vref($lines);\n $lines = role_names($lines);\n $lines = skip_block($lines);\n\n return $lines;\n}\n\nsub rw_cdm {\n my $lines = shift;\n my @ret;\n\n # repo foo <...> RWC = ...\n # -> option CREATE_IS_C = 1\n # (and similarly DELETE_IS_D and MERGE_CHECK)\n # but only once per repo of course\n\n my %seen = ();\n for my $line (@$lines) {\n push @ret, $line;\n if ( $line =~ /^repo / ) {\n %seen = ();\n } elsif ( $line =~ /^(-|C|R|RW\\+?(?:C?D?|D?C?)M?) (.* )?= (.+)/ ) {\n my $perms = $1;\n push @ret, \"option DELETE_IS_D = 1\" if $perms =~ /D/ and not $seen{D}++;\n push @ret, \"option CREATE_IS_C = 1\" if $perms =~ /RW.*C/ and not $seen{C}++;\n push @ret, \"option MERGE_CHECK = 1\" if $perms =~ /M/ and not $seen{M}++;\n }\n }\n return \\@ret;\n}\n\nsub option {\n my $lines = shift;\n my @ret;\n\n # option foo = bar\n # -> config gitolite-options.foo = bar\n\n for my $line (@$lines) {\n $line =~ s/option mirror\\.slaves/option mirror.copies/;\n if ( $line =~ /^option (\\S+) = (\\S.*)/ ) {\n push @ret, \"config gitolite-options.$1 = $2\";\n } else {\n push @ret, $line;\n }\n }\n return \\@ret;\n}\n\nsub owner_desc {\n my $lines = shift;\n my @ret;\n\n # owner = \"owner name\"\n # -> config gitweb.owner = owner name\n # desc = \"some long description\"\n # -> config gitweb.description = some long description\n # category = \"whatever...\"\n # -> config gitweb.category = whatever...\n\n for my $line (@$lines) {\n if ( $line =~ /^desc = (\\S.*)/ ) {\n push @ret, \"config gitweb.description = $1\";\n } elsif ( $line =~ /^owner = (\\S.*)/ ) {\n push @ret, \"config gitweb.owner = $1\";\n } elsif ( $line =~ /^category = (\\S.*)/ ) {\n push @ret, \"config gitweb.category = $1\";\n } else {\n push @ret, $line;\n }\n }\n return \\@ret;\n}\n\nsub name_vref {\n my $lines = shift;\n my @ret;\n\n # NAME/foo = \n # -> VREF/NAME/foo = \n\n for my $line (@$lines) {\n if ( $line =~ /^(-|R\\S+) \\S.* = \\S.*/ ) {\n $line =~ s( NAME/)( VREF/NAME/)g;\n }\n push @ret, $line;\n }\n return \\@ret;\n}\n\nsub role_names {\n my $lines = shift;\n my @ret;\n\n # [] = \n # -> same but with \"@\" prepended to rolenames\n\n for my $line (@$lines) {\n if ( $line =~ /^(-|C|R|RW\\+?(?:C?D?|D?C?)M?) (.* )?= (.+)/ ) {\n my ( $p, $r ) = ( $1, $2 );\n my $u = '';\n for ( split ' ', $3 ) {\n $_ = \"\\@$_\" if $_ eq 'CREATOR' or $rc{ROLES}{$_};\n $u .= \" $_\";\n }\n $r ||= '';\n # mind the spaces (or play safe and run cleanup_conf_line again)\n push @ret, cleanup_conf_line(\"$p $r = $u\");\n } else {\n push @ret, $line;\n }\n }\n return \\@ret;\n}\n\nsub skip_block {\n my $lines = shift;\n\n my @out = ();\n for (@$lines) {\n my $skip = 0;\n $skip = 1 if /^= *begin testconf$/;\n $skip = 1 if /^= *begin template-data$/;\n # add code for other types of blocks here as needed\n\n next if $skip .. /^= *end$/;\n push @out, $_;\n }\n\n return \\@out;\n}\n\n1;\n\n" }, { "path": "src/lib/Gitolite/Conf.pm", "content": "package Gitolite::Conf;\n\n# explode/parse a conf file\n# ----------------------------------------------------------------------\n\n@EXPORT = qw(\n compile\n explode\n parse\n);\n\nuse Exporter 'import';\n\nuse Gitolite::Rc;\nuse Gitolite::Common;\nuse Gitolite::Conf::Sugar;\nuse Gitolite::Conf::Store;\n\nuse strict;\nuse warnings;\n\n# ----------------------------------------------------------------------\n\nsub compile {\n _die \"'gitolite compile' does not take any arguments\" if @_;\n\n _chdir( $rc{GL_ADMIN_BASE} );\n _chdir(\"conf\");\n\n parse( sugar('gitolite.conf') );\n\n # the order matters; new repos should be created first, to give store a\n # place to put the individual gl-conf files\n new_repos();\n\n # cache control\n if ($rc{CACHE}) {\n require Gitolite::Cache;\n Gitolite::Cache->import(qw(cache_control));\n\n cache_control('stop');\n }\n\n store();\n\n if ($rc{CACHE}) {\n cache_control('start');\n }\n\n # remove entries from POST_CREATE which also exist in POST_COMPILE. This\n # not only saves us having to implement an optimisation in *those*\n # scripts, but more importantly, moves the optimisation one step up -- we\n # don't even *call* those scripts now.\n my %pco = map { $_ => 1 } @{ $rc{POST_COMPILE} };\n @{ $rc{POST_CREATE} } = grep { ! exists $pco{$_} } @{ $rc{POST_CREATE} };\n\n for my $repo ( @{ $rc{NEW_REPOS_CREATED} } ) {\n trigger( 'POST_CREATE', $repo );\n }\n\n # process rule template data\n _system(\"gitolite compile-template-data\");\n}\n\nsub parse {\n my $lines = shift;\n trace( 3, scalar(@$lines) . \" lines incoming\" );\n\n my ( $fname, $lnum );\n for my $line (@$lines) {\n ( $fname, $lnum ) = ( $1, $2 ), next if $line =~ /^# (\\S+) (\\d+)$/;\n # user or repo groups\n if ( $line =~ /^(@\\S+) = (.*)/ ) {\n add_to_group( $1, split( ' ', $2 ) );\n } elsif ( $line =~ /^repo (.*)/ ) {\n set_repolist( split( ' ', $1 ) );\n } elsif ( $line =~ /^(-|C|R|RW\\+?(?:C?D?|D?C?)M?) (.* )?= (.+)/ ) {\n my $perm = $1;\n my @refs = parse_refs( $2 || '' );\n my @users = parse_users($3);\n\n for my $ref (@refs) {\n for my $user (@users) {\n add_rule( $perm, $ref, $user, $fname, $lnum );\n }\n }\n } elsif ( $line =~ /^config (.+) = ?(.*)/ ) {\n my ( $key, $value ) = ( $1, $2 );\n $value =~ s/^['\"](.*)[\"']$/$1/;\n my @validkeys = split( ' ', ( $rc{GIT_CONFIG_KEYS} || '' ) );\n push @validkeys, \"gitolite-options\\\\..*\";\n my @matched = grep { $key =~ /^$_$/i } @validkeys;\n _die \"git config '$key' not allowed\\ncheck GIT_CONFIG_KEYS in the rc file\" if ( @matched < 1 );\n _die \"bad config value '$value'\" if $value =~ $UNSAFE_PATT;\n while ( my ( $mk, $mv ) = each %{ $rc{SAFE_CONFIG} } ) {\n $value =~ s/%$mk/$mv/g;\n }\n add_config( 1, $key, $value );\n } elsif ( $line =~ /^subconf (\\S+)$/ ) {\n trace( 3, $line );\n set_subconf($1);\n } else {\n _warn \"syntax error, ignoring: '$line'\";\n }\n }\n parse_done();\n}\n\n1;\n" }, { "path": "src/lib/Gitolite/Easy.pm", "content": "package Gitolite::Easy;\n\n# easy access to gitolite from external perl programs\n# ----------------------------------------------------------------------\n# most/all functions in this module test $ENV{GL_USER}'s rights and\n# permissions so it needs to be set.\n\n# \"use\"-ing this module\n# ----------------------------------------------------------------------\n# Using this module from within a gitolite trigger or command is easy; you\n# just need 'use lib $ENV{GL_LIBDIR};' before the 'use Gitolite::Easy;'.\n#\n# Using it from something completely outside gitolite requires a bit more\n# work. First, run 'gitolite query-rc -a' to find the correct values for\n# GL_BINDIR and GL_LIBDIR in your installation. Then use this code in your\n# external program, using the paths you just found:\n#\n# BEGIN {\n# $ENV{HOME} = \"/home/git\"; # or whatever is the hosting user's $HOME\n# $ENV{GL_BINDIR} = \"/full/path/to/gitolite/src\";\n# $ENV{GL_LIBDIR} = \"/full/path/to/gitolite/src/lib\";\n# }\n# use lib $ENV{GL_LIBDIR};\n# use Gitolite::Easy;\n\n# API documentation\n# ----------------------------------------------------------------------\n# documentation for each function is at the top of the function.\n# Documentation is NOT in pod format; just read the source with a nice syntax\n# coloring text editor and you'll be happy enough. (I do not like POD; please\n# don't send me patches for this aspect of the module).\n\n#<<<\n@EXPORT = qw(\n is_admin\n is_super_admin\n in_group\n in_role\n\n owns\n can_read\n can_write\n\n config\n\n textfile\n\n %rc\n say\n say2\n _die\n _warn\n _print\n usage\n\n option\n);\n#>>>\nuse Exporter 'import';\n\nuse Gitolite::Rc;\nuse Gitolite::Common;\nuse Gitolite::Conf::Load;\n\nuse strict;\nuse warnings;\n\nmy $user;\n\n# ----------------------------------------------------------------------\n\n# is_admin()\n\n# return true if $ENV{GL_USER} is set and has W perms to the admin repo\n\n# shell equivalent\n# if gitolite access -q gitolite-admin $GL_USER W; then ...\n\nsub is_admin {\n valid_user();\n return not( access( 'gitolite-admin', $user, 'W', 'any' ) =~ /DENIED/ );\n}\n\n# is_super_admin()\n\n# (useful only if you are using delegation)\n\n# return true if $ENV{GL_USER} is set and has W perms to any file in the admin\n# repo\n\n# shell equivalent\n# if gitolite access -q gitolite-admin $GL_USER W VREF/NAME/; then ...\nsub is_super_admin {\n valid_user();\n return not( access( 'gitolite-admin', $user, 'W', 'VREF/NAME/' ) =~ /DENIED/ );\n}\n\n# in_group()\n\n# return true if $ENV{GL_USER} is set and is in the given group\n\n# shell equivalent\n# if gitolite list-memberships $GL_USER | grep -x $GROUPNAME >/dev/null; then ...\nsub in_group {\n valid_user();\n my $g = shift;\n $g =~ s/^\\@?/@/;\n\n return grep { $_ eq $g } @{ Gitolite::Conf::Load::list_memberships( '-u', $user ) };\n}\n\n# in_role()\n\n# return true if $ENV{GL_USER} is set and has the given role for the given repo\n\n# shell equivalent\n# if gitolite list-memberships -u $GL_USER -r $GL_REPO | grep -x $ROLENAME >/dev/null; then ...\nsub in_role {\n valid_user();\n my $r = shift;\n $r =~ s/^\\@?/@/;\n my $repo = shift;\n\n return grep { $_ eq $r } @{ Gitolite::Conf::Load::list_memberships( \"-u\", $user, \"-r\", $repo ) };\n}\n\n# owns()\n\n# return true if $ENV{GL_USER} is set and is an OWNER of the given repo.\n\n# shell equivalent (assuming GL_USER is set)\n# if gitolite owns $REPONAME; then ...\nsub owns {\n valid_user();\n my $r = shift;\n\n # prevent unnecessary disclosure of repo existence info\n return 0 if repo_missing($r);\n\n return ( creator($r) eq $user or $rc{OWNER_ROLENAME} and in_role( $rc{OWNER_ROLENAME}, $r ) );\n}\n\n# can_read()\n# return true if $ENV{GL_USER} is set and can read the given repo\n\n# shell equivalent\n# if gitolite access -q $REPONAME $GL_USER R; then ...\nsub can_read {\n valid_user();\n my $r = shift;\n return not( access( $r, $user, 'R', 'any' ) =~ /DENIED/ );\n}\n\n# can_write()\n# return true if $ENV{GL_USER} is set and can write to the given repo.\n# Optional second argument can be '+' to check that instead of 'W'. Optional\n# third argument can be a full ref name instead of 'any'.\n\n# shell equivalent\n# if gitolite access -q $REPONAME $GL_USER W; then ...\nsub can_write {\n valid_user();\n my ( $r, $aa, $ref ) = @_;\n $aa ||= 'W';\n $ref ||= 'any';\n return not( access( $r, $user, $aa, $ref ) =~ /DENIED/ );\n}\n\n# config()\n# given a repo and a key, return a hash containing all the git config\n# variables for that repo where the section+key match the regex. If none are\n# found, return an empty hash. If you don't want it as a regex, use \\Q\n# appropriately\n\n# shell equivalent\n# foo=$(gitolite git-config -r $REPONAME foo\\\\.bar)\nsub config {\n my $repo = shift;\n my $key = shift;\n\n return () if repo_missing($repo);\n\n my $ret = git_config( $repo, $key );\n return %$ret;\n}\n\n# ----------------------------------------------------------------------\n\n# maintain a textfile; see comments in code for details, and calls in various\n# other programs (like 'motd', 'desc', and 'readme') for how to call\nsub textfile {\n my %h = @_;\n my $repodir;\n\n # target file\n _die \"need file\" unless $h{file};\n _die \"'$h{file}' contains a '/'\" if $h{file} =~ m(/);\n Gitolite::Conf::Load::sanity($h{file}, $REPONAME_PATT);\n\n # target file's location. This can come from one of two places: dir\n # (which comes from our code, so does not need to be sanitised), or repo,\n # which may come from the user\n _die \"need exactly one of repo or dir\" unless $h{repo} xor $h{dir};\n _die \"'$h{dir}' does not exist\" if $h{dir} and not -d $h{dir};\n if ($h{repo}) {\n Gitolite::Conf::Load::sanity($h{repo}, $REPONAME_PATT);\n $h{dir} = \"$rc{GL_REPO_BASE}/$h{repo}.git\";\n _die \"repo '$h{repo}' does not exist\" if not -d $h{dir};\n\n my $umask = option( $h{repo}, 'umask' );\n # note: using option() moves us to ADMIN_BASE, but we don't care here\n umask oct($umask) if $umask;\n }\n\n # final full file name\n my $f = \"$h{dir}/$h{file}\";\n\n # operation\n _die \"can't have both prompt and text\" if defined $h{prompt} and defined $h{text};\n if (defined $h{prompt}) {\n print STDERR $h{prompt};\n my $t = join( \"\", <> );\n _print($f, $t);\n } elsif (defined $h{text}) {\n _print($f, $h{text});\n } else {\n return slurp($f) if -f $f;\n }\n\n return '';\n}\n\n# ----------------------------------------------------------------------\n\nsub valid_user {\n _die \"GL_USER not set\" unless exists $ENV{GL_USER};\n $user = $ENV{GL_USER};\n}\n\n1;\n" }, { "path": "src/lib/Gitolite/Hooks/PostUpdate.pm", "content": "package Gitolite::Hooks::PostUpdate;\n\n# everything to do with the post-update hook\n# ----------------------------------------------------------------------\n\n@EXPORT = qw(\n post_update\n post_update_hook\n);\n\nuse Exporter 'import';\n\nuse Gitolite::Rc;\nuse Gitolite::Common;\n\nuse strict;\nuse warnings;\n\n# ----------------------------------------------------------------------\n\nsub post_update {\n trace( 3, 'post-up', @ARGV );\n\n my $master=`git symbolic-ref HEAD`; chomp $master;\n\n exit 0 unless grep( $_ eq $master, @ARGV );\n # this is the *real* post_update hook for gitolite\n $master =~ s(.*/)();\n\n tsh_try(\"git ls-tree --name-only $master\");\n _die \"no files/dirs called 'hooks' or 'logs' are allowed\" if tsh_text() =~ /^(hooks|logs)$/m;\n\n my $hooks_changed = 0;\n {\n local $ENV{GIT_WORK_TREE} = $rc{GL_ADMIN_BASE};\n\n tsh_try(\"git diff --name-only $master\");\n $hooks_changed++ if tsh_text() =~ m(/hooks/common/);\n # the leading slash ensure that this hooks/common directory is below\n # some top level directory, not *at* the top. That's LOCAL_CODE, and\n # it's actual name could be anything but it doesn't matter to us.\n\n tsh_try(\"git checkout -f --quiet $master\");\n }\n _system(\"gitolite compile\");\n _system(\"gitolite setup --hooks-only\") if $hooks_changed;\n _system(\"gitolite trigger POST_COMPILE\");\n\n exit 0;\n}\n\n{\n my $text = '';\n\n sub post_update_hook {\n if ( not $text ) {\n local $/ = undef;\n $text = ;\n }\n return $text;\n }\n}\n\n1;\n\n__DATA__\n#!/usr/bin/perl\n\nuse strict;\nuse warnings;\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Hooks::PostUpdate;\n\n# gitolite post-update hook (only for the admin repo)\n# ----------------------------------------------------------------------\n\npost_update(); # is not expected to return\nexit 1; # so if it does, something is wrong\n" }, { "path": "src/lib/Gitolite/Hooks/Update.pm", "content": "package Gitolite::Hooks::Update;\n\n# everything to do with the update hook\n# ----------------------------------------------------------------------\n\n@EXPORT = qw(\n update\n update_hook\n);\n\nuse Exporter 'import';\n\nuse Gitolite::Rc;\nuse Gitolite::Common;\nuse Gitolite::Conf::Load;\n\nuse strict;\nuse warnings;\n\n$|++;\n\n# ----------------------------------------------------------------------\n\nsub update {\n # this is the *real* update hook for gitolite\n\n bypass() if $ENV{GL_BYPASS_ACCESS_CHECKS};\n\n my ( $ref, $oldsha, $newsha, $oldtree, $newtree, $aa ) = args(@ARGV);\n\n trace( 2, $ENV{GL_REPO}, $ENV{GL_USER}, $aa, @ARGV );\n\n my $ret = access( $ENV{GL_REPO}, $ENV{GL_USER}, $aa, $ref );\n trigger( 'ACCESS_2', $ENV{GL_REPO}, $ENV{GL_USER}, $aa, $ref, $ret, $oldsha, $newsha );\n _die $ret if $ret =~ /DENIED/;\n\n check_vrefs( $ref, $oldsha, $newsha, $oldtree, $newtree, $aa );\n\n gl_log( 'update', $ENV{GL_REPO}, $ENV{GL_USER}, $aa, @ARGV, $ret );\n exit 0;\n}\n\nsub bypass {\n require Cwd;\n Cwd->import;\n gl_log( 'update', getcwd(), '(' . ( $ENV{USER} || '?' ) . ')', 'bypass', @ARGV );\n exit 0;\n}\n\nsub check_vrefs {\n my ( $ref, $oldsha, $newsha, $oldtree, $newtree, $aa ) = @_;\n my $name_seen = 0;\n my $n_vrefs = 0;\n for my $vref ( vrefs( $ENV{GL_REPO}, $ENV{GL_USER} ) ) {\n $n_vrefs++;\n if ( $vref =~ m(^VREF/NAME/) ) {\n # this one is special; we process it right here, and only once\n next if $name_seen++;\n\n for my $ref ( map { chomp; s(^)(VREF/NAME/); $_; } `git diff --name-only $oldtree $newtree` ) {\n check_vref( $aa, $ref );\n }\n } else {\n my ( $dummy, $pgm, @args ) = split '/', $vref;\n $pgm = _which( \"VREF/$pgm\", 'x' );\n $pgm or _die \"'$vref': helper program missing or unexecutable\";\n\n open( my $fh, \"-|\", $pgm, @_, $vref, @args ) or _die \"'$vref': can't spawn helper program: $!\";\n while (<$fh>) {\n # print non-vref lines and skip processing (for example,\n # normal STDOUT by a normal update hook)\n unless (m(^VREF/)) {\n print;\n next;\n }\n my ( $ref, $deny_message ) = split( ' ', $_, 2 );\n check_vref( $aa, $ref, $deny_message );\n }\n close($fh) or _die $!\n ? \"Error closing sort pipe: $!\"\n : \"$vref: helper program exit status $?\";\n }\n }\n return $n_vrefs;\n}\n\nsub check_vref {\n my ( $aa, $ref, $deny_message ) = @_;\n\n my $ret = access( $ENV{GL_REPO}, $ENV{GL_USER}, $aa, $ref );\n trace( 2, \"access($ENV{GL_REPO}, $ENV{GL_USER}, $aa, $ref)\", \"-> $ret\" );\n if ( $ret =~ /by fallthru/ ) {\n trace( 3, \"remember, fallthru is success here!\" );\n return;\n }\n trigger( 'ACCESS_2', $ENV{GL_REPO}, $ENV{GL_USER}, $aa, $ref, $ret );\n _die \"$ret\" . ( $deny_message ? \"\\n$deny_message\" : '' ) if $ret =~ /DENIED/;\n}\n\n{\n my $text = '';\n\n sub update_hook {\n if ( not $text ) {\n local $/ = undef;\n $text = ;\n }\n return $text;\n }\n}\n\n# ----------------------------------------------------------------------\n\nsub args {\n my ( $ref, $oldsha, $newsha ) = @_;\n my ( $oldtree, $newtree, $aa );\n\n my $sha256 = 0;\n my $zeroes = '0' x 40;\n # this is special to git -- the hash of an empty tree\n my $empty = '4b825dc642cb6eb9a060e54bf8d69288fbee4904';\n if (length($oldsha) == 64) {\n $sha256 = 1;\n $zeroes = '0' x 64;\n $empty = '6ef19b41225c5369f1c104d45d8d85efa9b057b53b14b4b9b939dd74decc5321';\n }\n\n $oldtree = $oldsha eq $zeroes ? $empty : $oldsha;\n $newtree = $newsha eq $zeroes ? $empty : $newsha;\n\n my $merge_base = $zeroes;\n # for branch create or delete, merge_base stays at '0'x40\n chomp( $merge_base = `git merge-base $oldsha $newsha` )\n unless $oldsha eq $zeroes\n or $newsha eq $zeroes;\n\n $aa = 'W';\n # tag rewrite\n $aa = '+' if $ref =~ m(refs/tags/) and $oldsha ne ( $zeroes );\n # non-ff push to ref (including ref delete)\n $aa = '+' if $oldsha ne $merge_base;\n\n $aa = 'D' if ( option( $ENV{GL_REPO}, 'DELETE_IS_D' ) ) and $newsha eq $zeroes;\n $aa = 'C' if ( option( $ENV{GL_REPO}, 'CREATE_IS_C' ) ) and $oldsha eq $zeroes;\n\n # and now \"M\" commits. All the other accesses (W, +, C, D) were mutually\n # exclusive in some sense. Sure a W could be a C or a + could be a D but\n # that's by design. A merge commit, however, could still be any of the\n # others (except a \"D\").\n\n # so we have to *append* 'M' to $aa (if the repo has MERGE_CHECK in\n # effect and this push contains a merge inside)\n\n if ( option( $ENV{GL_REPO}, 'MERGE_CHECK' ) ) {\n if ( $oldsha eq $zeroes or $newsha eq $zeroes ) {\n _warn \"ref create/delete ignored for purposes of merge-check\\n\";\n } else {\n $aa .= 'M' if `git rev-list -n 1 --merges $oldsha..$newsha` =~ /./;\n }\n }\n\n return ( $ref, $oldsha, $newsha, $oldtree, $newtree, $aa );\n}\n\n1;\n\n__DATA__\n#!/usr/bin/perl\n\nuse strict;\nuse warnings;\n\nuse lib $ENV{GL_LIBDIR};\nuse Gitolite::Hooks::Update;\n\n# gitolite update hook\n# ----------------------------------------------------------------------\n\nupdate(); # is not expected to return\nexit 1; # so if it does, something is wrong\n" }, { "path": "src/lib/Gitolite/Rc.pm", "content": "package Gitolite::Rc;\n\n# everything to do with 'rc'. Also defines some 'constants'\n# ----------------------------------------------------------------------\n\n@EXPORT = qw(\n %rc\n glrc\n query_rc\n version\n greeting\n trigger\n _which\n\n $REMOTE_COMMAND_PATT\n $REF_OR_FILENAME_PATT\n $REPONAME_PATT\n $REPOPATT_PATT\n $USERNAME_PATT\n $UNSAFE_PATT\n);\n\nuse Exporter 'import';\n\nuse Gitolite::Common;\n\n# ----------------------------------------------------------------------\n\nour %rc;\nour $non_core;\n\n# ----------------------------------------------------------------------\n\n# pre-populate some important rc keys\n# ----------------------------------------------------------------------\n\n$rc{GL_BINDIR} = $ENV{GL_BINDIR};\n$rc{GL_LIBDIR} = $ENV{GL_LIBDIR};\n\n# these keys could be overridden by the rc file later\n$rc{GL_REPO_BASE} = \"$ENV{HOME}/repositories\";\n$rc{GL_ADMIN_BASE} = \"$ENV{HOME}/.gitolite\";\n$rc{LOG_TEMPLATE} = \"$ENV{HOME}/.gitolite/logs/gitolite-%y-%m.log\";\n\n# variables that should probably never be changed but someone will want to, I'll bet...\n# ----------------------------------------------------------------------\n\n#<<<\n$REMOTE_COMMAND_PATT = qr(^[-0-9a-zA-Z._\\@/+ :,\\%=]*$);\n$REF_OR_FILENAME_PATT = qr(^[0-9a-zA-Z][-0-9a-zA-Z._\\@/+ :,]*$);\n$REPONAME_PATT = qr(^\\@?[0-9a-zA-Z][-0-9a-zA-Z._\\@/+]*$);\n$REPOPATT_PATT = qr(^\\@?[[0-9a-zA-Z][-0-9a-zA-Z._\\@/+\\\\^$|()[\\]*?{},]*$);\n$USERNAME_PATT = qr(^\\@?[0-9a-zA-Z][-0-9a-zA-Z._\\@+]*$);\n\n$UNSAFE_PATT = qr([`~#\\$\\&()|;<>]);\n#>>>\n\n# ----------------------------------------------------------------------\n\n# find the rc file and 'do' it\n# ----------------------------------------------------------------------\nmy $current_data_version = \"3.2\";\n\nmy $rc = glrc('filename');\nif ( -r $rc and -s $rc ) {\n do $rc or die $@;\n}\nif ( defined($GL_ADMINDIR) ) {\n say2 \"\";\n say2 \"FATAL: '$rc' seems to be for older gitolite; please see\\nhttp://gitolite.com/gitolite/migr.html\";\n\n exit 1;\n}\n\n# let values specified in rc file override our internal ones\n# ----------------------------------------------------------------------\n@rc{ keys %RC } = values %RC;\n\n# expand the non_core list into INPUT, PRE_GIT, etc using 'ENABLE' settings\nnon_core_expand() if $rc{ENABLE};\n\n# add internal triggers\n# ----------------------------------------------------------------------\n\n# is the server/repo in a writable state (i.e., not down for maintenance etc)\nunshift @{ $rc{ACCESS_1} }, 'Writable::access_1';\n\n# (testing only) override the rc file silently\n# ----------------------------------------------------------------------\n# use an env var that is highly unlikely to appear in real life :)\ndo $ENV{G3T_RC} if exists $ENV{G3T_RC} and -r $ENV{G3T_RC};\n\n# setup some perl/rc/env vars, plus umask\n# ----------------------------------------------------------------------\n\numask ( $rc{UMASK} || 0077 );\n\nunshift @INC, \"$rc{LOCAL_CODE}/lib\" if $rc{LOCAL_CODE};\n\n$ENV{PATH} = \"$ENV{GL_BINDIR}:$ENV{PATH}\" unless $ENV{PATH} =~ /^$ENV{GL_BINDIR}:/;\n\n{\n $rc{GL_TID} = $ENV{GL_TID} ||= $$;\n # TID: loosely, transaction ID. The first PID at the entry point passes\n # it down to all its children so you can track each access, across all the\n # various commands it spawns and actions it generates.\n\n $rc{GL_LOGFILE} = $ENV{GL_LOGFILE} ||= gen_lfn( $rc{LOG_TEMPLATE} );\n}\n\n# these two are meant to help externally written commands (see\n# src/commands/writable for an example)\n$ENV{GL_REPO_BASE} = $rc{GL_REPO_BASE};\n$ENV{GL_ADMIN_BASE} = $rc{GL_ADMIN_BASE};\n\n# ----------------------------------------------------------------------\n\nuse strict;\nuse warnings;\n\n# ----------------------------------------------------------------------\n\nmy $glrc_default_text = '';\n{\n local $/ = undef;\n $glrc_default_text = ;\n}\n\n# ----------------------------------------------------------------------\n\nsub non_core_expand {\n my %enable;\n\n for my $e ( @{ $rc{ENABLE} } ) {\n my ( $name, $arg ) = split ' ', $e, 2;\n # store args as the hash value for the name\n $enable{$name} = $arg || '';\n\n # for now, we pretend everything is a command, because commands\n # are the only thing that the non_core list does not contain\n $rc{COMMANDS}{$name} = $arg || 1;\n }\n\n # bring in additional non-core specs from the rc file, if given\n if ( my $nc2 = $rc{NON_CORE} ) {\n for ( $non_core, $nc2 ) {\n # beat 'em into shape :)\n s/#.*//g;\n s/[ \\t]+/ /g; s/^ //mg; s/ $//mg;\n s/\\n+/\\n/g;\n }\n\n for ( split \"\\n\", $nc2 ) {\n next unless /\\S/;\n my ( $name, $where, $module, $before, $name2 ) = split ' ', $_;\n if ( not $before ) {\n $non_core .= \"$name $where $module\\n\";\n next;\n }\n die if $before ne 'before';\n $non_core =~ s(^(?=$name2 $where( |$)))($name $where $module\\n)m;\n }\n }\n\n my @data = split \"\\n\", $non_core || '';\n for (@data) {\n next if /^\\s*(#|$)/;\n my ( $name, $where, $module ) = split ' ', $_;\n\n # if it appears here, it's not a command, so delete it. At the end of\n # this loop, what's left in $rc{COMMANDS} will be those names in the\n # enable list that do not appear in the non_core list.\n delete $rc{COMMANDS}{$name};\n\n next unless exists $enable{$name};\n\n # module to call is name if specified as \".\"\n $module = $name if $module eq \".\";\n\n # module to call is \"name::pre_git\" or such if specified as \"::\"\n ( $module = $name ) .= \"::\" . lc($where) if $module eq '::';\n\n # append arguments, if supplied\n $module .= \" $enable{$name}\" if $enable{$name};\n\n push @{ $rc{$where} }, $module;\n }\n\n # finally, add in commands that were declared in the non-core list\n map { /^(\\S+)/; $rc{COMMANDS}{$1} = 1 } @{ $rc{COMMAND} };\n}\n\n# exported functions\n# ----------------------------------------------------------------------\n\nsub glrc {\n my $cmd = shift;\n if ( $cmd eq 'default-filename' ) {\n return \"$ENV{HOME}/.gitolite.rc\";\n } elsif ( $cmd eq 'default-text' ) {\n return $glrc_default_text if $glrc_default_text;\n _die \"rc file default text not set; this should not happen!\";\n } elsif ( $cmd eq 'filename' ) {\n # where is the rc file?\n\n # search $HOME first\n return \"$ENV{HOME}/.gitolite.rc\" if -f \"$ENV{HOME}/.gitolite.rc\";\n\n return '';\n } elsif ( $cmd eq 'current-data-version' ) {\n return $current_data_version;\n } else {\n _die \"unknown argument to glrc: '$cmd'\";\n }\n}\n\nmy $all = 0;\nmy $dump = 0;\nmy $nonl = 0;\nmy $quiet = 0;\n\nsub query_rc {\n\n my @vars = args();\n\n no strict 'refs';\n\n if ($all) {\n for my $e ( sort keys %rc ) {\n print \"$e=\" . ( defined( $rc{$e} ) ? $rc{$e} : 'undef' ) . \"\\n\";\n }\n exit 0;\n }\n\n if ($dump) {\n require Data::Dumper;\n $Data::Dumper::Sortkeys = 1;\n print Data::Dumper::Dumper \\%rc;\n exit 0;\n }\n\n my $cv = \\%rc; # current \"value\"\n while (@vars) {\n my $v = shift @vars;\n\n # dig into the rc hash, using each var as a component\n if ( not ref($cv) ) {\n _warn \"unused arguments...\";\n last;\n } elsif ( ref($cv) eq 'HASH' ) {\n $cv = $cv->{$v} || '';\n } elsif ( ref($cv) eq 'ARRAY' ) {\n $cv = $cv->[$v] || '';\n } else {\n _die \"dont know what to do with \" . ref($cv) . \" item in the rc file\";\n }\n }\n\n # we've run out of arguments so $cv is what we have. If we're supposed to\n # be quiet, we don't have to print anything so let's get that done first:\n exit( $cv ? 0 : 1 ) if $quiet; # shell truth\n\n # print values (notice we ignore the '-n' option if it's a ref)\n if ( ref($cv) eq 'HASH' ) {\n print join( \"\\n\", sort keys %$cv ), \"\\n\" if %$cv;\n } elsif ( ref($cv) eq 'ARRAY' ) {\n print join( \"\\n\", @$cv ), \"\\n\" if @$cv;\n } else {\n print $cv . ( $nonl ? '' : \"\\n\" ) if $cv;\n }\n exit( $cv ? 0 : 1 ); # shell truth\n}\n\nsub version {\n my $version = '';\n $version = '(unknown)';\n for (\"$ENV{GL_BINDIR}/VERSION\") {\n $version = slurp($_) if -r $_;\n }\n chomp($version);\n return $version;\n}\n\nsub greeting {\n my $json = shift;\n\n chomp( my $hn = `hostname -s 2>/dev/null || hostname` );\n my $gv = substr( `git --version`, 12 );\n my $gl_user = $ENV{GL_USER} || '';\n $gl_user = \" $gl_user\" if $gl_user;\n\n if ($json) {\n $json->{GL_USER} = $ENV{GL_USER};\n $json->{USER} = ( $ENV{USER} || \"httpd\" ) . \"\\@$hn\";\n $json->{gitolite_version} = version();\n chomp( $json->{git_version} = $gv ); # this thing has a newline at the end\n return;\n }\n\n # normal output\n return \"hello$gl_user, this is \" . ( $ENV{USER} || \"httpd\" ) . \"\\@$hn running gitolite3 \" . version() . \" on git $gv\\n\";\n}\n\nsub trigger {\n my $rc_section = shift;\n\n # if arg-2 (now arg-1, due to the 'shift' above) exists, it is a repo\n # name, so setup env from options\n require Gitolite::Conf::Load;\n Gitolite::Conf::Load->import('env_options');\n env_options( $_[0] ) if $_[0];\n\n if ( exists $rc{$rc_section} ) {\n if ( ref( $rc{$rc_section} ) ne 'ARRAY' ) {\n _die \"'$rc_section' section in rc file is not a perl list\";\n } else {\n for my $s ( @{ $rc{$rc_section} } ) {\n my ( $pgm, @args ) = split ' ', $s;\n\n if ( my ( $module, $sub ) = ( $pgm =~ /^(.*)::(\\w+)$/ ) ) {\n\n require Gitolite::Triggers;\n trace( 2, 'trigger module', $module, $sub, @args, $rc_section, @_ );\n Gitolite::Triggers::run( $module, $sub, @args, $rc_section, @_ );\n\n } else {\n $pgm = _which( \"triggers/$pgm\", 'x' );\n\n _warn(\"skipped trigger '$s' (not found or not executable)\"), next if not $pgm;\n trace( 2, 'trigger command', $s );\n _system( $pgm, @args, $rc_section, @_ ); # they better all return with 0 exit codes!\n }\n }\n }\n return;\n }\n trace( 3, \"'$rc_section' not found in rc\" );\n}\n\nsub _which {\n # looks for a file in LOCAL_CODE or GL_BINDIR. Returns whichever exists\n # (LOCAL_CODE preferred if defined) or 0 if not found.\n my $file = shift;\n my $mode = shift; # could be 'x' or 'r'\n\n my @files = (\"$rc{GL_BINDIR}/$file\");\n unshift @files, (\"$rc{LOCAL_CODE}/$file\") if $rc{LOCAL_CODE};\n\n for my $f (@files) {\n return $f if -x $f;\n return $f if -r $f and $mode eq 'r';\n }\n\n return 0;\n}\n\n# ----------------------------------------------------------------------\n\n=for args\nUsage: gitolite query-rc -a\n gitolite query-rc -d\n gitolite query-rc [-n] [-q] rc-variable\n\n -a print all variables and values (first level only)\n -d dump the entire rc structure\n -n do not append a newline if variable is scalar\n -q exit code only (shell truth; 0 is success)\n\nQuery the rc hash. Second and subsequent arguments dig deeper into the hash.\nThe examples are for the default configuration; yours may be different.\n\nSingle values:\n gitolite query-rc GL_ADMIN_BASE # prints \"/home/git/.gitolite\" or similar\n gitolite query-rc UMASK # prints \"63\" (that's 0077 in decimal!)\n\nHashes:\n gitolite query-rc COMMANDS\n # prints \"desc\", \"help\", \"info\", \"perms\", \"writable\", one per line\n gitolite query-rc COMMANDS help # prints 1\n gitolite query-rc -q COMMANDS help # prints nothing; exit code is 0\n gitolite query-rc COMMANDS fork # prints nothing; exit code is 1\n\nArrays (somewhat less useful):\n gitolite query-rc POST_GIT # prints nothing; exit code is 0\n gitolite query-rc POST_COMPILE # prints 4 lines\n gitolite query-rc POST_COMPILE 0 # prints the first of those 4 lines\n\nExplore:\n gitolite query-rc -a\n # prints all first level variables and values, one per line. Any that are\n # listed as HASH or ARRAY can be explored further in subsequent commands.\n gitolite query-rc -d # dump the entire rc structure\n=cut\n\nsub args {\n my $help = 0;\n\n require Getopt::Long;\n Getopt::Long::GetOptions(\n 'all|a' => \\$all,\n 'dump|d' => \\$dump,\n 'nonl|n' => \\$nonl,\n 'quiet|q' => \\$quiet,\n 'help|h' => \\$help,\n ) or usage();\n\n _die(\"'-a' cannot be combined with other arguments or options; run with '-h' for usage\") if $all and ( @ARGV or $dump or $nonl or $quiet );\n usage() if not $all and not $dump and not @ARGV or $help;\n return @ARGV;\n}\n\n# ----------------------------------------------------------------------\n\nBEGIN {\n $non_core = \"\n # No user-servicable parts inside. Warranty void if seal broken. Refer\n # servicing to authorised service center only.\n\n continuation-lines SYNTACTIC_SUGAR .\n keysubdirs-as-groups SYNTACTIC_SUGAR .\n macros SYNTACTIC_SUGAR .\n refex-expr SYNTACTIC_SUGAR .\n\n renice PRE_GIT .\n\n Kindergarten INPUT ::\n\n CpuTime INPUT ::\n CpuTime POST_GIT ::\n\n Shell INPUT ::\n\n Alias INPUT ::\n\n Motd INPUT ::\n Motd PRE_GIT ::\n Motd COMMAND motd\n\n Mirroring INPUT ::\n Mirroring PRE_GIT ::\n Mirroring POST_GIT ::\n\n refex-expr ACCESS_2 RefexExpr::access_2\n\n expand-deny-messages ACCESS_1 .\n expand-deny-messages ACCESS_2 .\n\n RepoUmask PRE_GIT ::\n RepoUmask POST_CREATE ::\n\n partial-copy PRE_GIT .\n\n upstream PRE_GIT .\n\n no-create-on-read PRE_CREATE AutoCreate::deny_R\n no-auto-create PRE_CREATE AutoCreate::deny_RW\n\n ssh-authkeys-split POST_COMPILE post-compile/ssh-authkeys-split\n ssh-authkeys POST_COMPILE post-compile/ssh-authkeys\n Shell POST_COMPILE post-compile/ssh-authkeys-shell-users\n\n set-default-roles POST_CREATE .\n\n git-config POST_COMPILE post-compile/update-git-configs\n git-config POST_CREATE post-compile/update-git-configs\n\n create-with-reference POST_CREATE post-compile/create-with-reference\n\n gitweb POST_CREATE post-compile/update-gitweb-access-list\n gitweb POST_COMPILE post-compile/update-gitweb-access-list\n\n cgit POST_COMPILE post-compile/update-description-file\n\n daemon POST_CREATE post-compile/update-git-daemon-access-list\n daemon POST_COMPILE post-compile/update-git-daemon-access-list\n\n repo-specific-hooks POST_COMPILE .\n repo-specific-hooks POST_CREATE .\n\";\n}\n\n1;\n\n# ----------------------------------------------------------------------\n\n__DATA__\n# configuration variables for gitolite\n\n# This file is in perl syntax. But you do NOT need to know perl to edit it --\n# just mind the commas, use single quotes unless you know what you're doing,\n# and make sure the brackets and braces stay matched up!\n\n# (Tip: perl allows a comma after the last item in a list also!)\n\n# HELP for commands can be had by running the command with \"-h\".\n\n# HELP for all the other FEATURES can be found in the documentation (look for\n# \"list of non-core programs shipped with gitolite\" in the master index) or\n# directly in the corresponding source file.\n\n%RC = (\n\n # ------------------------------------------------------------------\n\n # default umask gives you perms of '0700'; see the rc file docs for\n # how/why you might change this\n UMASK => 0077,\n\n # look for \"git-config\" in the documentation\n GIT_CONFIG_KEYS => '',\n\n # comment out if you don't need all the extra detail in the logfile\n LOG_EXTRA => 1,\n # logging options\n # 1. leave this section as is for 'normal' gitolite logging (default)\n # 2. uncomment this line to log ONLY to syslog:\n # LOG_DEST => 'syslog',\n # 3. uncomment this line to log to syslog and the normal gitolite log:\n # LOG_DEST => 'syslog,normal',\n # 4. prefixing \"repo-log,\" to any of the above will **also** log just the\n # update records to \"gl-log\" in the bare repo directory:\n # LOG_DEST => 'repo-log,normal',\n # LOG_DEST => 'repo-log,syslog',\n # LOG_DEST => 'repo-log,syslog,normal',\n # syslog 'facility': defaults to 'local0', uncomment if needed. For example:\n # LOG_FACILITY => 'local4',\n\n # roles. add more roles (like MANAGER, TESTER, ...) here.\n # WARNING: if you make changes to this hash, you MUST run 'gitolite\n # compile' afterward, and possibly also 'gitolite trigger POST_COMPILE'\n ROLES => {\n READERS => 1,\n WRITERS => 1,\n },\n\n # enable caching (currently only Redis). PLEASE RTFM BEFORE USING!!!\n # CACHE => 'Redis',\n\n # ------------------------------------------------------------------\n\n # rc variables used by various features\n\n # the 'info' command prints this as additional info, if it is set\n # SITE_INFO => 'Please see http://blahblah/gitolite for more help',\n\n # the CpuTime feature uses these\n # display user, system, and elapsed times to user after each git operation\n # DISPLAY_CPU_TIME => 1,\n # display a warning if total CPU times (u, s, cu, cs) crosses this limit\n # CPU_TIME_WARN_LIMIT => 0.1,\n\n # the Mirroring feature needs this\n # HOSTNAME => \"foo\",\n\n # TTL for redis cache; PLEASE SEE DOCUMENTATION BEFORE UNCOMMENTING!\n # CACHE_TTL => 600,\n\n # ------------------------------------------------------------------\n\n # suggested locations for site-local gitolite code (see cust.html)\n\n # this one is managed directly on the server\n # LOCAL_CODE => \"$ENV{HOME}/local\",\n\n # or you can use this, which lets you put everything in a subdirectory\n # called \"local\" in your gitolite-admin repo. For a SECURITY WARNING\n # on this, see http://gitolite.com/gitolite/non-core.html#using-the-gitolite-admin-repo-to-manage-non-core-code\n # LOCAL_CODE => \"$rc{GL_ADMIN_BASE}/local\",\n\n # ------------------------------------------------------------------\n\n # List of commands and features to enable\n\n ENABLE => [\n\n # COMMANDS\n\n # These are the commands enabled by default\n 'help',\n 'desc',\n 'info',\n 'perms',\n 'writable',\n\n # Uncomment or add new commands here.\n # 'create',\n # 'fork',\n # 'mirror',\n # 'readme',\n # 'sskm',\n # 'D',\n\n # These FEATURES are enabled by default.\n\n # essential (unless you're using smart-http mode)\n 'ssh-authkeys',\n\n # creates git-config entries from gitolite.conf file entries like 'config foo.bar = baz'\n 'git-config',\n\n # creates git-daemon-export-ok files; if you don't use git-daemon, comment this out\n 'daemon',\n\n # creates projects.list file; if you don't use gitweb, comment this out\n 'gitweb',\n\n # These FEATURES are disabled by default; uncomment to enable. If you\n # need to add new ones, ask on the mailing list :-)\n\n # user-visible behaviour\n\n # prevent wild repos auto-create on fetch/clone\n # 'no-create-on-read',\n # no auto-create at all (don't forget to enable the 'create' command!)\n # 'no-auto-create',\n\n # access a repo by another (possibly legacy) name\n # 'Alias',\n\n # give some users direct shell access. See documentation in\n # sts.html for details on the following two choices.\n # \"Shell $ENV{HOME}/.gitolite.shell-users\",\n # 'Shell alice bob',\n\n # set default roles from lines like 'option default.roles-1 = ...', etc.\n # 'set-default-roles',\n\n # show more detailed messages on deny\n # 'expand-deny-messages',\n\n # show a message of the day\n # 'Motd',\n\n # system admin stuff\n\n # enable mirroring (don't forget to set the HOSTNAME too!)\n # 'Mirroring',\n\n # allow people to submit pub files with more than one key in them\n # 'ssh-authkeys-split',\n\n # selective read control hack\n # 'partial-copy',\n\n # manage local, gitolite-controlled, copies of read-only upstream repos\n # 'upstream',\n\n # updates 'description' file instead of 'gitweb.description' config item\n # 'cgit',\n\n # allow repo-specific hooks to be added\n # 'repo-specific-hooks',\n\n # performance, logging, monitoring...\n\n # be nice\n # 'renice 10',\n\n # log CPU times (user, system, cumulative user, cumulative system)\n # 'CpuTime',\n\n # syntactic_sugar for gitolite.conf and included files\n\n # allow backslash-escaped continuation lines in gitolite.conf\n # 'continuation-lines',\n\n # create implicit user groups from directory names in keydir/\n # 'keysubdirs-as-groups',\n\n # allow simple line-oriented macros\n # 'macros',\n\n # Kindergarten mode\n\n # disallow various things that sensible people shouldn't be doing anyway\n # 'Kindergarten',\n ],\n\n);\n\n# ------------------------------------------------------------------------------\n# per perl rules, this should be the last line in such a file:\n1;\n\n# Local variables:\n# mode: perl\n# End:\n# vim: set syn=perl:\n" }, { "path": "src/lib/Gitolite/Setup.pm", "content": "package Gitolite::Setup;\n\n# implements 'gitolite setup'\n# ----------------------------------------------------------------------\n\n=for args\nUsage: gitolite setup [