{"thread":{"id":"12551","subject":"Re: Switching to Git","startedAt":"2008-03-06T22:08:23Z","lastAt":"2008-03-07T12:39:24Z","messageCount":3,"participants":["Sam Vilain","Ævar Arnfjörð Bjarmason"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"71284","messageId":"47D06B57.4090607@vilain.net","threadId":"12551","inReplyTo":"51dd1af80803061300y1a2abcf2n9b9d3184e4ed42b2@mail.gmail.com","subject":"Re: Switching to Git","fromName":"Sam Vilain","fromEmail":"sam@vilain.net","sentAt":"2008-03-06T22:08:23Z","receivedAt":"2008-03-06T22:08:23Z","isPatch":false,"sender":{"key":"sam@vilain.net","avatar":"https://gravatar.com/avatar/8fc840ca854dbf6f7065b4335e3b934951c1dca3b11db688e95e471901f8f4a8?d=mp&s=160"},"body":"Ævar Arnfjörð Bjarmason wrote:\n> Yes see [1] it works but the list members wanted some tool to manage\n> passwords too which I didn't pursue since it worked for me in its\n> present form.\n> \n> 1. http://lists-archives.org/git/640574-authentication-support-for-pserver.html\n\nCool, well done.  Having re-read that thread, I think Martin Langhoff's\nresponse\nhttp://lists-archives.org/git/641074-authentication-support-for-pserver.html\nis the most pertinent.  I didn't see any requests for an actual tool to\nbe written, just that the password file be separate to the git config\nfile, and/or use crypt() to store its contents.  Perhaps point them at\n\"htpasswd\" if they want a tool :)\n\nThis patch is untested and sits on top of the previous patch by Ævar.\nPullable from git://git.catalyst.net.nz/git.git#cvsserver-auth\n\nSubject: [PATCH] git-cvsserver: use a password file cvsserver pserver\n\nIf a git repository is shared via HTTP, the config file is typically\nvisible.  Use an external file instead.\n---\n Documentation/git-cvsserver.txt |   21 ++++++++++++++++-----\n git-cvsserver.perl              |   27 ++++++++++++++-------------\n 2 files changed, 30 insertions(+), 18 deletions(-)\n\ndiff --git a/Documentation/git-cvsserver.txt b/Documentation/git-cvsserver.txt\nindex 98183d4..c642f12 100644\n--- a/Documentation/git-cvsserver.txt\n+++ b/Documentation/git-cvsserver.txt\n@@ -97,16 +97,27 @@ looks like\n ------\n \n Only anonymous access is provided by pserve by default. To commit you\n-will have to create pserver accounts, simply add a [gitcvs.users]\n-section to the repositories you want to access, for example:\n+will have to create pserver accounts, simply add a gitcvs.authdb\n+setting in the config file of the repositories you want the cvsserver\n+to allow writes to, for example:\n \n ------\n    \n-   [gitcvs.users]\n-        someuser = somepassword\n-        otheruser = otherpassword\n+   [gitcvs]\n+        authdb = /etc/cvsserver/passwd\n    \n ------\n+The format of these files is username followed by the crypted password,\n+for example:\n+\n+------\n+   myuser:$1Oyx5r9mdGZ2\n+   myuser:$1$BA)@$vbnMJMDym7tA32AamXrm./\n+------\n+You can use the 'htpasswd' facility that comes with Apache to make these\n+files, but Apache's MD5 crypt method differs from the one used by most C\n+library's crypt() function, so don't use the -m option.\n+\n Then provide your password via the pserver method, for example:\n ------\n    cvs -d:pserver:someuser:somepassword <at> server/path/repo.git co <HEAD_name>\ndiff --git a/git-cvsserver.perl b/git-cvsserver.perl\nindex 9bc2ff5..e54cbcd 100755\n--- a/git-cvsserver.perl\n+++ b/git-cvsserver.perl\n@@ -156,24 +156,25 @@ if ($state->{method} eq 'pserver') {\n \n     unless ($user eq 'anonymous') {\n         # Trying to authenticate a user\n-        if (not exists $cfg->{gitcvs}->{users}) {\n-            print \"E the repo config file needs a [gitcvs.users] section with user/password key-value pairs\\n\";\n+        if (not exists $cfg->{gitcvs}->{authdb}) {\n+            print \"E the repo config file needs a [gitcvs.authdb] section with a filename\\n\";\n             print \"I HATE YOU\\n\";\n             exit 1;\n-        } elsif (exists $cfg->{gitcvs}->{users} and not exists $cfg->{gitcvs}->{users}->{$user}) {\n-            #print \"E the repo config file has a [gitcvs.users] section but the user $user is not defined in it\\n\";\n+        }\n+\tmy $auth_ok;\n+\topen PASSWD, \"<$cfg->{gitcvs}->{authdb}\" or die $!;\n+\twhile(<PASSWD>) {\n+\t    if (m{^\\Q$user\\E:(.*)}) {\n+\t\tif (crypt($user, $1) eq $1) {\n+\t\t    $auth_ok = 1;\n+\t\t}\n+\t    };\n+\t}\n+\tunless ($auth_ok) {\n             print \"I HATE YOU\\n\";\n             exit 1;\n-        } else {\n-            my $descrambled_password = descramble($password);\n-            my $cleartext_password = $cfg->{gitcvs}->{users}->{$user};\n-            if ($descrambled_password ne $cleartext_password) {\n-                #print \"E The password supplied for user $user was incorrect\\n\";\n-                print \"I HATE YOU\\n\";\n-                exit 1;\n-            }\n-            # else fall through to LOVE\n         }\n+        # else fall through to LOVE\n     }\n \n     # For checking whether the user is anonymous on commit\n-- \n1.5.3.5\n\n"},{"id":"71295","messageId":"51dd1af80803061645w5261163dlf4171b8c95e0792a@mail.gmail.com","threadId":"12551","inReplyTo":"47D06B57.4090607@vilain.net","subject":"Re: Switching to Git","fromName":"Ævar Arnfjörð Bjarmason","fromEmail":"avarab@gmail.com","sentAt":"2008-03-07T00:45:05Z","receivedAt":"2008-03-07T00:45:05Z","isPatch":false,"sender":{"key":"avarab@gmail.com","avatar":"https://avatars.githubusercontent.com/u/45301?v=4"},"body":"On 3/6/08, Sam Vilain <sam@vilain.net> wrote:\n> Ævar Arnfjörð Bjarmason wrote:\n> > Yes see [1] it works but the list members wanted some tool to manage\n> > passwords too which I didn't pursue since it worked for me in its\n> > present form.\n> >\n> > 1.\n> http://lists-archives.org/git/640574-authentication-support-for-pserver.html\n>\n> Cool, well done. Having re-read that thread, I think Martin Langhoff's\n> response\n> http://lists-archives.org/git/641074-authentication-support-for-pserver.html\n> is the most pertinent. I didn't see any requests for an actual tool to\n> be written, just that the password file be separate to the git config\n> file, and/or use crypt() to store its contents. Perhaps point them at\n> \"htpasswd\" if they want a tool :)\n\nI was refering to http://www.spinics.net/lists/git/msg53054.html\n\nBut yes, your crypt() method should do. I made some cleanups to your\npatch so it works now, you can pull the changes from\ngit://git.nix.is/avar/git if you'd like.\n\nI'm submitting this to the git list again.\n\n</wildly off-topic>\n"},{"id":"71343","messageId":"86mypaso77.fsf@cpan.org","threadId":"12551","inReplyTo":"47D06B57.4090607@vilain.net","subject":"Re: Switching to Git","fromName":"Ævar Arnfjörð Bjarmason","fromEmail":"avar@cpan.org","sentAt":"2008-03-07T12:39:24Z","receivedAt":"2008-03-07T12:39:24Z","isPatch":false,"sender":{"key":"avar@cpan.org","avatar":"https://gravatar.com/avatar/26a9abd89a6d76e77bbb1d1b6a5fc4714a6060dbf7862544cec4540305c9d9da?d=mp&s=160"},"body":"Sam Vilain <sam@vilain.net> writes:\n\n> Ævar Arnfjörð Bjarmason wrote:\n>> Yes see [1] it works but the list members wanted some tool to manage\n>> passwords too which I didn't pursue since it worked for me in its\n>> present form.\n>> \n>> 1. http://lists-archives.org/git/640574-authentication-support-for-pserver.html\n>\n> Cool, well done.  Having re-read that thread, I think Martin Langhoff's\n> response\n> http://lists-archives.org/git/641074-authentication-support-for-pserver.html\n> is the most pertinent.  I didn't see any requests for an actual tool to\n> be written, just that the password file be separate to the git config\n> file, and/or use crypt() to store its contents.  Perhaps point them at\n> \"htpasswd\" if they want a tool :)\n>\n> This patch is untested and sits on top of the previous patch by Ævar.\n> Pullable from git://git.catalyst.net.nz/git.git#cvsserver-auth\n>\n> Subject: [PATCH] git-cvsserver: use a password file cvsserver pserver\n>\n> If a git repository is shared via HTTP, the config file is typically\n> visible.  Use an external file instead.\n> ---\n>  Documentation/git-cvsserver.txt |   21 ++++++++++++++++-----\n>  git-cvsserver.perl              |   27 ++++++++++++++-------------\n>  2 files changed, 30 insertions(+), 18 deletions(-)\n>\n> diff --git a/Documentation/git-cvsserver.txt b/Documentation/git-cvsserver.txt\n> index 98183d4..c642f12 100644\n> --- a/Documentation/git-cvsserver.txt\n> +++ b/Documentation/git-cvsserver.txt\n> @@ -97,16 +97,27 @@ looks like\n>  ------\n>  \n>  Only anonymous access is provided by pserve by default. To commit you\n> -will have to create pserver accounts, simply add a [gitcvs.users]\n> -section to the repositories you want to access, for example:\n> +will have to create pserver accounts, simply add a gitcvs.authdb\n> +setting in the config file of the repositories you want the cvsserver\n> +to allow writes to, for example:\n>  \n>  ------\n>     \n> -   [gitcvs.users]\n> -        someuser = somepassword\n> -        otheruser = otherpassword\n> +   [gitcvs]\n> +        authdb = /etc/cvsserver/passwd\n>     \n>  ------\n> +The format of these files is username followed by the crypted password,\n> +for example:\n> +\n> +------\n> +   myuser:$1Oyx5r9mdGZ2\n> +   myuser:$1$BA)@$vbnMJMDym7tA32AamXrm./\n> +------\n> +You can use the 'htpasswd' facility that comes with Apache to make these\n> +files, but Apache's MD5 crypt method differs from the one used by most C\n> +library's crypt() function, so don't use the -m option.\n> +\n>  Then provide your password via the pserver method, for example:\n>  ------\n>     cvs -d:pserver:someuser:somepassword <at> server/path/repo.git co <HEAD_name>\n> diff --git a/git-cvsserver.perl b/git-cvsserver.perl\n> index 9bc2ff5..e54cbcd 100755\n> --- a/git-cvsserver.perl\n> +++ b/git-cvsserver.perl\n> @@ -156,24 +156,25 @@ if ($state->{method} eq 'pserver') {\n>  \n>      unless ($user eq 'anonymous') {\n>          # Trying to authenticate a user\n> -        if (not exists $cfg->{gitcvs}->{users}) {\n> -            print \"E the repo config file needs a [gitcvs.users] section with user/password key-value pairs\\n\";\n> +        if (not exists $cfg->{gitcvs}->{authdb}) {\n> +            print \"E the repo config file needs a [gitcvs.authdb] section with a filename\\n\";\n>              print \"I HATE YOU\\n\";\n>              exit 1;\n> -        } elsif (exists $cfg->{gitcvs}->{users} and not exists $cfg->{gitcvs}->{users}->{$user}) {\n> -            #print \"E the repo config file has a [gitcvs.users] section but the user $user is not defined in it\\n\";\n> +        }\n> +\tmy $auth_ok;\n> +\topen PASSWD, \"<$cfg->{gitcvs}->{authdb}\" or die $!;\n> +\twhile(<PASSWD>) {\n> +\t    if (m{^\\Q$user\\E:(.*)}) {\n> +\t\tif (crypt($user, $1) eq $1) {\n> +\t\t    $auth_ok = 1;\n> +\t\t}\n> +\t    };\n> +\t}\n> +\tunless ($auth_ok) {\n>              print \"I HATE YOU\\n\";\n>              exit 1;\n> -        } else {\n> -            my $descrambled_password = descramble($password);\n> -            my $cleartext_password = $cfg->{gitcvs}->{users}->{$user};\n> -            if ($descrambled_password ne $cleartext_password) {\n> -                #print \"E The password supplied for user $user was incorrect\\n\";\n> -                print \"I HATE YOU\\n\";\n> -                exit 1;\n> -            }\n> -            # else fall through to LOVE\n>          }\n> +        # else fall through to LOVE\n>      }\n>  \n>      # For checking whether the user is anonymous on commit\n> -- \n> 1.5.3.5\n\nAh, I didn't notice that this got crossposted, here, anyway I've cleaned\nup this patch a bit and submitted it in reply to the original thread\n[1].\n\n1. http://article.gmane.org/gmane.comp.version-control.git/76446/match=bjarmason\n"}]}