{"thread":{"id":"15939","subject":"Howto setup-git-server-over-http.txt with SSL and basic authentication?","startedAt":"2008-10-17T16:06:04Z","lastAt":"2008-10-17T16:06:04Z","messageCount":1,"participants":["Josef Wolf"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"93304","messageId":"20081017160603.GD9707@raven.wolf.lan","threadId":"15939","inReplyTo":null,"subject":"Howto setup-git-server-over-http.txt with SSL and basic authentication?","fromName":"Josef Wolf","fromEmail":"jw@raven.inka.de","sentAt":"2008-10-17T16:06:04Z","receivedAt":"2008-10-17T16:06:04Z","isPatch":false,"sender":{"key":"jw@raven.inka.de","avatar":null},"body":"Hello folks,\n\nI am new to git and I am trying to set up a git repository as described in\n\n  http://www.kernel.org/pub/software/scm/git/docs/howto/setup-git-server-over-http.txt\n\nbut with SSL and basic authentication.\n\nThis is what I have done:\n\n1. Create bare git repository on the server:\n\n     root: mkdir -p /data/git/test\n     root: ( cd /data/git/test ; git --bare init )\n     root: chown -R wwwrun:www /data/git\n\n2. Add a new DAV location to the (existing and already working) apache\n   config, pointing to the newly created git repository.  I list only\n   the relevant parts here:\n\n     LoadModule dav_svn_module /usr/lib/apache2/mod_dav_svn.so\n     LoadModule dav_fs_module /usr/lib/apache2/mod_dav_fs.so\n     DAVLockDB \"/data/dav/lock/DAV.lock\"\n\n     Alias /git/test /data/git/test\n     <Location /git/test>\n       DAV on\n       Order           Allow,Deny\n       Allow           from all\n       AllowOverride   None\n       AuthName        \"test\"\n       AuthType        Basic\n       AuthUserFile    /m/b/httpd/passwd\n       AuthGroupFile   /m/b/httpd/group\n       Require         group test test-ro\n       SSLRequireSSL\n       <LimitExcept GET PROPFIND OPTIONS REPORT>\n         Require group test\n       </LimitExcept>\n     </Location>\n\n3. Now it's time to test DAV access, so I go to the client:\n\n     konqueror webdavs://repo.host.org/git/test\n\n   After asking for credentials, Konqueror shows me content, and I can\n   read/copy/delete files to/from the DAV directory.  So the server\n   seems to work fine.\n   Now I go test curl:\n\n     $ curl --cacert /etc/cacerts/myca.pem \\\n            https://user@repo.host.org/git/test/HEAD\n\n   fails with \"authentication required\", but\n\n     $ curl --cacert /etc/cacerts/myca.pem --user user \\\n            https://user@repo.host.org/git/test/HEAD\n\n   works fine.  So I put this information into ~/.curlrc:\n\n     $ cat ~/.curlrc\n     --cacert /etc/cacerts/myca.pem\n     --user   user\n     $ curl https://repo.host.org/git/test/HEAD\n     Enter host password for user 'user':\n     ref: refs/heads/master\n     $\n\n   this looks good now.\n\n4. OK, now I go to the next step on the client:\n\n     $ git-config remote.upload.url https://repo.host.org/git/test/\n     error: could not lock config file .git/config\n     $\n\n   hmm, maybe I should have an empty repos here?  So:\n\n     $ git init\n     Initialized empty Git repository in /tmp/test/.git/\n     $ git-config remote.upload.url https://repo.host.org/git/test/\n     $ git push upload master\n     error: Cannot access URL https://repo.host.org/git/test/, return code 60\n     error: failed to push some refs to 'https://repo.host.org/git/test/'\n\n   OK, from the above mentioned howto, this looks like cacert is missing.\n   Looks like (unlike the howto states) ~/.curlrc is ignored by git.\n   So I go searching for appropriate configuration options in git:\n\n     $ git-config http.sslCAPath /etc/cacerts\n\n   don't help (why?), but \n\n     $ git-config http.sslCAInfo /etc/cacerts/myca.pem\n     $ git push upload master\n     error: Cannot access URL https://repo.host.org/git/test/, return code 22\n     error: failed to push some refs to 'https://repo.host.org/git/test/'\n\n   Finally, that's a new error code.  This is probably because the server\n   requires authentication.  But I can't find any hints how to specify\n   credentials in git-config or git-push.\n\nSo now come my questions:\n\n0. The howto says curl is used for transport. Why is my ~/.curlrc ignored?\n1. Since .curlrc is ignored: How do I specify credentials for git?\n2. Why don't sslCAPath work?\n3. Is there a way to override credentials and sslCAPath on a per-remote\n   basis (as can be done with http.proxy, for example)\n\nAny hints?\n"}]}