{"thread":{"id":"1598","subject":"\"Publishing your work\" questions?","startedAt":"2005-08-20T13:57:00Z","lastAt":"2005-08-20T17:42:34Z","messageCount":4,"participants":["Alan Chandler","Linus Torvalds","Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"7584","messageId":"200508201457.00725.alan@chandlerfamily.org.uk","threadId":"1598","inReplyTo":null,"subject":"\"Publishing your work\" questions?","fromName":"Alan Chandler","fromEmail":"alan@chandlerfamily.org.uk","sentAt":"2005-08-20T13:57:00Z","receivedAt":"2005-08-20T13:57:00Z","isPatch":false,"sender":{"key":"alan@chandlerfamily.org.uk","avatar":"https://gravatar.com/avatar/1862247e5ea8eac114c842f9dc3a5db6253754e24ef7171757cf97eedce48b8c?d=mp&s=160"},"body":"I am planning my way through switching over to using git (as opposed to \nsubversion - via svnserve) to publish some stuff.\n\nAt the moment I leave a hole in my firewall for port 3690 and svnserve is run \nas a daemon from inetd.  I use svnserve's own user/realm management to limit \nthe repositories I make public.\n\nIf I switch over to git, I assume I run git-daemon from inetd.\n\nBUT\n\na) Is this what the git://my.domain.com/path/to/repository url refers to \n(neither get-pull-script nor git-fetch-script man pages actually say what \nthis form means) ?\n\nb) I can't find any mention in the documentation of what the default port \nshould be. What is it?\n\nc) Is git-daemon multithreaded (ie do I use nowait in inetd.conf)?\n\nd) Is it possible to ensure that external accesses can't access anywhere in my \nfilesystem? \n\ne) If I put my public key in ~git/.ssh/authorized_keys on the server, I can \nact as user git on the server via ssh.  Does git push support this?  \n\nf) If I can do e), then perhaps [need to read the docs a bit harder] I can set \nup my user git on the machine to use git-receive-pack as its login shell.  \nWill this work? - the tutorial talks about needing .bashrc to set up the \n$PATH environment, but are there any other hidden gotchas?\n\n-- \nAlan Chandler\nhttp://www.chandlerfamily.org.uk\n"},{"id":"7585","messageId":"Pine.LNX.4.58.0508200821220.3317@g5.osdl.org","threadId":"1598","inReplyTo":"200508201457.00725.alan@chandlerfamily.org.uk","subject":"Re: \"Publishing your work\" questions?","fromName":"Linus Torvalds","fromEmail":"torvalds@osdl.org","sentAt":"2005-08-20T15:52:25Z","receivedAt":"2005-08-20T15:52:25Z","isPatch":false,"sender":{"key":"torvalds@linux-foundation.org","avatar":"https://avatars.githubusercontent.com/u/1024025?v=4"},"body":"\n\nOn Sat, 20 Aug 2005, Alan Chandler wrote:\n> \n> If I switch over to git, I assume I run git-daemon from inetd.\n\nYes. Use the \"--inetd\" flag, and open port 9418 instead.\n\n> a) Is this what the git://my.domain.com/path/to/repository url refers to \n> (neither get-pull-script nor git-fetch-script man pages actually say what \n> this form means) ?\n\nYes.\n\n> b) I can't find any mention in the documentation of what the default port \n> should be. What is it?\n\nThe default one is 9418, although you can use \"--port=xxx\" to set it to\nsomething else. Obviously, if you put it at some other port, you either\nneed to re-compile the client side with the new port number (it's\nDEFAULT_GIT_PORT in cache.h) or need to use\n\n\tgit://my.domain.com:<port>/path/to/repository\n\n> c) Is git-daemon multithreaded (ie do I use nowait in inetd.conf)?\n\nYup, it's entirely safe to run tons of them concurrently.\n\nYou can also run the git deamon without inetd, and it will do it's own \nserving. That normally limits it to 25 connections at a time.\n\n> d) Is it possible to ensure that external accesses can't access anywhere in my \n> filesystem? \n\nYes. The first thing the git-deamon will do is to chdir to the argument \n(and add \".git\" to the end if it can't find the exact path), and then look \nup a file called \"git-daemon-export-ok\". If that file does not exist, it \nwill exit.\n\nThis means, btw, that it will _not_ export any random git directory by \ndefault, much less anything else. You literally have to mark your git \ndirectories for export explicitly by doing a \"touch git-daemon-export-ok\" \nin the .git directory.\n\nSee \"daemon.c: upload()\" for some of the details.\n\n> e) If I put my public key in ~git/.ssh/authorized_keys on the server, I can \n> act as user git on the server via ssh.  Does git push support this?  \n\nYes. That's the normal way to do it. The anonymous \"git://\" protocol can \nonly do reads (adn it is entirely anonymous). For pushes, you _have_ to \nuse ssh, either through\n\n\tgit push my.domain.com:/path/to/repository\n\nor\n\n\tgit push ssh://my.domain.com/path/to/repository\n\n(and you can obviously shorthand the format by putting it into your \n.git/remotes/ files, so that you can do things like \"git push public\".)\n\n> f) If I can do e), then perhaps [need to read the docs a bit harder] I can set \n> up my user git on the machine to use git-receive-pack as its login shell.  \n> Will this work? - the tutorial talks about needing .bashrc to set up the \n> $PATH environment, but are there any other hidden gotchas?\n\nThere shouldn't be any other gotchas. But no, you can't _quite_ use \ngit-receive-pack as the login shell. Why? Because if you have it as your \nlogin shell, it will get the wrong arguments: it will get:\n\n\t0: git-receive-pack\n\t1: -c\n\t2: git-receive-pack '/path/to/repository'\n\nand you'd need to have some ultra-simple shell that took this, verified\nthe proper arguments, and turned it into an\n\n\texecvp(git-receive-pack, /path/to/repository, NULL);\n\nBut yes, you _should_ be able to do it with that ultra-simplistic login \nshell. Probably just a 5-liner main() function or something.\n\n\t\t\tLinus\n"},{"id":"7587","messageId":"Pine.LNX.4.58.0508200911250.3317@g5.osdl.org","threadId":"1598","inReplyTo":"Pine.LNX.4.58.0508200821220.3317@g5.osdl.org","subject":"Re: \"Publishing your work\" questions?","fromName":"Linus Torvalds","fromEmail":"torvalds@osdl.org","sentAt":"2005-08-20T16:12:11Z","receivedAt":"2005-08-20T16:12:11Z","isPatch":false,"sender":{"key":"torvalds@linux-foundation.org","avatar":"https://avatars.githubusercontent.com/u/1024025?v=4"},"body":"\n\nOn Sat, 20 Aug 2005, Linus Torvalds wrote:\n> \n> But yes, you _should_ be able to do it with that ultra-simplistic login \n> shell. Probably just a 5-liner main() function or something.\n\nThis is entirely untested, and a lot more than five lines of code. Edit \nuntil it works.\n\n\t\tLinus\n\n----\n#include <unistd.h>\n#include <string.h>\n#include <stdlib.h>\n\nstatic char *parse_argument(char *orig)\n{\n\tint i;\n\tint len = strlen(orig);\n\n\t/* We only accept properly quoted arguments */\n\tif (len < 2 || orig[0] != '\\'' || orig[len-1] != '\\'')\n\t\texit(2);\n\torig[len-1] = 0;\n\torig++;\n\tlen -= 2;\n\n\t/*\n\t * Go look for quoted single-ticks. They are always\n\t * quoted as '\\'', we don't accept anything else\n\t */\n\tfor (i = 0; len ; i++, len--) {\n\t\tchar c = orig[i];\n\t\tif (c != '\\'')\n\t\t\tcontinue;\n\t\tif (len < 4 || memcmp(orig+i, \"'\\\\''\", 4))\n\t\t\texit(2);\n\t\tlen -= 3;\n\t\tmemmove(orig+1, orig+4, len+1);\n\t}\n\treturn orig;\n}\n\nint main(int argc, char **argv)\n{\n\tint i;\n\tchar *cmd, *arg;\n\n\tif (argc < 2)\n\t\texit(1);\n\ti = 2;\n\tcmd = argv[1];\n\tif (!strcmp(cmd, \"-c\"))\n\t\tcmd = argv[i++];\n\n\t/* We're not going to allow anything else */\n\tif (argc != i)\n\t\texit(1);\n\n\t/*\n\t * Right now we only accept \"upload\" commands, but\n\t * we could have some maintenance commands too, to\n\t * create new archives or delete old ones..\n\t */\n\tif (strncmp(cmd, \"git-upload-pack \", 16))\n\t\texit(1);\n\n\targ = parse_argument(cmd+16);\n\texeclp(\"git-upload-pack\", \"git-upload-pack\", arg, NULL);\n\texit(3);\n}\n"},{"id":"7588","messageId":"7v4q9kpks5.fsf@assigned-by-dhcp.cox.net","threadId":"1598","inReplyTo":"Pine.LNX.4.58.0508200911250.3317@g5.osdl.org","subject":"Re: \"Publishing your work\" questions?","fromName":"Junio C Hamano","fromEmail":"junkio@cox.net","sentAt":"2005-08-20T17:42:34Z","receivedAt":"2005-08-20T17:42:34Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Linus Torvalds <torvalds@osdl.org> writes:\n\n> \t/*\n> \t * Go look for quoted single-ticks. They are always\n> \t * quoted as '\\'', we don't accept anything else\n> \t */\n\nOh, I am extremely glad to see that somebody else understands\nexactly why I do things in the \"seemingly very unoptimized\" way\nin sq_quote() --- it allows easy parsing for non-shell users.\n"}]}