{"thread":{"id":"19633","subject":"gitosis question: identifying/logging remote user","startedAt":"2009-06-02T04:02:40Z","lastAt":"2009-06-03T21:02:01Z","messageCount":11,"participants":["Sitaram Chamarty","Robin H. Johnson","Heiko Voigt","Shawn O. Pearce"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"115226","messageId":"2e24e5b90906012102y4e1e6281p437e4d88da517c08@mail.gmail.com","threadId":"19633","inReplyTo":null,"subject":"gitosis question: identifying/logging remote user","fromName":"Sitaram Chamarty","fromEmail":"sitaramc@gmail.com","sentAt":"2009-06-02T04:02:40Z","receivedAt":"2009-06-02T04:02:40Z","isPatch":false,"sender":{"key":"sitaramc@gmail.com","avatar":"https://avatars.githubusercontent.com/u/43316?v=4"},"body":"Hi,\n\nSummary:\n\nI want to be able to log the information that the post-receive hook\nreceives, but I *also* want, along with that, the name of the pubkey\nthat was used in this particular \"push\".\n\nDetail:\n\ngitosis uses lines in ~git/.ssh/authorized_keys that use ssh's\n\"command=\" feature. Specifically, the command is restricted to\n\"gitosis-serve username\". Internally, gitosis uses this name to\ndecide if you're allowed to do what you're trying to do.\n\nI'd like it to set an additional env var which will contain \"username\"\nso that hooks etc can get that info and use it as they they see fit.\n\nQ1: are there any downsides to doing this? I don't see any, you're\njust creating and setting a new variable but...\n\nQ2: if it's a good idea, can someone give me a hint about where to do\nthis? I'm useless at python but I'm willing to try.\n\nThanks,\n\nSitaram\n"},{"id":"115229","messageId":"robbat2-20090602T062332-128740789Z@orbis-terrarum.net","threadId":"19633","inReplyTo":"2e24e5b90906012102y4e1e6281p437e4d88da517c08@mail.gmail.com","subject":"Re: gitosis question: identifying/logging remote user","fromName":"Robin H. Johnson","fromEmail":"robbat2@gentoo.org","sentAt":"2009-06-02T06:31:58Z","receivedAt":"2009-06-02T06:31:58Z","isPatch":false,"sender":{"key":"robbat2@gentoo.org","avatar":"https://avatars.githubusercontent.com/u/373898?v=4"},"body":"On Tue, Jun 02, 2009 at 09:32:40AM +0530, Sitaram Chamarty wrote:\n> I want to be able to log the information that the post-receive hook\n> receives, but I *also* want, along with that, the name of the pubkey\n> that was used in this particular \"push\".\nI've got a partial patch that I never finished for using this with the\ngitosis-gentoo fork that powers git.overlays.gentoo.org. It needs\nre-implementation from scratch, but here's the design notes:\n1. Use the username to open the file in keydir again.\n2. At the top, look for RFC822 headers with a leading \"# \" as padding:\n Examples from my own patch:\n # Full-Name: \"Robin H. Johnson (robbat2)\" \n # cia-vc-username: robbat2\n The headers are followed by a blank line then further text is free-form\n and not parsed. Continuation lines are NOT supported.\n3. The header field names are transformed to enviornoment variable names\n as follows:\n - y/[[:lower:]]/[[:upper:]]/g\n - s/-/_/g\n4. Export the environment variables, named per above, with the full\n content of the rest of the line.\n\n(We need to export the CIA.vc data, and also send off a commit mail).\n\n-- \nRobin Hugh Johnson\nGentoo Linux Developer & Infra Guy\nE-Mail : robbat2@gentoo.org\nGnuPG FP : 11AC BA4F 4778 E3F6 E4ED F38E B27B 944E 3488 4E85\n"},{"id":"115242","messageId":"2e24e5b90906020619o1bef150k43eba2870ff4fc4e@mail.gmail.com","threadId":"19633","inReplyTo":"robbat2-20090602T062332-128740789Z@orbis-terrarum.net","subject":"Re: gitosis question: identifying/logging remote user","fromName":"Sitaram Chamarty","fromEmail":"sitaramc@gmail.com","sentAt":"2009-06-02T13:19:22Z","receivedAt":"2009-06-02T13:19:22Z","isPatch":false,"sender":{"key":"sitaramc@gmail.com","avatar":"https://avatars.githubusercontent.com/u/43316?v=4"},"body":"On Tue, Jun 2, 2009 at 12:01 PM, Robin H. Johnson wrote:\n> On Tue, Jun 02, 2009 at 09:32:40AM +0530, Sitaram Chamarty wrote:\n>> I want to be able to log the information that the post-receive hook\n>> receives, but I *also* want, along with that, the name of the pubkey\n>> that was used in this particular \"push\".\n> I've got a partial patch that I never finished for using this with the\n> gitosis-gentoo fork that powers git.overlays.gentoo.org. It needs\n> re-implementation from scratch, but here's the design notes:\n> 1. Use the username to open the file in keydir again.\n\nThis is the directory that contains all the *.pub files, so ok...\n\n> 2. At the top, look for RFC822 headers with a leading \"# \" as padding:\n>   Examples from my own patch:\n>   # Full-Name: \"Robin H. Johnson (robbat2)\" \n>   # cia-vc-username: robbat2\n\nHmmm... is this a significantly different gitosis? The files in my\nkeydir mostly contain just one line (some have two, for people who\nwork from different machines), looking like this:\n\nssh-rsa [long series of base64 type characters]== some.one@company.com\n\n>   The headers are followed by a blank line then further text is free-form\n>   and not parsed. Continuation lines are NOT supported.\n> 3. The header field names are transformed to enviornoment variable names\n>   as follows:\n>   - y/[[:lower:]]/[[:upper:]]/g\n>   - s/-/_/g\n> 4. Export the environment variables, named per above, with the full\n>   content of the rest of the line.\n>\n> (We need to export the CIA.vc data, and also send off a commit mail).\n\nNope, I'm completely lost. Perhaps I failed miserably in explaining\nwhat I want... !\n\n----------\n\nI'm thinking along the lines of a simple change to this:\n\n TEMPLATE=('command=\"gitosis-serve %(user)s\",no-port-forwarding,'\n +'no-X11-forwarding,no-agent-forwarding,no-pty %(key)s')\n\n(in function generateAuthorizedKeys of gitosis/ssh.py) to generate an\nadditional ssh directive in the authorized_keys file:\n\n environment=\"REMOTEUSER=%(user)s\"\n\nI haven't tested it yet, but I'm expecting that this will pass on the\nname of the user (like \"sitaram\" in my case) as an env var so that I\ncan do whatever I want with it in the hooks.\n\nThanks,\n\nSitaram\n"},{"id":"115244","messageId":"20090602135659.GA4320@macbook.lan","threadId":"19633","inReplyTo":"2e24e5b90906012102y4e1e6281p437e4d88da517c08@mail.gmail.com","subject":"[PATCH] Add USER environment variable to executed git commands when serving","fromName":"Heiko Voigt","fromEmail":"hvoigt@hvoigt.net","sentAt":"2009-06-02T13:56:59Z","receivedAt":"2009-06-02T13:56:59Z","isPatch":true,"sender":{"key":"hvoigt@hvoigt.net","avatar":"https://avatars.githubusercontent.com/u/184958?v=4"},"body":"This is useful if you want to implement access rights by branchname.\nThe update hook can check this variable and react accordingly.\n\nSigned-off-by: Heiko Voigt \n---\nOn Tue, Jun 02, 2009 at 09:32:40AM +0530, Sitaram Chamarty wrote:\n> I'd like it to set an additional env var which will contain \"username\"\n> so that hooks etc can get that info and use it as they they see fit.\n\nHere is a trivial patch. This is totally untested as I wanted to\nimplement something similar but never had the time to work more on it.\n\ncheers Heiko\n\n gitosis/serve.py | 1 +\n 1 files changed, 1 insertions(+), 0 deletions(-)\n\ndiff --git a/gitosis/serve.py b/gitosis/serve.py\nindex 867249e..0e2c4af 100644\n--- a/gitosis/serve.py\n+++ b/gitosis/serve.py\n@@ -201,6 +201,7 @@ class Main(app.App):\n sys.exit(1)\n \n main_log.debug('Serving %s', newcmd)\n+ os.putenv('USER', user)\n os.execvp('git', ['git', 'shell', '-c', newcmd])\n main_log.error('Cannot execute git-shell.')\n sys.exit(1)\n-- \n1.6.2.1.424.g0b27.dirty\n"},{"id":"115277","messageId":"20090602202118.GD3042@orbis-terrarum.net","threadId":"19633","inReplyTo":"2e24e5b90906020619o1bef150k43eba2870ff4fc4e@mail.gmail.com","subject":"Re: gitosis question: identifying/logging remote user","fromName":"Robin H. Johnson","fromEmail":"robbat2@gentoo.org","sentAt":"2009-06-02T20:21:18Z","receivedAt":"2009-06-02T20:21:18Z","isPatch":false,"sender":{"key":"robbat2@gentoo.org","avatar":"https://avatars.githubusercontent.com/u/373898?v=4"},"body":"On Tue, Jun 02, 2009 at 06:49:22PM +0530, Sitaram Chamarty wrote:\n> > 2. At the top, look for RFC822 headers with a leading \"# \" as padding:\n> >   Examples from my own patch:\n> >   # Full-Name: \"Robin H. Johnson (robbat2)\" \n> >   # cia-vc-username: robbat2\n> Hmmm... is this a significantly different gitosis? \nAvailable here:\nhttp://git.overlays.gentoo.org/gitweb/?p=proj/gitosis-gentoo.git;a=summary\n\n> The files in my keydir mostly contain just one line (some have two,\n> for people who work from different machines), looking like this:\n> \n> ssh-rsa [long series of base64 type characters]== some.one@company.com\nComments ARE valid at the top of the files. Some of files have many\nkeys (users that keep keys unique to machines rather than use agents).\nIn the comments, we keep contact details for the user, as well as who\nrequested adding them, when, and for what purpose. The name of the file\nis only for the ACL system. We had one potential conflict in naming\nalready, I got one of the users to rename to avoid having problems\nelsewhere.\n\n> >   The headers are followed by a blank line then further text is free-form\n> >   and not parsed. Continuation lines are NOT supported.\n> > 3. The header field names are transformed to enviornoment variable names\n> >   as follows:\n> >   - y/[[:lower:]]/[[:upper:]]/g\n> >   - s/-/_/g\n> > 4. Export the environment variables, named per above, with the full\n> >   content of the rest of the line.\n> > (We need to export the CIA.vc data, and also send off a commit mail).\n> Nope, I'm completely lost. Perhaps I failed miserably in explaining\n> what I want... !\nNo, it just seems that you aren't expecting the extra level of\nindirection. Instead of explicitly exporting values via environment in\nauthorized_keys, OR in gitosis-serve (like the other patch), I teach\ngitosis-serve how to find the keydir again, and extract pre-formatted\ndata.\n\nSay I'm committing to gitosis.\nThe entry in the authorized keys is:\ncommand=\"gitosis-serve robbat2\",no-port-forwarding,no-X11-forwarding,...\n\nWhen gitosis-serve runs, it goes and opens keydir/robbat2.pub.\nThe following headers are there:\n# Full-Name: \"Robin H. Johnson (robbat2)\"\n# Email: \n# cia-vc-username: robbat2\n\nAnd the gitosis-serve mangles these per my instructions above, and does\nos.putenv with them.\n\nThen the following exists in the environment:\nFULL_NAME='Robin H. Johnson (robbat2)'\nEMAIL='robbat2@gentoo.org'\nCIA_VC_USERNAME='robbat2'\n\nWhich are thus usable in the hooks.\n\n-- \nRobin Hugh Johnson\nGentoo Linux Developer & Infra Guy\nE-Mail : robbat2@gentoo.org\nGnuPG FP : 11AC BA4F 4778 E3F6 E4ED F38E B27B 944E 3488 4E85\n"},{"id":"115300","messageId":"2e24e5b90906021754h14d0b2ah265070d958b75048@mail.gmail.com","threadId":"19633","inReplyTo":"20090602202118.GD3042@orbis-terrarum.net","subject":"Re: gitosis question: identifying/logging remote user","fromName":"Sitaram Chamarty","fromEmail":"sitaramc@gmail.com","sentAt":"2009-06-03T00:54:27Z","receivedAt":"2009-06-03T00:54:27Z","isPatch":false,"sender":{"key":"sitaramc@gmail.com","avatar":"https://avatars.githubusercontent.com/u/43316?v=4"},"body":"On Wed, Jun 3, 2009 at 1:51 AM, Robin H. Johnson wrote:\n\n> No, it just seems that you aren't expecting the extra level of\n> indirection. Instead of explicitly exporting values via environment in\n> authorized_keys, OR in gitosis-serve (like the other patch), I teach\n> gitosis-serve how to find the keydir again, and extract pre-formatted\n> data.\n\nThanks for the detailed explanation. It makes sense, certainly.\n\nHowever, I'll probably use/test the other patch :-) because that's\nreally all I need. In an open source project, it's necessary for\npeople to see other details (GPG FP even, as you showed), but in the\nkind of single-digit-team-size internal projects I manage, just the\nuserid is quite enough.\n\nAlso, I'm not even going to send emails. All I want is to be able to\nlog each push to identify who did the push. That log may never be\nlooked at, but if is needed, it will have enough information to go on\nwith.\n\nOf course, if the main gitosis gets your changes, that'll be great :-)\n\nThanks again,\n\nSitaram\n"},{"id":"115301","messageId":"2e24e5b90906021804tf3db263qc41a6f8b171111e1@mail.gmail.com","threadId":"19633","inReplyTo":"20090602135659.GA4320@macbook.lan","subject":"Re: [PATCH] Add USER environment variable to executed git commands when serving","fromName":"Sitaram Chamarty","fromEmail":"sitaramc@gmail.com","sentAt":"2009-06-03T01:04:56Z","receivedAt":"2009-06-03T01:04:56Z","isPatch":true,"sender":{"key":"sitaramc@gmail.com","avatar":"https://avatars.githubusercontent.com/u/43316?v=4"},"body":"On Tue, Jun 2, 2009 at 7:26 PM, Heiko Voigt wrote:\n> This is useful if you want to implement access rights by branchname.\n\nI see this as more fundamental than any specific purpose. Right now,\ngitosis completely loses information on \"who did this push\", and this\nfills that basic need.\n\nAnd thanks for a patch that's even simpler than what I was *thinking*\nof doing :-)\n\nI will test it out today at work and report back but it should work; I\ndon't see why it wouldn't, unless somewhere else there's a\nsanitisation of env vars going on for security.\n\nRegards,\n\nSitaram\n"},{"id":"115315","messageId":"2e24e5b90906022324pe6769d5vfa5e3eec44daeaf3@mail.gmail.com","threadId":"19633","inReplyTo":"2e24e5b90906021804tf3db263qc41a6f8b171111e1@mail.gmail.com","subject":"Re: [PATCH] Add USER environment variable to executed git commands when serving","fromName":"Sitaram Chamarty","fromEmail":"sitaramc@gmail.com","sentAt":"2009-06-03T06:24:50Z","receivedAt":"2009-06-03T06:24:50Z","isPatch":true,"sender":{"key":"sitaramc@gmail.com","avatar":"https://avatars.githubusercontent.com/u/43316?v=4"},"body":"On Wed, Jun 3, 2009 at 6:34 AM, Sitaram Chamarty wrote:\n\n> I will test it out today at work and report back but it should work; I\n> don't see why it wouldn't, unless somewhere else there's a\n> sanitisation of env vars going on for security.\n\nworks beautifully! Thanks again.\n"},{"id":"115372","messageId":"20090603202701.GA8739@macbook.lan","threadId":"19633","inReplyTo":"2e24e5b90906022324pe6769d5vfa5e3eec44daeaf3@mail.gmail.com","subject":"Re: Re: [PATCH] Add USER environment variable to executed git commands when serving","fromName":"Heiko Voigt","fromEmail":"hvoigt@hvoigt.net","sentAt":"2009-06-03T20:27:02Z","receivedAt":"2009-06-03T20:27:02Z","isPatch":true,"sender":{"key":"hvoigt@hvoigt.net","avatar":"https://avatars.githubusercontent.com/u/184958?v=4"},"body":"On Wed, Jun 03, 2009 at 11:54:50AM +0530, Sitaram Chamarty wrote:\n> On Wed, Jun 3, 2009 at 6:34 AM, Sitaram Chamarty wrote:\n> \n> > I will test it out today at work and report back but it should work; I\n> > don't see why it wouldn't, unless somewhere else there's a\n> > sanitisation of env vars going on for security.\n> \n> works beautifully! Thanks again.\n\nYou are welcome. An interesting addition would be to propagate allowed\nbranchnames from gitosis.conf. That way you can implement write-\nprotected branches using an update hook.\n\nWhich enables better support for a maintainer based workflow for\ncentralized setups. Every developer would be allowed to push all branch\nnames he likes but the master branch is only writable by the maintainer.\n\nA nice solution to steer this directly from gitosis.conf? I never got\naround implementing it.\n\ncheers Heiko\n"},{"id":"115373","messageId":"robbat2-20090603T204719-922480112Z@orbis-terrarum.net","threadId":"19633","inReplyTo":"20090603202701.GA8739@macbook.lan","subject":"Re: Re: [PATCH] Add USER environment variable to executed git commands when serving","fromName":"Robin H. Johnson","fromEmail":"robbat2@gentoo.org","sentAt":"2009-06-03T20:50:04Z","receivedAt":"2009-06-03T20:50:04Z","isPatch":true,"sender":{"key":"robbat2@gentoo.org","avatar":"https://avatars.githubusercontent.com/u/373898?v=4"},"body":"On Wed, Jun 03, 2009 at 10:27:02PM +0200, Heiko Voigt wrote:\n> You are welcome. An interesting addition would be to propagate allowed\n> branchnames from gitosis.conf. That way you can implement write-\n> protected branches using an update hook.\n...\n> A nice solution to steer this directly from gitosis.conf? I never got\n> around implementing it.\nHas anybody implemented something like cvs_acls.pl (used by FreeBSD) for\nGit?\n\n-- \nRobin Hugh Johnson\nGentoo Linux Developer & Infra Guy\nE-Mail : robbat2@gentoo.org\nGnuPG FP : 11AC BA4F 4778 E3F6 E4ED F38E B27B 944E 3488 4E85\n"},{"id":"115375","messageId":"20090603210201.GP3355@spearce.org","threadId":"19633","inReplyTo":"robbat2-20090603T204719-922480112Z@orbis-terrarum.net","subject":"Re: Re: [PATCH] Add USER environment variable to executed git commands when serving","fromName":"Shawn O. Pearce","fromEmail":"spearce@spearce.org","sentAt":"2009-06-03T21:02:01Z","receivedAt":"2009-06-03T21:02:01Z","isPatch":true,"sender":{"key":"spearce@spearce.org","avatar":"https://avatars.githubusercontent.com/u/34844?v=4"},"body":"\"Robin H. Johnson\" wrote:\n> On Wed, Jun 03, 2009 at 10:27:02PM +0200, Heiko Voigt wrote:\n> > You are welcome. An interesting addition would be to propagate allowed\n> > branchnames from gitosis.conf. That way you can implement write-\n> > protected branches using an update hook.\n> ...\n> > A nice solution to steer this directly from gitosis.conf? I never got\n> > around implementing it.\n> Has anybody implemented something like cvs_acls.pl (used by FreeBSD) for\n> Git?\n\ncontrib/hooks/update-paranoid ?\n\nPerhaps the most flexible, and most paranoid, update hook available.\nBut it does require that the frontend set some sort of user identity.\nI think it relies on UNIX uid, but its easy to hack to use an env\nvar instead from gitosis.\n\n-- \nShawn.\n"}]}