{"thread":{"id":"33444","subject":"git-http-backend: anonymous read, authenticated write","startedAt":"2013-04-09T05:45:53Z","lastAt":"2013-04-13T08:52:17Z","messageCount":23,"participants":["Magnus Therning","Jakub Narębski","Jeff King"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"213641","messageId":"20130409054553.GA1537@mteis.lan","threadId":"33444","inReplyTo":null,"subject":"git-http-backend: anonymous read, authenticated write","fromName":"Magnus Therning","fromEmail":"magnus@therning.org","sentAt":"2013-04-09T05:45:53Z","receivedAt":"2013-04-09T05:45:53Z","isPatch":false,"sender":{"key":"magnus@therning.org","avatar":"https://gravatar.com/avatar/c10a263a961d4137d34ac9c7bfb03e0fa701cc0f8c6f3ab3c29df6473da383d9?d=mp&s=160"},"body":"I've been trying to set up git-http-backend+lighttpd. I've managed to\nset up anonymous read-only access, and I then successfully configured\nauthentication for both read and write. Then I get stuck. The\nman-page for git-http-backend says that the following snippet can be\nused for Apache 2.x:\n\n \n AuthType Basic\n AuthName \"Git Access\"\n Require group committers\n ...\n \n\nHowever, when I put in this match on location in my lighty config and\ntry to push I'm not asked for a password, instead I'm greeted with\n\n % git push \n error: The requested URL returned error: 403 Forbidden while accessing http://magnus@tracsrv.local/git/foo.git/info/refs?service=git-receive-pack\n\nAFAICS this means the man-page is wrong, and that I instead ought to\nmatch on the \"service=git-receive-pack\" part. Is that a correct\nconclusion?\n\n/M\n\n-- \nMagnus Therning OpenPGP: 0xAB4DFBA4 \nemail: magnus@therning.org jabber: magnus@therning.org\ntwitter: magthe http://therning.org/magnus\n\nI invented the term Object-Oriented, and I can tell you I did not have\nC++ in mind.\n -- Alan Kay\n"},{"id":"213655","messageId":"5164087A.3030007@gmail.com","threadId":"33444","inReplyTo":"20130409054553.GA1537@mteis.lan","subject":"Re: git-http-backend: anonymous read, authenticated write","fromName":"Jakub Narębski","fromEmail":"jnareb@gmail.com","sentAt":"2013-04-09T12:24:26Z","receivedAt":"2013-04-09T12:24:26Z","isPatch":false,"sender":{"key":"jnareb@gmail.com","avatar":"https://avatars.githubusercontent.com/u/2706?v=4"},"body":"On 09.04.2013, Magnus Therning wrote:\n\n> I've been trying to set up git-http-backend+lighttpd. I've managed to\n> set up anonymous read-only access, and I then successfully configured\n> authentication for both read and write. Then I get stuck. The\n> man-page for git-http-backend says that the following snippet can be\n> used for Apache 2.x:\n> \n> \n> AuthType Basic\n> AuthName \"Git Access\"\n> Require group committers\n> ...\n> \n> \n> However, when I put in this match on location in my lighty config and\n> try to push I'm not asked for a password, instead I'm greeted with\n> \n> % git push \n> error: The requested URL returned error: 403 Forbidden while \n> accessing\nhttp://magnus@tracsrv.local/git/foo.git/info/refs?service=git-receive-pack\n> \n> AFAICS this means the man-page is wrong, and that I instead ought to\n> match on the \"service=git-receive-pack\" part. Is that a correct\n> conclusion?\n\nYes, it is.\n\nI have tried to do the same anonymous read and authenticated write\nin \"smart HTTP\" access in Apache. There are some proposals[1],\nall I think which use mod_rewrite (as LocationMatch doesn't take\nquery string into account, unfortunately), but I haven't been able\nto make it work.\n\nThe problem is that both POST *and GET* (to get refs) must be authethicated.\n\nNb. I thought that it was corrected... which git version do you use?\n\n[1]: http://paperlined.org/apps/git/SmartHTTP_Ubuntu.html\n\n\nIn the end I have worked around this by allowing all registered users to\nread with \"require valid-user\" (which in my situation might be even more\ncorrect solution; the case being repositories for Computer Science class\nlab work), and restricting write via pre-receive hook which checks\nREMOTE_USER.\n\n-- \nJakub Narębski\n"},{"id":"213676","messageId":"20130409171247.GD21972@sigill.intra.peff.net","threadId":"33444","inReplyTo":"20130409054553.GA1537@mteis.lan","subject":"Re: git-http-backend: anonymous read, authenticated write","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2013-04-09T17:12:47Z","receivedAt":"2013-04-09T17:12:47Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Tue, Apr 09, 2013 at 07:45:53AM +0200, Magnus Therning wrote:\n\n> I've been trying to set up git-http-backend+lighttpd. I've managed to\n> set up anonymous read-only access, and I then successfully configured\n> authentication for both read and write. Then I get stuck. The\n> man-page for git-http-backend says that the following snippet can be\n> used for Apache 2.x:\n> \n> \n> AuthType Basic\n> AuthName \"Git Access\"\n> Require group committers\n> ...\n> \n> \n> However, when I put in this match on location in my lighty config and\n> try to push I'm not asked for a password, instead I'm greeted with\n> \n> % git push \n> error: The requested URL returned error: 403 Forbidden while accessing http://magnus@tracsrv.local/git/foo.git/info/refs?service=git-receive-pack\n\nSomething in your config is blocking access to info/refs there. It\nshould not be the block shown above, which handles only the actual POST\nof the data. The sequence of http requests made is:\n\n 1. GET $repo/info/refs?service=git-receive-pack\n\n This makes initial contact and gets the ref information which push\n uses to decide what it is going to push. So it is read-only, and in\n an anonymous-read setup, does not need to be protected.\n\n 2. POST $repo/git-receive-pack\n\n This actually pushes up the objects and updates the refs, and\n must be protected.\n\nThe setup listed above does work with apache; it is tested as part of\nour test suite (you can see the actual config in t/lib-httpd/apache.conf).\nSo what in lighttpd is giving us the 403? Can you share your whole\nconfig?\n\n> AFAICS this means the man-page is wrong, and that I instead ought to\n> match on the \"service=git-receive-pack\" part. Is that a correct\n> conclusion?\n\nNo. It is not a bad idea to _also_ match on info/refs, but I think it's\na little trickier (you need to reliably match the query string to\ndifferentiate it from a fetch, which IIRC is a little hard in apache, at\nleast).\n\nBut if you drop the protections on \"/git-receive-pack$\", then an\nattacker can just POST whatever they want into your repository.\n\n-Peff\n"},{"id":"213839","messageId":"20130410204544.GA2472@mteis.lan","threadId":"33444","inReplyTo":"20130409171247.GD21972@sigill.intra.peff.net","subject":"Re: git-http-backend: anonymous read, authenticated write","fromName":"Magnus Therning","fromEmail":"magnus@therning.org","sentAt":"2013-04-10T20:45:44Z","receivedAt":"2013-04-10T20:45:44Z","isPatch":false,"sender":{"key":"magnus@therning.org","avatar":"https://gravatar.com/avatar/c10a263a961d4137d34ac9c7bfb03e0fa701cc0f8c6f3ab3c29df6473da383d9?d=mp&s=160"},"body":"On Tue, Apr 09, 2013 at 01:12:47PM -0400, Jeff King wrote:\n> On Tue, Apr 09, 2013 at 07:45:53AM +0200, Magnus Therning wrote:\n> \n>> I've been trying to set up git-http-backend+lighttpd. I've managed\n>> to set up anonymous read-only access, and I then successfully\n>> configured authentication for both read and write. Then I get\n>> stuck. The man-page for git-http-backend says that the following\n>> snippet can be used for Apache 2.x:\n>> \n>> \n>> AuthType Basic\n>> AuthName \"Git Access\"\n>> Require group committers\n>> ...\n>> \n>> \n>> However, when I put in this match on location in my lighty config\n>> and try to push I'm not asked for a password, instead I'm greeted\n>> with\n>> \n>> % git push \n>> error: The requested URL returned error: 403 Forbidden while accessing http://magnus@tracsrv.local/git/foo.git/info/refs?service=git-receive-pack\n> \n> Something in your config is blocking access to info/refs there. It\n> should not be the block shown above, which handles only the actual POST\n> of the data. The sequence of http requests made is:\n> \n> 1. GET $repo/info/refs?service=git-receive-pack\n> \n> This makes initial contact and gets the ref information which push\n> uses to decide what it is going to push. So it is read-only, and in\n> an anonymous-read setup, does not need to be protected.\n> \n> 2. POST $repo/git-receive-pack\n> \n> This actually pushes up the objects and updates the refs, and\n> must be protected.\n> \n> The setup listed above does work with apache; it is tested as part of\n> our test suite (you can see the actual config in t/lib-httpd/apache.conf).\n> So what in lighttpd is giving us the 403? Can you share your whole\n> config?\n\nI was putting together a *long* response, with my different\nconfigurations when it suddenly hit me how to make it work.\n\nSo, this is the accesslog for a successful `git push`:\n\n192.168.1.84 tracsrv.local - [10/Apr/2013:22:24:59 +0200] \"GET /git/foo.git/info/refs?service=git-receive-pack HTTP/1.1\" 401 351 \"-\" \"git/1.8.2.1\"\n192.168.1.84 tracsrv.local - [10/Apr/2013:22:24:59 +0200] \"GET /git/foo.git/info/refs?service=git-receive-pack HTTP/1.1\" 401 351 \"-\" \"git/1.8.2.1\"\n192.168.1.84 tracsrv.local magnus [10/Apr/2013:22:25:04 +0200] \"GET /git/foo.git/info/refs?service=git-receive-pack HTTP/1.1\" 200 202 \"-\" \"git/1.8.2.1\"\n192.168.1.84 tracsrv.local magnus [10/Apr/2013:22:25:09 +0200] \"POST /git/foo.git/git-receive-pack HTTP/1.1\" 200 73 \"-\" \"git/1.8.2.1\"\n\nThat is, *both* the GET and POST queries require a valid username\n(trying to push without a valid user will fail with a 403 already on\nthe GET query). Maybe Apache 2.x simply behaves *very* differently\nfrom lighttpd, but I still can't see how a rule to require a valid\nuser only on the POST can ever work.\n\n>> AFAICS this means the man-page is wrong, and that I instead ought\n>> to match on the \"service=git-receive-pack\" part. Is that a correct\n>> conclusion?\n> \n> No. It is not a bad idea to _also_ match on info/refs, but I think\n> it's a little trickier (you need to reliably match the query string\n> to differentiate it from a fetch, which IIRC is a little hard in\n> apache, at least).\n\nThis is what triggered me to find a working config. Matching on the\nquery string is actually *very* easy in lighttpd. Here's the relevant\nbit of a working configuration[1]:\n\n alias.url += ( \"/git\" => \"/usr/lib/git-core/git-http-backend\" )\n $HTTP[\"querystring\"] =~ \"service=git-receive-pack\" {\n $HTTP[\"url\"] =~ \"^/git\" {\n cgi.assign = ( \"\" => \"\" )\n setenv.add-environment = (\n \"GIT_PROJECT_ROOT\" => \"/srv/git\",\n \"GIT_HTTP_EXPORT_ALL\" => \"\"\n )\n include \"trac-git-auth.conf\"\n }\n } else $HTTP[\"url\"] =~ \"^/git/.*/git-receive-pack$\" {\n cgi.assign = ( \"\" => \"\" )\n setenv.add-environment = (\n \"GIT_PROJECT_ROOT\" => \"/srv/git\",\n \"GIT_HTTP_EXPORT_ALL\" => \"\"\n )\n include \"trac-git-auth.conf\"\n } else $HTTP[\"url\"] =~ \"^/git\" {\n cgi.assign = ( \"\" => \"\" )\n setenv.add-environment = (\n \"GIT_PROJECT_ROOT\" => \"/srv/git\",\n \"GIT_HTTP_EXPORT_ALL\" => \"\"\n )\n }\n\n> But if you drop the protections on \"/git-receive-pack$\", then an\n> attacker can just POST whatever they want into your repository.\n\nThis setup is for a server on the internal network, but still, your\ncomment holds. The reason for wanting to allow reading without\nauthentication is that then I can signal a CI server to pull without\nhaving to give it credentials.\n\n/M\n\n[1]: The configuration for the authentication looks like this at the\nmoment, but it's only for testing:\n\n auth.backend = \"plain\"\n auth.backend.plain.userfile = \"/srv/git/pwds.plain\"\n auth.require = (\n \"/\" => (\n \"method\" => \"basic\",\n \"realm\" => \"git\",\n \"require\" => \"valid-user\"\n )\n )\n-- \nMagnus Therning OpenPGP: 0xAB4DFBA4 \nemail: magnus@therning.org jabber: magnus@therning.org\ntwitter: magthe http://therning.org/magnus\n\nMost software today is very much like an Egyptian pyramid with\nmillions of bricks piled on top of each other, with no structural\nintegrity, but just done by brute force and thousands of slaves.\n -- Alan Kay\n"},{"id":"213840","messageId":"20130410205359.GB2472@mteis.lan","threadId":"33444","inReplyTo":"5164087A.3030007@gmail.com","subject":"Re: git-http-backend: anonymous read, authenticated write","fromName":"Magnus Therning","fromEmail":"magnus@therning.org","sentAt":"2013-04-10T20:53:59Z","receivedAt":"2013-04-10T20:53:59Z","isPatch":false,"sender":{"key":"magnus@therning.org","avatar":"https://gravatar.com/avatar/c10a263a961d4137d34ac9c7bfb03e0fa701cc0f8c6f3ab3c29df6473da383d9?d=mp&s=160"},"body":"On Tue, Apr 09, 2013 at 02:24:26PM +0200, Jakub Narębski wrote:\n> On 09.04.2013, Magnus Therning wrote:\n> \n> > I've been trying to set up git-http-backend+lighttpd. I've managed to\n> > set up anonymous read-only access, and I then successfully configured\n> > authentication for both read and write. Then I get stuck. The\n> > man-page for git-http-backend says that the following snippet can be\n> > used for Apache 2.x:\n> > \n> > \n> > AuthType Basic\n> > AuthName \"Git Access\"\n> > Require group committers\n> > ...\n> > \n> > \n> > However, when I put in this match on location in my lighty config and\n> > try to push I'm not asked for a password, instead I'm greeted with\n> > \n> > % git push \n> > error: The requested URL returned error: 403 Forbidden while \n> > accessing\n> http://magnus@tracsrv.local/git/foo.git/info/refs?service=git-receive-pack\n> > \n> > AFAICS this means the man-page is wrong, and that I instead ought to\n> > match on the \"service=git-receive-pack\" part. Is that a correct\n> > conclusion?\n> \n> Yes, it is.\n> \n> I have tried to do the same anonymous read and authenticated write\n> in \"smart HTTP\" access in Apache. There are some proposals[1],\n> all I think which use mod_rewrite (as LocationMatch doesn't take\n> query string into account, unfortunately), but I haven't been able\n> to make it work.\n> \n> The problem is that both POST *and GET* (to get refs) must be authethicated.\n> \n> Nb. I thought that it was corrected... which git version do you use?\n\n1.8.2 on the server, though 1.8.2.1 is available for the distro I'm\nusing. The discussion you refer to took place in 2010, I doubt any\nimprovement has been made to this in that point release, or am I\nwrong?\n\n> [1]: http://paperlined.org/apps/git/SmartHTTP_Ubuntu.html\n> \n> \n> In the end I have worked around this by allowing all registered users to\n> read with \"require valid-user\" (which in my situation might be even more\n> correct solution; the case being repositories for Computer Science class\n> lab work), and restricting write via pre-receive hook which checks\n> REMOTE_USER.\n\nI *really* want anonymous RO access so the CI server doesn't need any\ncredentials. I could of course set up git-http-backend to be served\non two different URLs, but that's just ugly ;)\n\nLuckily I did find a working configuration, which I posted in another\nemail in this thread.\n\n/M\n\n-- \nMagnus Therning OpenPGP: 0xAB4DFBA4 \nemail: magnus@therning.org jabber: magnus@therning.org\ntwitter: magthe http://therning.org/magnus\n\n\nPerl is another example of filling a tiny, short-term need, and then\nbeing a real problem in the longer term.\n -- Alan Kay\n"},{"id":"213857","messageId":"5165DA13.8010100@gmail.com","threadId":"33444","inReplyTo":"20130409171247.GD21972@sigill.intra.peff.net","subject":"Re: git-http-backend: anonymous read, authenticated write","fromName":"Jakub Narębski","fromEmail":"jnareb@gmail.com","sentAt":"2013-04-10T21:30:59Z","receivedAt":"2013-04-10T21:30:59Z","isPatch":false,"sender":{"key":"jnareb@gmail.com","avatar":"https://avatars.githubusercontent.com/u/2706?v=4"},"body":"Jeff King wrote:\n> On Tue, Apr 09, 2013 at 07:45:53AM +0200, Magnus Therning wrote:\n\n>> % git push \n>> error: The requested URL returned error: 403 Forbidden while accessing\n>>\nhttp://magnus@tracsrv.local/git/foo.git/info/refs?service=git-receive-pack\n> \n> Something in your config is blocking access to info/refs there. It\n> should not be the block shown above, which handles only the actual POST\n> of the data. The sequence of http requests made is:\n> \n> 1. GET $repo/info/refs?service=git-receive-pack\n> \n> This makes initial contact and gets the ref information which push\n> uses to decide what it is going to push. So it is read-only, and in\n> an anonymous-read setup, does not need to be protected.\n\nYes, it doesn't need to be protected, but *git-receive-pack* requires\n(or required) valid user even for above GET request for getting refs.\n\n> 2. POST $repo/git-receive-pack\n> \n> This actually pushes up the objects and updates the refs, and\n> must be protected.\n> \n> The setup listed above does work with apache; it is tested as part of\n> our test suite (you can see the actual config in t/lib-httpd/apache.conf).\n> So what in lighttpd is giving us the 403? Can you share your whole\n> config?\n\nI think I have seen a patch on git mailing list to correct this, but\nI am not sure.\n\nAre you sure that we test this correctly?\n\n-- \nJakub Narębski\n"},{"id":"213862","messageId":"20130410214722.GA6215@sigill.intra.peff.net","threadId":"33444","inReplyTo":"5165DA13.8010100@gmail.com","subject":"Re: git-http-backend: anonymous read, authenticated write","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2013-04-10T21:47:22Z","receivedAt":"2013-04-10T21:47:22Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Wed, Apr 10, 2013 at 11:30:59PM +0200, Jakub Narębski wrote:\n\n> > 1. GET $repo/info/refs?service=git-receive-pack\n> > \n> > This makes initial contact and gets the ref information which push\n> > uses to decide what it is going to push. So it is read-only, and in\n> > an anonymous-read setup, does not need to be protected.\n> \n> Yes, it doesn't need to be protected, but *git-receive-pack* requires\n> (or required) valid user even for above GET request for getting refs.\n\nRight. But that is not anything receive-pack is doing; it is up to his\nwebserver config, which is why I asked to see it.\n\n> > 2. POST $repo/git-receive-pack\n> > \n> > This actually pushes up the objects and updates the refs, and\n> > must be protected.\n> > \n> > The setup listed above does work with apache; it is tested as part of\n> > our test suite (you can see the actual config in t/lib-httpd/apache.conf).\n> > So what in lighttpd is giving us the 403? Can you share your whole\n> > config?\n> \n> I think I have seen a patch on git mailing list to correct this, but\n> I am not sure.\n> \n> Are you sure that we test this correctly?\n\nPerhaps you are thinking of the jk/maint-http-half-auth-push topic from\nlast August/September. It explicitly tests the setup from the manpage.\nThe relevant commits are 4c71009 (t: test http access to \"half-auth\"\nrepositories, 2012-08-27) which demonstrates the problem, and b81401c\n(http: prompt for credentials on failed POST, 2012-08-27).\n\nHowever, even before the fix, it never got a 403 on the GET of\ninfo/refs. It got a 401 on the later POST, but didn't prompt for\ncredentials.\n\n-Peff\n"},{"id":"213863","messageId":"20130410215346.GB6215@sigill.intra.peff.net","threadId":"33444","inReplyTo":"20130410204544.GA2472@mteis.lan","subject":"Re: git-http-backend: anonymous read, authenticated write","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2013-04-10T21:53:46Z","receivedAt":"2013-04-10T21:53:46Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Wed, Apr 10, 2013 at 10:45:44PM +0200, Magnus Therning wrote:\n\n> I was putting together a *long* response, with my different\n> configurations when it suddenly hit me how to make it work.\n> \n> So, this is the accesslog for a successful `git push`:\n> \n> 192.168.1.84 tracsrv.local - [10/Apr/2013:22:24:59 +0200] \"GET /git/foo.git/info/refs?service=git-receive-pack HTTP/1.1\" 401 351 \"-\" \"git/1.8.2.1\"\n> 192.168.1.84 tracsrv.local - [10/Apr/2013:22:24:59 +0200] \"GET /git/foo.git/info/refs?service=git-receive-pack HTTP/1.1\" 401 351 \"-\" \"git/1.8.2.1\"\n> 192.168.1.84 tracsrv.local magnus [10/Apr/2013:22:25:04 +0200] \"GET /git/foo.git/info/refs?service=git-receive-pack HTTP/1.1\" 200 202 \"-\" \"git/1.8.2.1\"\n> 192.168.1.84 tracsrv.local magnus [10/Apr/2013:22:25:09 +0200] \"POST /git/foo.git/git-receive-pack HTTP/1.1\" 200 73 \"-\" \"git/1.8.2.1\"\n> \n> That is, *both* the GET and POST queries require a valid username\n> (trying to push without a valid user will fail with a 403 already on\n> the GET query). Maybe Apache 2.x simply behaves *very* differently\n> from lighttpd, but I still can't see how a rule to require a valid\n> user only on the POST can ever work.\n\nRight. But that is not configured at all by the apache config shown in\nthe manpage:\n\n \n AuthType Basic\n AuthName \"Git Access\"\n Require group committers\n ...\n \n\nwhich should not match on the info/refs request at all. That is why I\nsuspect there is something else wrong in your lighttpd config, or\nsomething wrong in the conversion of the apache config to lighttpd.\n\nAnyway, it sounds like you found a working config.\n\n-Peff\n"},{"id":"213873","messageId":"20130410231919.GA1315@mteis.lan","threadId":"33444","inReplyTo":"20130410214722.GA6215@sigill.intra.peff.net","subject":"Re: git-http-backend: anonymous read, authenticated write","fromName":"Magnus Therning","fromEmail":"magnus@therning.org","sentAt":"2013-04-10T23:19:19Z","receivedAt":"2013-04-10T23:19:19Z","isPatch":false,"sender":{"key":"magnus@therning.org","avatar":"https://gravatar.com/avatar/c10a263a961d4137d34ac9c7bfb03e0fa701cc0f8c6f3ab3c29df6473da383d9?d=mp&s=160"},"body":"On Wed, Apr 10, 2013 at 05:47:22PM -0400, Jeff King wrote:\n> On Wed, Apr 10, 2013 at 11:30:59PM +0200, Jakub Narębski wrote:\n> \n>>> 1. GET $repo/info/refs?service=git-receive-pack\n>>> \n>>> This makes initial contact and gets the ref information which\n>>> push uses to decide what it is going to push. So it is\n>>> read-only, and in an anonymous-read setup, does not need to\n>>> be protected.\n>> \n>> Yes, it doesn't need to be protected, but *git-receive-pack*\n>> requires (or required) valid user even for above GET request for\n>> getting refs.\n> \n> Right. But that is not anything receive-pack is doing; it is up to\n> his webserver config, which is why I asked to see it.\n\nNope. I'm pretty sure this had *nothing* to do with my config. This\nis the original config, which doesn't work:\n\n$HTTP[\"url\"] =~ \"^/git\" {\n cgi.assign = ( \"\" => \"\" )\n setenv.add-environment = (\n \"GIT_PROJECT_ROOT\" => \"/srv/git\",\n \"GIT_HTTP_EXPORT_ALL\" => \"\"\n )\n $HTTP[\"url\"] =~ \"^/git/.*/git-receive-pack$\" {\n include \"trac-git-auth.conf\"\n }\n}\n\nThis will turn on authentication *only* for URLs matching\n^/git/.*/git-receive-pack$, which AFAIU is *exactly* what the manpage states is\nall that is needed.\n\nThis is the configuration that actually works:\n\n$HTTP[\"querystring\"] =~ \"service=git-receive-pack\" {\n $HTTP[\"url\"] =~ \"^/git\" {\n cgi.assign = ( \"\" => \"\" )\n setenv.add-environment = (\n \"GIT_PROJECT_ROOT\" => \"/srv/git\",\n \"GIT_HTTP_EXPORT_ALL\" => \"\"\n )\n include \"trac-git-auth.conf\"\n }\n} else $HTTP[\"url\"] =~ \"^/git\" {\n cgi.assign = ( \"\" => \"\" )\n setenv.add-environment = (\n \"GIT_PROJECT_ROOT\" => \"/srv/git\",\n \"GIT_HTTP_EXPORT_ALL\" => \"\"\n )\n $HTTP[\"url\"] =~ \"^/git/.*/git-receive-pack$\" {\n include \"trac-git-auth.conf\"\n }\n}\n\nThe top bit adds matching against the query string and ^/git which\nforces authentication on the initial GET as well.\n\n>>> 2. POST $repo/git-receive-pack\n>>> \n>>> This actually pushes up the objects and updates the refs, and\n>>> must be protected.\n>>> \n>>> The setup listed above does work with apache; it is tested as part\n>>> of our test suite (you can see the actual config in\n>>> t/lib-httpd/apache.conf). So what in lighttpd is giving us the\n>>> 403? Can you share your whole config?\n>> \n>> I think I have seen a patch on git mailing list to correct this,\n>> but I am not sure.\n>> \n>> Are you sure that we test this correctly?\n> \n> Perhaps you are thinking of the jk/maint-http-half-auth-push topic\n> from last August/September. It explicitly tests the setup from the\n> manpage. The relevant commits are 4c71009 (t: test http access to\n> \"half-auth\" repositories, 2012-08-27) which demonstrates the\n> problem, and b81401c (http: prompt for credentials on failed POST,\n> 2012-08-27).\n> \n> However, even before the fix, it never got a 403 on the GET of\n> info/refs. It got a 401 on the later POST, but didn't prompt for\n> credentials.\n\nI know nothing about CGI, but surely the script signals the need for a\nvalid user to the server somehow, couldn't the web server then decide\nto return 403 rather than 401 *if there's no configuration for\nauthentication*?\n\nIn any case it seems there is no fix in the version of git in Arch\nLinux[1].\n\n/M\n\n[1]: The package I've been using is built from these unpatched\nsources: http://git-core.googlecode.com/files/git-1.8.2.tar.gz\n\n-- \nMagnus Therning OpenPGP: 0xAB4DFBA4 \nemail: magnus@therning.org jabber: magnus@therning.org\ntwitter: magthe http://therning.org/magnus\n\nI invented the term Object-Oriented, and I can tell you I did not have\nC++ in mind.\n -- Alan Kay\n"},{"id":"213879","messageId":"20130411015613.GA8455@sigill.intra.peff.net","threadId":"33444","inReplyTo":"20130410231919.GA1315@mteis.lan","subject":"Re: git-http-backend: anonymous read, authenticated write","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2013-04-11T01:56:13Z","receivedAt":"2013-04-11T01:56:13Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Thu, Apr 11, 2013 at 01:19:19AM +0200, Magnus Therning wrote:\n\n> Nope. I'm pretty sure this had *nothing* to do with my config. This\n> is the original config, which doesn't work:\n> \n> $HTTP[\"url\"] =~ \"^/git\" {\n> cgi.assign = ( \"\" => \"\" )\n> setenv.add-environment = (\n> \"GIT_PROJECT_ROOT\" => \"/srv/git\",\n> \"GIT_HTTP_EXPORT_ALL\" => \"\"\n> )\n> $HTTP[\"url\"] =~ \"^/git/.*/git-receive-pack$\" {\n> include \"trac-git-auth.conf\"\n> }\n> }\n\nAh, I think I see what it is.\n\nDid you turn on http.receivepack in the git config to enable pushing?\nFrom \"git help http-backend\":\n\n By default, only the upload-pack service is enabled, which serves git\n fetch-pack and git ls-remote clients, which are invoked from git\n fetch, git pull, and git clone. If the client is authenticated, the\n receive-pack service is enabled, which serves git send-pack clients,\n which is invoked from git push.\n\n [...]\n\n http.receivepack\n This serves git send-pack clients, allowing push. It is disabled\n by default for anonymous users, and enabled by default for users\n authenticated by the web server. It can be disabled by setting\n this item to false, or enabled for all users, including anonymous\n users, by setting it to true.\n\nIf there is no authentication happening for the initial service-request,\nthen the default http.receivepack kicks in, which is to turn pushing\noff (because there is no authenticated user).\n\nWhen you do this;\n\n> $HTTP[\"querystring\"] =~ \"service=git-receive-pack\" {\n> $HTTP[\"url\"] =~ \"^/git\" {\n> cgi.assign = ( \"\" => \"\" )\n> setenv.add-environment = (\n> \"GIT_PROJECT_ROOT\" => \"/srv/git\",\n> \"GIT_HTTP_EXPORT_ALL\" => \"\"\n> )\n> include \"trac-git-auth.conf\"\n> }\n\nThen you are asking for authentication earlier (on the first request),\nand the default behavior is to allow the push.\n\nThe documentation should probably make the use of http.receivepack more\nclear in this situation.\n\n> > However, even before the fix, it never got a 403 on the GET of\n> > info/refs. It got a 401 on the later POST, but didn't prompt for\n> > credentials.\n> \n> I know nothing about CGI, but surely the script signals the need for a\n> valid user to the server somehow, couldn't the web server then decide\n> to return 403 rather than 401 *if there's no configuration for\n> authentication*?\n\nI think that series is a red herring. It did not affect the server-side\nat all, but was a fix for the _client_ to handle the 401 it should\nreceive in that situation. But your server was generating a 403, for\ndifferent reasons.\n\nSo _if_ you fixed it by setting http.receivepack (which I think is the\nsimplest thing under Apache, since matching the query string there is\nhard), then you would need a version of git with that fix on the\nclient side to actually have git prompt for the password correctly.\n\nBut your fix under lighttpd is much better, as it asks for the\ncredentials up front (which means the client does not go to any work\ncreating a packfile just to find out that it does not have access).\n\n-Peff\n"},{"id":"213888","messageId":"20130411033022.GA14462@sigill.intra.peff.net","threadId":"33444","inReplyTo":"20130411015613.GA8455@sigill.intra.peff.net","subject":"[PATCH 0/2] http-backend documentation examples","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2013-04-11T03:30:22Z","receivedAt":"2013-04-11T03:30:22Z","isPatch":true,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Wed, Apr 10, 2013 at 09:56:13PM -0400, Jeff King wrote:\n\n> The documentation should probably make the use of http.receivepack more\n> clear in this situation.\n\nHere's a patch series to do that. The first one would (hopefully) have\nhelped you arrive at the http.receivepack fix, as well as any other\npeople configuring Apache. The second one actually adds some basic\nlighttpd config, including the query-string match, which is a better\nsolution anyway.\n\n [1/2]: doc/http-backend: clarify \"half-auth\" repo configuration\n [2/2]: doc/http-backend: give some lighttpd config examples\n\n-Peff\n"},{"id":"213889","messageId":"20130411033211.GA14551@sigill.intra.peff.net","threadId":"33444","inReplyTo":"20130411033022.GA14462@sigill.intra.peff.net","subject":"[PATCH 1/2] doc/http-backend: clarify \"half-auth\" repo configuration","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2013-04-11T03:32:11Z","receivedAt":"2013-04-11T03:32:11Z","isPatch":true,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"When the http-backend is set up to allow anonymous read but\nauthenticated write, the http-backend manual suggests\ncatching only the \"/git-receive-pack\" POST of the packfile,\nnot the initial \"info/refs?service=git-receive-pack\" GET in\nwhich we advertise refs.\n\nThis does work and is secure, as we do not allow any write\nduring the info/refs request, and the information in the ref\nadvertisement is the same that you would get from a fetch.\n\nHowever, the configuration required by the server is\nslightly more complex. The default `http.receivepack`\nsetting is to allow pushes if the webserver tells us that\nthe user authenticated, and otherwise to return a 403\n(\"Forbidden\"). That works fine if authentication is turned\non completely; the initial request requires authentication,\nand http-backend realizes it is OK to do a push.\n\nBut for this \"half-auth\" state, no authentication has\noccurred during the initial ref advertisement. The\nhttp-backend CGI therefore does not think that pushing\nshould be enabled, and responds with a 403. The client\ncannot continue, even though the server would have allowed\nit to run if it had provided credentials.\n\nIt would be much better if the server responded with a 401,\nasking for credentials during the initial contact. But\ngit-http-backend does not know about the server's auth\nconfiguration (so a 401 would be confusing in the case of a\ntrue anonymous server). Unfortunately, configuring Apache to\nrecognize the query string and apply the auth appropriately\nto receive-pack (but not upload-pack) initial requests is\nnon-trivial.\n\nThe site admin can work around this by just turning on\nhttp.receivepack explicitly in its repositories. Let's\ndocument this workaround.\n\nSigned-off-by: Jeff King \n---\nMy understanding is that you can do query-string matching through a\nclever use of mod-rewrite. I am not nearly clever nor interested in\nApache enough to figure it out, but if somebody does, it would be nice\nto put the recipe here.\n\n Documentation/git-http-backend.txt | 9 +++++++++\n 1 file changed, 9 insertions(+)\n\ndiff --git a/Documentation/git-http-backend.txt b/Documentation/git-http-backend.txt\nindex 7b1e85c..f43980f 100644\n--- a/Documentation/git-http-backend.txt\n+++ b/Documentation/git-http-backend.txt\n@@ -91,6 +91,15 @@ require authorization with a LocationMatch directive:\n \n ----------------------------------------------------------------\n +\n+In this mode, the server will not request authentication until the\n+client actually starts the object negotiation phase of the push, rather\n+than during the initial contact. For this reason, you must also enable\n+the `http.receivepack` config option in any repositories that should\n+accept a push. The default behavior, if `http.receivepack` is not set,\n+is to reject any pushes by unauthenticated users; the initial request\n+will therefore report `403 Forbidden` to the client, without even giving\n+an opportunity for authentication.\n++\n To require authentication for both reads and writes, use a Location\n directive around the repository, or one of its parent directories:\n +\n-- \n1.8.2.rc0.33.gd915649\n"},{"id":"213890","messageId":"20130411033613.GB14551@sigill.intra.peff.net","threadId":"33444","inReplyTo":"20130411033022.GA14462@sigill.intra.peff.net","subject":"[PATCH 2/2] doc/http-backend: give some lighttpd config examples","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2013-04-11T03:36:13Z","receivedAt":"2013-04-11T03:36:13Z","isPatch":true,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"The examples in the documentation are all for Apache. Let's\nat least cover the basics: an anonymous server, an\nauthenticated server, and a \"half auth\" server with\nanonymous read and authenticated write.\n\nSigned-off-by: Jeff King \n---\nI am by no means a lighttpd expert, so there may be better ways to do\nsome of these. But I did test that they all work as expected.\n\nI was tempted for a moment to provide a mechanism for the t55* tests to\nuse either lighttpd _or_ apache, so that these could get some automated\ntesting. But I don't relish the thought of trying to keep both configs\nsynchronized as people update one or the other.\n\nThere are also some advanced setups in the apache part of the doc that I\ndidn't translate here (e.g., dumb-http fallback, and static serving of\ndumb-http files). Mostly because I don't think they are that commonly\nused these days, and I do not know enough about lighttpd configuration\nto translate them easily. If somebody wants to make a patch on top, they\ncan.\n\n Documentation/git-http-backend.txt | 55 ++++++++++++++++++++++++++++++++++++++\n 1 file changed, 55 insertions(+)\n\ndiff --git a/Documentation/git-http-backend.txt b/Documentation/git-http-backend.txt\nindex f43980f..cad18ce 100644\n--- a/Documentation/git-http-backend.txt\n+++ b/Documentation/git-http-backend.txt\n@@ -167,6 +167,61 @@ ScriptAlias /git/ /var/www/cgi-bin/gitweb.cgi/\n ScriptAlias /git/ /var/www/cgi-bin/gitweb.cgi/\n ----------------------------------------------------------------\n \n+Lighttpd::\n+\tEnsure that `mod_cgi`, `mod_alias, `mod_auth`, `mod_setenv` are\n+\tloaded, then set `GIT_PROJECT_ROOT` appropriately and redirect\n+\tall requests to the CGI:\n++\n+----------------------------------------------------------------\n+alias.url += ( \"/git\" => \"/usr/lib/git-core/git-http-backend\" )\n+$HTTP[\"url\"] =~ \"^/git\" {\n+\tcgi.assign = (\"\" => \"\")\n+\tsetenv.add-environment = (\n+\t\t\"GIT_PROJECT_ROOT\" => \"/var/www/git\",\n+\t\t\"GIT_HTTP_EXPORT_ALL\" => \"\"\n+\t)\n+}\n+----------------------------------------------------------------\n++\n+To enable anonymous read access but authenticated write access:\n++\n+----------------------------------------------------------------\n+$HTTP[\"querystring\"] =~ \"service=git-receive-pack\" {\n+\tinclude \"git-auth.conf\"\n+}\n+$HTTP[\"url\"] =~ \"^/git/.*/git-receive-pack$\" {\n+\tinclude \"git-auth.conf\"\n+}\n+----------------------------------------------------------------\n++\n+where `git-auth.conf` looks something like:\n++\n+----------------------------------------------------------------\n+auth.require = (\n+\t\"/\" => (\n+\t\t\"method\" => \"basic\",\n+\t\t\"realm\" => \"Git Access\",\n+\t\t\"require\" => \"valid-user\"\n+\t )\n+)\n+# ...and set up auth.backend here\n+----------------------------------------------------------------\n++\n+Note that unlike the similar setup with Apache, we can easily match the\n+query string for receive-pack, catching the initial request from the\n+client. This means that the server administrator does not have to worry\n+about configuring `http.receivepack` for the repositories (the default\n+value, which enables it only in the case of authentication, is\n+sufficient).\n++\n+To require authentication for both reads and writes:\n++\n+----------------------------------------------------------------\n+$HTTP[\"url\"] =~ \"^/git/private\" {\n+\tinclude \"git-auth.conf\"\n+}\n+----------------------------------------------------------------\n+\n \n ENVIRONMENT\n -----------\n-- \n1.8.2.rc0.33.gd915649\n"},{"id":"213906","messageId":"CAAExw5t3rk_R1GB9OMVKjPYEMRQg1gNSUGQtEK71m1Ux01N27w@mail.gmail.com","threadId":"33444","inReplyTo":"20130411015613.GA8455@sigill.intra.peff.net","subject":"Re: git-http-backend: anonymous read, authenticated write","fromName":"Magnus Therning","fromEmail":"magnus@therning.org","sentAt":"2013-04-11T06:52:56Z","receivedAt":"2013-04-11T06:52:56Z","isPatch":false,"sender":{"key":"magnus@therning.org","avatar":"https://gravatar.com/avatar/c10a263a961d4137d34ac9c7bfb03e0fa701cc0f8c6f3ab3c29df6473da383d9?d=mp&s=160"},"body":"On Thu, Apr 11, 2013 at 3:56 AM, Jeff King wrote:\n> On Thu, Apr 11, 2013 at 01:19:19AM +0200, Magnus Therning wrote:\n>\n>> Nope. I'm pretty sure this had *nothing* to do with my config. This\n>> is the original config, which doesn't work:\n>>\n>> $HTTP[\"url\"] =~ \"^/git\" {\n>> cgi.assign = ( \"\" => \"\" )\n>> setenv.add-environment = (\n>> \"GIT_PROJECT_ROOT\" => \"/srv/git\",\n>> \"GIT_HTTP_EXPORT_ALL\" => \"\"\n>> )\n>> $HTTP[\"url\"] =~ \"^/git/.*/git-receive-pack$\" {\n>> include \"trac-git-auth.conf\"\n>> }\n>> }\n>\n> Ah, I think I see what it is.\n>\n> Did you turn on http.receivepack in the git config to enable pushing?\n\nNope, of course I didn't :) Instead I did what the man-page tells me\nwill allow full export of a git repo *without* having to fiddle around\nwith the repo's config:\n\n1. set GIT_HTTP_EXPORT_ALL in the environment\n2. turn on authentication for *one* location that requires it for\npushing: ^/git/.*/git-receive-pack$\n\n[...]\n> If there is no authentication happening for the initial service-request,\n> then the default http.receivepack kicks in, which is to turn pushing\n> off (because there is no authenticated user).\n\nYes, but that only becomes clear when looking at the traffic. In\nfact, the whole design of services is not clearly mentioned in the\nman-page. I was *very* surprised to see the query strings when I\nstarted looking at the access logs.\n\n> The documentation should probably make the use of http.receivepack more\n> clear in this situation.\n\nI think that'd be good. The fact that it wasn't until several mails\ninto the thread that anyone thought of the http.receivepack setting\nalso suggests that its use is a bit un-intuitive (even though it\nprobably makes perfect sense and is a good solution).\n\n> So _if_ you fixed it by setting http.receivepack (which I think is the\n> simplest thing under Apache, since matching the query string there is\n> hard), then you would need a version of git with that fix on the\n> client side to actually have git prompt for the password correctly.\n\nAh, so *that* is the fix that has been mentioned (I haven't bothered\nreading it myself), or are there in fact two fixes that have been\nreferred to in the thread?\n\n> But your fix under lighttpd is much better, as it asks for the\n> credentials up front (which means the client does not go to any work\n> creating a packfile just to find out that it does not have access).\n\nYes, I think it also helps with my particular scenario where new repos\nwill be added from time to time. This way there is no second step,\nafter `git init`, that must be remembered.\n\nThank you very much for taking the time to help me out with this!\nI'll also take a look at the patches you sent, as a dumb simpler user\nI might have something to add, who knows?\n\n/M\n\n--\nMagnus Therning OpenPGP: 0xAB4DFBA4\nemail: magnus@therning.org jabber: magnus@therning.org\ntwitter: magthe http://therning.org/magnus\n"},{"id":"213907","messageId":"CAAExw5vNh=1B9pdyNiVU+-Nff_MaguGfE3czvMYiUhGhr2cz1Q@mail.gmail.com","threadId":"33444","inReplyTo":"20130411033211.GA14551@sigill.intra.peff.net","subject":"Re: [PATCH 1/2] doc/http-backend: clarify \"half-auth\" repo configuration","fromName":"Magnus Therning","fromEmail":"magnus@therning.org","sentAt":"2013-04-11T06:57:13Z","receivedAt":"2013-04-11T06:57:13Z","isPatch":true,"sender":{"key":"magnus@therning.org","avatar":"https://gravatar.com/avatar/c10a263a961d4137d34ac9c7bfb03e0fa701cc0f8c6f3ab3c29df6473da383d9?d=mp&s=160"},"body":"On Thu, Apr 11, 2013 at 5:32 AM, Jeff King wrote:\n> When the http-backend is set up to allow anonymous read but\n> authenticated write, the http-backend manual suggests\n> catching only the \"/git-receive-pack\" POST of the packfile,\n> not the initial \"info/refs?service=git-receive-pack\" GET in\n> which we advertise refs.\n>\n> This does work and is secure, as we do not allow any write\n> during the info/refs request, and the information in the ref\n> advertisement is the same that you would get from a fetch.\n>\n> However, the configuration required by the server is\n> slightly more complex. The default `http.receivepack`\n> setting is to allow pushes if the webserver tells us that\n> the user authenticated, and otherwise to return a 403\n> (\"Forbidden\"). That works fine if authentication is turned\n> on completely; the initial request requires authentication,\n> and http-backend realizes it is OK to do a push.\n>\n> But for this \"half-auth\" state, no authentication has\n> occurred during the initial ref advertisement. The\n> http-backend CGI therefore does not think that pushing\n> should be enabled, and responds with a 403. The client\n> cannot continue, even though the server would have allowed\n> it to run if it had provided credentials.\n>\n> It would be much better if the server responded with a 401,\n> asking for credentials during the initial contact. But\n> git-http-backend does not know about the server's auth\n> configuration (so a 401 would be confusing in the case of a\n> true anonymous server). Unfortunately, configuring Apache to\n> recognize the query string and apply the auth appropriately\n> to receive-pack (but not upload-pack) initial requests is\n> non-trivial.\n>\n> The site admin can work around this by just turning on\n> http.receivepack explicitly in its repositories. Let's\n> document this workaround.\n>\n> Signed-off-by: Jeff King \n> ---\n> My understanding is that you can do query-string matching through a\n> clever use of mod-rewrite. I am not nearly clever nor interested in\n> Apache enough to figure it out, but if somebody does, it would be nice\n> to put the recipe here.\n>\n> Documentation/git-http-backend.txt | 9 +++++++++\n> 1 file changed, 9 insertions(+)\n>\n> diff --git a/Documentation/git-http-backend.txt b/Documentation/git-http-backend.txt\n> index 7b1e85c..f43980f 100644\n> --- a/Documentation/git-http-backend.txt\n> +++ b/Documentation/git-http-backend.txt\n> @@ -91,6 +91,15 @@ require authorization with a LocationMatch directive:\n> \n> ----------------------------------------------------------------\n> +\n> +In this mode, the server will not request authentication until the\n> +client actually starts the object negotiation phase of the push, rather\n> +than during the initial contact. For this reason, you must also enable\n> +the `http.receivepack` config option in any repositories that should\n> +accept a push. The default behavior, if `http.receivepack` is not set,\n> +is to reject any pushes by unauthenticated users; the initial request\n> +will therefore report `403 Forbidden` to the client, without even giving\n> +an opportunity for authentication.\n> ++\n> To require authentication for both reads and writes, use a Location\n> directive around the repository, or one of its parent directories:\n> +\n> --\n> 1.8.2.rc0.33.gd915649\n>\n\nAs the dumb user who started the thread that lead to this proposed\nchange, I do think this makes the documentation much clearer and had I\nread this I most probably would have managed to set up the webserver\non my own.\n\n/M\n\n-- \nMagnus Therning OpenPGP: 0xAB4DFBA4\nemail: magnus@therning.org jabber: magnus@therning.org\ntwitter: magthe http://therning.org/magnus\n"},{"id":"213966","messageId":"5166E849.40609@gmail.com","threadId":"33444","inReplyTo":"20130411015613.GA8455@sigill.intra.peff.net","subject":"Re: git-http-backend: anonymous read, authenticated write","fromName":"Jakub Narębski","fromEmail":"jnareb@gmail.com","sentAt":"2013-04-11T16:43:53Z","receivedAt":"2013-04-11T16:43:53Z","isPatch":false,"sender":{"key":"jnareb@gmail.com","avatar":"https://avatars.githubusercontent.com/u/2706?v=4"},"body":"W dniu 11.04.2013 03:56, Jeff King napisał:\n\n> So _if_ you fixed it by setting http.receivepack (which I think is the\n> simplest thing under Apache, since matching the query string there is\n> hard), then you would need a version of git with that fix on the\n> client side to actually have git prompt for the password correctly.\n> \n> But your fix under lighttpd is much better, as it asks for the\n> credentials up front (which means the client does not go to any work\n> creating a packfile just to find out that it does not have access).\n\nAccording to http://paperlined.org/apps/git/SmartHTTP_Ubuntu.html\nit is (supposedly) not that hard in Apache (though it requires mod_rewrite):\n\n\n RewriteCond %{QUERY_STRING} =service=git-receive-pack [OR]\n RewriteCond %{REQUEST_URI} /git-receive-pack$\n RewriteRule (.*) $1 [E=AUTHREQUIRED:yes]\n\n \n Order Deny,Allow\n Deny from env=AUTHREQUIRED\n\n AuthType Basic\n AuthName \"Git Access\"\n Require group committers\n\n Satisfy Any\n \n\nNot tested.\n\n\nP.S. By the way, is there some debugger for apache config (mod_rewrite\nand deny/allow)?\n-- \nJakub Narębski\n"},{"id":"213968","messageId":"5166E935.2080206@gmail.com","threadId":"33444","inReplyTo":"20130411033613.GB14551@sigill.intra.peff.net","subject":"Re: [PATCH 2/2] doc/http-backend: give some lighttpd config examples","fromName":"Jakub Narębski","fromEmail":"jnareb@gmail.com","sentAt":"2013-04-11T16:47:49Z","receivedAt":"2013-04-11T16:47:49Z","isPatch":true,"sender":{"key":"jnareb@gmail.com","avatar":"https://avatars.githubusercontent.com/u/2706?v=4"},"body":"W dniu 11.04.2013 05:36, Jeff King napisał:\n\n> +Note that unlike the similar setup with Apache, we can easily match the\n> +query string for receive-pack, catching the initial request from the\n> +client. This means that the server administrator does not have to worry\n> +about configuring `http.receivepack` for the repositories (the default\n> +value, which enables it only in the case of authentication, is\n> +sufficient).\n\nPerhaps it would be worth including for Apache2 beside basic setup that\nrequires http.receivepack set to true, also one like for LigHTTPd, i.e.\n\n RewriteCond %{QUERY_STRING} =service=git-receive-pack [OR]\n RewriteCond %{REQUEST_URI} /git-receive-pack$\n RewriteRule (.*) $1 [E=AUTHREQUIRED:yes]\n\n \n Order Deny,Allow\n Deny from env=AUTHREQUIRED\n\n AuthType Basic\n AuthName \"Git Access\"\n Require group committers\n\n Satisfy Any\n \n\nAnd perhaps also adding it as test...\n-- \nJakub Narębski\n"},{"id":"213972","messageId":"20130411170233.GB1255@sigill.intra.peff.net","threadId":"33444","inReplyTo":"5166E935.2080206@gmail.com","subject":"Re: [PATCH 2/2] doc/http-backend: give some lighttpd config examples","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2013-04-11T17:02:33Z","receivedAt":"2013-04-11T17:02:33Z","isPatch":true,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Thu, Apr 11, 2013 at 06:47:49PM +0200, Jakub Narębski wrote:\n\n> W dniu 11.04.2013 05:36, Jeff King napisał:\n> \n> > +Note that unlike the similar setup with Apache, we can easily match the\n> > +query string for receive-pack, catching the initial request from the\n> > +client. This means that the server administrator does not have to worry\n> > +about configuring `http.receivepack` for the repositories (the default\n> > +value, which enables it only in the case of authentication, is\n> > +sufficient).\n> \n> Perhaps it would be worth including for Apache2 beside basic setup that\n> requires http.receivepack set to true, also one like for LigHTTPd, i.e.\n> \n> RewriteCond %{QUERY_STRING} =service=git-receive-pack [OR]\n> RewriteCond %{REQUEST_URI} /git-receive-pack$\n> RewriteRule (.*) $1 [E=AUTHREQUIRED:yes]\n> \n> \n> Order Deny,Allow\n> Deny from env=AUTHREQUIRED\n> \n> AuthType Basic\n> AuthName \"Git Access\"\n> Require group committers\n> \n> Satisfy Any\n> \n> \n> And perhaps also adding it as test...\n\nThat was the \"I am not clever nor interested in Apache enough to figure\nout how to do this...\" part that I wrote. I have no clue if the above\nworks, but I'd be happy if you wanted to test it out and submit it as a\npatch on top (I think it could even replace my 1/2, as making it just\nwork is a much better solution than having to explain the extra step in\nthe documentation).\n\n-Peff\n\n> -- \n> Jakub Narębski\n"},{"id":"213985","messageId":"5167009D.1050906@gmail.com","threadId":"33444","inReplyTo":"20130411170233.GB1255@sigill.intra.peff.net","subject":"Re: [PATCH 2/2] doc/http-backend: give some lighttpd config examples","fromName":"Jakub Narębski","fromEmail":"jnareb@gmail.com","sentAt":"2013-04-11T18:27:41Z","receivedAt":"2013-04-11T18:27:41Z","isPatch":true,"sender":{"key":"jnareb@gmail.com","avatar":"https://avatars.githubusercontent.com/u/2706?v=4"},"body":"W dniu 11.04.2013 19:02, Jeff King napisał:\n> On Thu, Apr 11, 2013 at 06:47:49PM +0200, Jakub Narębski wrote:\n>> W dniu 11.04.2013 05:36, Jeff King napisał:\n>>\n>>> +Note that unlike the similar setup with Apache, we can easily match the\n>>> +query string for receive-pack, catching the initial request from the\n>>> +client. This means that the server administrator does not have to worry\n>>> +about configuring `http.receivepack` for the repositories (the default\n>>> +value, which enables it only in the case of authentication, is\n>>> +sufficient).\n>>\n>> Perhaps it would be worth including for Apache2 beside basic setup that\n>> requires http.receivepack set to true, also one like for LigHTTPd, i.e.\n>>\n>> RewriteCond %{QUERY_STRING} =service=git-receive-pack [OR]\n>> RewriteCond %{REQUEST_URI} /git-receive-pack$\n>> RewriteRule (.*) $1 [E=AUTHREQUIRED:yes]\n[...]\n>> And perhaps also adding it as test...\n> \n> That was the \"I am not clever nor interested in Apache enough to figure\n> out how to do this...\" part that I wrote. I have no clue if the above\n> works, but I'd be happy if you wanted to test it out and submit it as a\n> patch on top (I think it could even replace my 1/2, as making it just\n> work is a much better solution than having to explain the extra step in\n> the documentation).\n\nI don't know if short description of `http.receivepack`, suitable for\na reference documentation, tells a new user how to configure web server\nfor pushes.\n\n\nWith `http.receivepack` unset git (git-http-backed?) will refuse\nunauthenthicated pushes but allow authenthicated ones (though it doesn't\nhandle authorization). This makes it easy to configure web server for\nfetches (read-only) access via smart HTTP (and you can make it\nbulletproof by refusing pushes at all with `http.receivepack` false,\nisn't it?).\n\nBut in this case (`http.receivepack` unset - the default) web server\nmust be configured to request authorization for both steps of push:\nrequesting references (for coming up with what\nrepositories have in common), i.e.\n\n GET ...?service=git-receive-pack\n\nand actual sending of data and updating refs...\n\n POST .../git-receive-pack\n\nthough only second part is actually writing.\n\n\nWith `http.receivepack` set to true git (git-http-backend?) allows\nanonymous pushes, and it is responsibility of web server configuration\nto deny unauthorized pushes... but it is sufficient to do it only for\nwrites i.e.\n\n POST .../git-receive-pack\n\n\n[Now to translate it to manpage or users-manual contents...]\n\nP.S. Do I understand it correctly that `http.receivepack` is\nthree-state: true (allow all), unset (allow authenthicated) and false\n(deny all)?\n\nP.P.S. It would be better to accept both patches; I don't know when\nI would be able to test Apache config; I remember that I had problems\nwith it...\n-- \nJakub Narębski\n"},{"id":"213998","messageId":"20130411193434.GE3177@sigill.intra.peff.net","threadId":"33444","inReplyTo":"CAAExw5t3rk_R1GB9OMVKjPYEMRQg1gNSUGQtEK71m1Ux01N27w@mail.gmail.com","subject":"Re: git-http-backend: anonymous read, authenticated write","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2013-04-11T19:34:34Z","receivedAt":"2013-04-11T19:34:34Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Thu, Apr 11, 2013 at 08:52:56AM +0200, Magnus Therning wrote:\n\n> > The documentation should probably make the use of http.receivepack more\n> > clear in this situation.\n> \n> I think that'd be good. The fact that it wasn't until several mails\n> into the thread that anyone thought of the http.receivepack setting\n> also suggests that its use is a bit un-intuitive (even though it\n> probably makes perfect sense and is a good solution).\n\nYeah, I did not even think of http.receivepack because I have never had\nto set it before (it was turned on in the original tests that I built\ntop of). I have the impression that the anonymous-read/authenticated-write\nsetup you are using has not been all that commonly used. The example in\nthe manpage dates back to 2009, but it was only in 2012 that we got a\nbug report that the client-side authentication handler has problems with\nit.\n\n> > So _if_ you fixed it by setting http.receivepack (which I think is the\n> > simplest thing under Apache, since matching the query string there is\n> > hard), then you would need a version of git with that fix on the\n> > client side to actually have git prompt for the password correctly.\n> \n> Ah, so *that* is the fix that has been mentioned (I haven't bothered\n> reading it myself), or are there in fact two fixes that have been\n> referred to in the thread?\n\nNo, there's only the one fix in git itself (not counting improving the\ndocumentation just now). With the Apache config given in the manual,\nclients older than git v1.7.11.7 will not properly handle the 401\nresponse they get mid-way through the push process.\n\nBut you do not have to worry about that with your configuration, as you\nprovide the 401 up-front.\n\n> > But your fix under lighttpd is much better, as it asks for the\n> > credentials up front (which means the client does not go to any work\n> > creating a packfile just to find out that it does not have access).\n> \n> Yes, I think it also helps with my particular scenario where new repos\n> will be added from time to time. This way there is no second step,\n> after `git init`, that must be remembered.\n\nYeah, avoiding setting http.receivepack at all is helpful. Though note\nthat you can also set it in /etc/gitconfig for the whole system at once.\n\n> Thank you very much for taking the time to help me out with this!\n> I'll also take a look at the patches you sent, as a dumb simpler user\n> I might have something to add, who knows?\n\nYou're welcome. I'm glad we got it resolved, and looking over the\ndocumentation patch is appreciated.\n\n-Peff\n"},{"id":"214048","messageId":"CAAExw5upfDU=U9Vntph4DECtDp_EVGps+Fgpxabaeq_c4WHqAA@mail.gmail.com","threadId":"33444","inReplyTo":"20130411193434.GE3177@sigill.intra.peff.net","subject":"Re: git-http-backend: anonymous read, authenticated write","fromName":"Magnus Therning","fromEmail":"magnus@therning.org","sentAt":"2013-04-12T07:22:36Z","receivedAt":"2013-04-12T07:22:36Z","isPatch":false,"sender":{"key":"magnus@therning.org","avatar":"https://gravatar.com/avatar/c10a263a961d4137d34ac9c7bfb03e0fa701cc0f8c6f3ab3c29df6473da383d9?d=mp&s=160"},"body":"On Thu, Apr 11, 2013 at 9:34 PM, Jeff King wrote:\n> On Thu, Apr 11, 2013 at 08:52:56AM +0200, Magnus Therning wrote:\n>\n>> > The documentation should probably make the use of http.receivepack more\n>> > clear in this situation.\n>>\n>> I think that'd be good. The fact that it wasn't until several mails\n>> into the thread that anyone thought of the http.receivepack setting\n>> also suggests that its use is a bit un-intuitive (even though it\n>> probably makes perfect sense and is a good solution).\n>\n> Yeah, I did not even think of http.receivepack because I have never had\n> to set it before (it was turned on in the original tests that I built\n> top of). I have the impression that the anonymous-read/authenticated-write\n> setup you are using has not been all that commonly used. The example in\n> the manpage dates back to 2009, but it was only in 2012 that we got a\n> bug report that the client-side authentication handler has problems with\n> it.\n\nReally? I certainly think it deserves a bit more attention than that.\n It may be that gitosis and other SSH-based solutions have been around\nlonger than git-http-backend, but from what I've understood from\nreading, it fits very nicely in between git-daemon and the rather\nheavy SSH-based stuff.\n\n>> > But your fix under lighttpd is much better, as it asks for the\n>> > credentials up front (which means the client does not go to any work\n>> > creating a packfile just to find out that it does not have access).\n>>\n>> Yes, I think it also helps with my particular scenario where new repos\n>> will be added from time to time. This way there is no second step,\n>> after `git init`, that must be remembered.\n>\n> Yeah, avoiding setting http.receivepack at all is helpful. Though note\n> that you can also set it in /etc/gitconfig for the whole system at once.\n\nGood point.\n\n/M\n\n-- \nMagnus Therning OpenPGP: 0xAB4DFBA4\nemail: magnus@therning.org jabber: magnus@therning.org\ntwitter: magthe http://therning.org/magnus\n"},{"id":"214117","messageId":"20130413033336.GA20333@sigill.intra.peff.net","threadId":"33444","inReplyTo":"20130411170233.GB1255@sigill.intra.peff.net","subject":"[PATCH 3/2] doc/http-backend: match query-string in apache half-auth example","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2013-04-13T03:33:36Z","receivedAt":"2013-04-13T03:33:36Z","isPatch":true,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"When setting up a \"half-auth\" repository in which reads can\nbe done anonymously but writes require authentication, it is\nbest if the server can require authentication for both the\nref advertisement and the actual receive-pack POSTs. This\nalleviates the need for the admin to set http.receivepack in\nthe repositories, and means that the client is challenged\nfor credentials immediately, instead of partway through the\npush process (and git clients older than v1.7.11.7 had\ntrouble handling these challenges).\n\nSince detecting a push during the ref advertisement requires\nmatching the query string, and this is non-trivial to do in\nApache, we have traditionally punted and instructed users to\njust protect \"/git-receive-pack$\". This patch provides the\nmod_rewrite recipe to actually match the ref advertisement,\nwhich is preferred.\n\nWhile we're at it, let's add the recipe to our test scripts\nso that we can be sure that it works, and doesn't get broken\n(either by our changes or by changes in Apache).\n\nSigned-off-by: Jeff King \n---\nThis is on top of the jk/doc-http-backend topic.\n\nNote that I have never used this in production, but it was pieced\ntogether from various advice I found on the web, and I did confirm that\nit works.\n\nI kind of assume mod-rewrite is everywhere these days, so we could\npotentially drop the fallback config completely, as it is likely to\nconfuse people.\n\n Documentation/git-http-backend.txt | 32 ++++++++++++++++++++++++--------\n t/lib-httpd/apache.conf | 18 ++++++++++++++++++\n t/t5541-http-push.sh | 30 ++++++++++++++++++++++++++++++\n 3 files changed, 72 insertions(+), 8 deletions(-)\n\ndiff --git a/Documentation/git-http-backend.txt b/Documentation/git-http-backend.txt\nindex cad18ce..e3bcdb5 100644\n--- a/Documentation/git-http-backend.txt\n+++ b/Documentation/git-http-backend.txt\n@@ -80,7 +80,30 @@ To enable anonymous read access but authenticated write access,\n ----------------------------------------------------------------\n +\n To enable anonymous read access but authenticated write access,\n-require authorization with a LocationMatch directive:\n+require authorization for both the initial ref advertisement (which we\n+detect as a push via the service parameter in the query string), and the\n+receive-pack invocation itself:\n++\n+----------------------------------------------------------------\n+RewriteCond %{QUERY_STRING} service=git-receive-pack [OR]\n+RewriteCond %{REQUEST_URI} /git-receive-pack$\n+RewriteRule ^/git/ - [E=AUTHREQUIRED:yes]\n+\n+\n+\tOrder Deny,Allow\n+\tDeny from env=AUTHREQUIRED\n+\n+\tAuthType Basic\n+\tAuthName \"Git Access\"\n+\tRequire group committers\n+\tSatisfy Any\n+\t...\n+\n+----------------------------------------------------------------\n++\n+If you do not have `mod_rewrite` available to match against the query\n+string, it is sufficient to just protect `git-receive-pack` itself,\n+like:\n +\n ----------------------------------------------------------------\n \n@@ -207,13 +230,6 @@ auth.require = (\n # ...and set up auth.backend here\n ----------------------------------------------------------------\n +\n-Note that unlike the similar setup with Apache, we can easily match the\n-query string for receive-pack, catching the initial request from the\n-client. This means that the server administrator does not have to worry\n-about configuring `http.receivepack` for the repositories (the default\n-value, which enables it only in the case of authentication, is\n-sufficient).\n-+\n To require authentication for both reads and writes:\n +\n ----------------------------------------------------------------\ndiff --git a/t/lib-httpd/apache.conf b/t/lib-httpd/apache.conf\nindex 938b4cf..542241b 100644\n--- a/t/lib-httpd/apache.conf\n+++ b/t/lib-httpd/apache.conf\n@@ -40,6 +40,9 @@ ErrorLog error.log\n \n \tLoadModule authz_user_module modules/mod_authz_user.so\n \n+\n+\tLoadModule authz_host_module modules/mod_authz_host.so\n+\n \n \n PassEnv GIT_VALGRIND\n@@ -110,6 +113,21 @@ SSLEngine On\n \tRequire valid-user\n \n \n+RewriteCond %{QUERY_STRING} service=git-receive-pack [OR]\n+RewriteCond %{REQUEST_URI} /git-receive-pack$\n+RewriteRule ^/half-auth-complete/ - [E=AUTHREQUIRED:yes]\n+\n+\n+ Order Deny,Allow\n+ Deny from env=AUTHREQUIRED\n+\n+ AuthType Basic\n+ AuthName \"Git Access\"\n+ AuthUserFile passwd\n+ Require valid-user\n+ Satisfy Any\n+\n+\n \n \tLoadModule dav_module modules/mod_dav.so\n \tLoadModule dav_fs_module modules/mod_dav_fs.so\ndiff --git a/t/t5541-http-push.sh b/t/t5541-http-push.sh\nindex 4086f02..beb00be 100755\n--- a/t/t5541-http-push.sh\n+++ b/t/t5541-http-push.sh\n@@ -294,5 +294,35 @@ test_expect_success 'push to auth-only-for-push repo' '\n \ttest_cmp expect actual\n '\n \n+test_expect_success 'create repo without http.receivepack set' '\n+\tcd \"$ROOT_PATH\" &&\n+\tgit init half-auth &&\n+\t(\n+\t\tcd half-auth &&\n+\t\ttest_commit one\n+\t) &&\n+\tgit clone --bare half-auth \"$HTTPD_DOCUMENT_ROOT_PATH/half-auth.git\"\n+'\n+\n+test_expect_success 'clone via half-auth-complete does not need password' '\n+\tcd \"$ROOT_PATH\" &&\n+\tset_askpass wrong &&\n+\tgit clone \"$HTTPD_URL\"/half-auth-complete/smart/half-auth.git \\\n+\t\thalf-auth-clone &&\n+\texpect_askpass none\n+'\n+\n+test_expect_success 'push into half-auth-complete requires password' '\n+\tcd \"$ROOT_PATH/half-auth-clone\" &&\n+\techo two >expect &&\n+\ttest_commit two &&\n+\tset_askpass user@host &&\n+\tgit push \"$HTTPD_URL/half-auth-complete/smart/half-auth.git\" &&\n+\tgit --git-dir=\"$HTTPD_DOCUMENT_ROOT_PATH/half-auth.git\" \\\n+\t\tlog -1 --format=%s >actual &&\n+\texpect_askpass both user@host &&\n+\ttest_cmp expect actual\n+'\n+\n stop_httpd\n test_done\n-- \n1.8.2.rc0.33.gd915649\n"},{"id":"214130","messageId":"51691CC1.9070802@gmail.com","threadId":"33444","inReplyTo":"20130413033336.GA20333@sigill.intra.peff.net","subject":"Re: [PATCH 3/2] doc/http-backend: match query-string in apache half-auth example","fromName":"Jakub Narębski","fromEmail":"jnareb@gmail.com","sentAt":"2013-04-13T08:52:17Z","receivedAt":"2013-04-13T08:52:17Z","isPatch":true,"sender":{"key":"jnareb@gmail.com","avatar":"https://avatars.githubusercontent.com/u/2706?v=4"},"body":"W dniu 13.04.2013 05:33, Jeff King pisze:\n\n> When setting up a \"half-auth\" repository in which reads can\n> be done anonymously but writes require authentication, it is\n> best if the server can require authentication for both the\n> ref advertisement and the actual receive-pack POSTs. [...]\n\nThanks for writing(and testing) this patch.\n-- \nJakub Narębski\n"}]}