{"thread":{"id":"38375","subject":"Advise on a push only repo","startedAt":"2015-01-15T18:02:19Z","lastAt":"2015-01-15T22:24:28Z","messageCount":4,"participants":["Jason Pyeron","Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"254762","messageId":"9782FD24F9FA45659CCE5171E73E49E7@black","threadId":"38375","inReplyTo":null,"subject":"Advise on a push only repo","fromName":"Jason Pyeron","fromEmail":"jpyeron@pdinc.us","sentAt":"2015-01-15T18:02:19Z","receivedAt":"2015-01-15T18:02:19Z","isPatch":false,"sender":{"key":"jpyeron@pdinc.us","avatar":"https://gravatar.com/avatar/c2e53452caa53d940768a1ffc9cf76196d851b9b534b7a39cd39852a70a0508f?d=mp&s=160"},"body":"I am setting up a continous integration (CI) system for an open source project and I want to allow forking developers to use the system, but I do not want anyone to do a clone or fetch from the CI git repo, the repo.\n\nAny advice on limiting the https smart protocol to push only, blocking clone and fetch?\n\nLooking at http-backend.c\n   542  static struct service_cmd {\n   543          const char *method;\n   544          const char *pattern;\n   545          void (*imp)(char *);\n   546  } services[] = {\n   547          {\"GET\", \"/HEAD$\", get_head},\n   548          {\"GET\", \"/info/refs$\", get_info_refs},\n   549          {\"GET\", \"/objects/info/alternates$\", get_text_file},\n   550          {\"GET\", \"/objects/info/http-alternates$\", get_text_file},\n   551          {\"GET\", \"/objects/info/packs$\", get_info_packs},\n   552          {\"GET\", \"/objects/[0-9a-f]{2}/[0-9a-f]{38}$\", get_loose_object},\n   553          {\"GET\", \"/objects/pack/pack-[0-9a-f]{40}\\\\.pack$\", get_pack_file},\n   554          {\"GET\", \"/objects/pack/pack-[0-9a-f]{40}\\\\.idx$\", get_idx_file},\n   555\n   556          {\"POST\", \"/git-upload-pack$\", service_rpc},\n   557          {\"POST\", \"/git-receive-pack$\", service_rpc}\n   558  };\n\n\nI feel I could just filter /git-receive-pack and /objects/ .\n\nI am going to build my test system now.\n\n--\n-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\n-                                                               -\n- Jason Pyeron                      PD Inc. http://www.pdinc.us -\n- Principal Consultant              10 West 24th Street #100    -\n- +1 (443) 269-1555 x333            Baltimore, Maryland 21218   -\n-                                                               -\n-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\nThis message is copyright PD Inc, subject to license 20080407P00.\n"},{"id":"254770","messageId":"xmqqa91j7sej.fsf@gitster.dls.corp.google.com","threadId":"38375","inReplyTo":"9782FD24F9FA45659CCE5171E73E49E7@black","subject":"Re: Advise on a push only repo","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2015-01-15T19:31:00Z","receivedAt":"2015-01-15T19:31:00Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"\"Jason Pyeron\" <jpyeron@pdinc.us> writes:\n\n> I am setting up a continous integration (CI) system for an open source\n> project and I want to allow forking developers to use the system, but\n> I do not want anyone to do a clone or fetch from the CI git repo, the\n> repo.\n>\n> Any advice on limiting the https smart protocol to push only, blocking clone and fetch?\n>\n> Looking at http-backend.c\n>    542  static struct service_cmd {\n> ...\n>    558  };\n\nLooking at http-backend.c\n\n     19 struct rpc_service {\n     20         const char *name;\n     21         const char *config_name;\n     22         signed enabled : 2;\n     23 };\n     24 \n     25 static struct rpc_service rpc_service[] = {\n     26         { \"upload-pack\", \"uploadpack\", 1 },\n     27         { \"receive-pack\", \"receivepack\", -1 },\n     28 };\n\nSo it would be natural to assume that there must be a way to\nenable/disable these two services, no?\n\nLooking at http_config() there, I would guess perhaps:\n\n    [http]\n        uploadpack = false\n        getanyfile = false\n\nbut I am not sure if the latter is needed (or anybody seriously\ntested it, for that matter).\n"},{"id":"254777","messageId":"4C328D132E8343F395AA9A72CC3BD4C1@black","threadId":"38375","inReplyTo":"xmqqa91j7sej.fsf@gitster.dls.corp.google.com","subject":"RE: Advise on a push only repo","fromName":"Jason Pyeron","fromEmail":"jpyeron@pdinc.us","sentAt":"2015-01-15T22:13:27Z","receivedAt":"2015-01-15T22:13:27Z","isPatch":false,"sender":{"key":"jpyeron@pdinc.us","avatar":"https://gravatar.com/avatar/c2e53452caa53d940768a1ffc9cf76196d851b9b534b7a39cd39852a70a0508f?d=mp&s=160"},"body":"> -----Original Message-----\n> From: Junio C Hamano\n> Sent: Thursday, January 15, 2015 14:31\n> \n> \"Jason Pyeron\" <jpyeron@pdinc.us> writes:\n> \n> > I am setting up a continous integration (CI) system for an \n> open source\n> > project and I want to allow forking developers to use the \n> system, but\n> > I do not want anyone to do a clone or fetch from the CI git \n> repo, the\n> > repo.\n> >\n> > Any advice on limiting the https smart protocol to push \n> only, blocking clone and fetch?\n> >\n> > Looking at http-backend.c\n> >    542  static struct service_cmd {\n> > ...\n> >    558  };\n> \n> Looking at http-backend.c\n> \n>      19 struct rpc_service {\n>      20         const char *name;\n>      21         const char *config_name;\n>      22         signed enabled : 2;\n>      23 };\n>      24 \n>      25 static struct rpc_service rpc_service[] = {\n>      26         { \"upload-pack\", \"uploadpack\", 1 },\n>      27         { \"receive-pack\", \"receivepack\", -1 },\n>      28 };\n> \n> So it would be natural to assume that there must be a way to\n> enable/disable these two services, no?\n> \n> Looking at http_config() there, I would guess perhaps:\n> \n>     [http]\n>         uploadpack = false\n>         getanyfile = false\n> \n> but I am not sure if the latter is needed (or anybody seriously\n> tested it, for that matter).\n\nPerfect! Had to add receivepack=true for the anonymous part.\n\nroot@twenty-one-100 /opt/git/public\n# cat /etc/httpd/conf.d/git.conf\nSetEnv GIT_PROJECT_ROOT /opt/git\nSetEnv GIT_HTTP_EXPORT_ALL\nScriptAlias /git/ /usr/libexec/git-core/git-http-backend/\n<Directory \"/usr/lib/git-core*\">\n   Options ExecCGI Indexes\n   Order allow,deny\n   Allow from all\n   Require all granted\n</Directory>\n\nroot@twenty-one-100 /opt/git/public\n# cat /opt/git/public/config\n[core]\n        repositoryformatversion = 0\n        filemode = true\n        bare = true\n[http]\n        receivepack = true\n        uploadpack = false\n        getanyfile = false\n\nTest get known object...\n\nroot@twenty-one-100 /opt/git/public\n# dir objects/bd/e1557acecaf3cebb4775b7b734f095e6010c15\n-r--r--r--. 1 apache apache 163 Jan 15 16:56 objects/bd/e1557acecaf3cebb4775b7b734f095e6010c15\n\nroot@twenty-one-100 /opt/git/public\n# curl http://127.0.0.1/git/public/objects/bd/e1557acecaf3cebb4775b7b734f095e6010c15 -v\n* About to connect() to 127.0.0.1 port 80 (#0)\n*   Trying 127.0.0.1... connected\n* Connected to 127.0.0.1 (127.0.0.1) port 80 (#0)\n> GET /git/public/objects/bd/e1557acecaf3cebb4775b7b734f095e6010c15 HTTP/1.1\n> User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.16.2.3 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2\n> Host: 127.0.0.1\n> Accept: */*\n>\n< HTTP/1.1 403 Forbidden\n< Date: Thu, 15 Jan 2015 22:08:48 GMT\n< Server: Apache/2.2.15 (CentOS)\n< Expires: Fri, 01 Jan 1980 00:00:00 GMT\n< Pragma: no-cache\n< Cache-Control: no-cache, max-age=0, must-revalidate\n< Content-Length: 0\n< Connection: close\n< Content-Type: text/plain; charset=UTF-8\n<\n* Closing connection #0\n\nroot@twenty-one-100 /opt/git/public\n# fg\ntail -f /var/log/httpd/*_log    (wd: /opt/git)\n\n==> /var/log/httpd/error_log <==\n[Thu Jan 15 17:08:48 2015] [error] [client 127.0.0.1] Unsupported service: getanyfile\n\n==> /var/log/httpd/access_log <==\n127.0.0.1 - - [15/Jan/2015:17:08:48 -0500] \"GET /git/public/objects/bd/e1557acecaf3cebb4775b7b734f095e6010c15 HTTP/1.1\" 403 - \"-\" \"curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.16.2.3 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2\"\n^Z\n[1]+  Stopped                 tail -f /var/log/httpd/*_log  (wd: /opt/git)\n(wd now: /opt/git/public)\n\nroot@twenty-one-100 /opt/git/public\n#\n\n\n--\n-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\n-                                                               -\n- Jason Pyeron                      PD Inc. http://www.pdinc.us -\n- Principal Consultant              10 West 24th Street #100    -\n- +1 (443) 269-1555 x333            Baltimore, Maryland 21218   -\n-                                                               -\n-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\nThis message is copyright PD Inc, subject to license 20080407P00. \n"},{"id":"254778","messageId":"xmqqegqv65sz.fsf@gitster.dls.corp.google.com","threadId":"38375","inReplyTo":"4C328D132E8343F395AA9A72CC3BD4C1@black","subject":"Re: Advise on a push only repo","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2015-01-15T22:24:28Z","receivedAt":"2015-01-15T22:24:28Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"\"Jason Pyeron\" <jpyeron@pdinc.us> writes:\n\n>> Looking at http_config() there, I would guess perhaps:\n>> \n>>     [http]\n>>         uploadpack = false\n>>         getanyfile = false\n>> \n>> but I am not sure if the latter is needed (or anybody seriously\n>> tested it, for that matter).\n>\n> Perfect! Had to add receivepack=true for the anonymous part.\n\nGood.\n"}]}