Re: git-http-backend: anonymous read, authenticated write

From: Jeff King <peff@peff.net>
Date: Apr 10, 2013, 21:53 UTC
Message-ID: <20130410215346.GB6215@sigill.intra.peff.net>
In-Reply-To: <20130410204544.GA2472@mteis.lan>

On Wed, Apr 10, 2013 at 10:45:44PM +0200, Magnus Therning wrote:

Show 15 quoted lines

> I was putting together a *long* response, with my different
> configurations when it suddenly hit me how to make it work.
> 
> So, this is the accesslog for a successful `git push`:
> 
> 192.168.1.84 tracsrv.local - [10/Apr/2013:22:24:59 +0200] "GET /git/foo.git/info/refs?service=git-receive-pack HTTP/1.1" 401 351 "-" "git/1.8.2.1"
> 192.168.1.84 tracsrv.local - [10/Apr/2013:22:24:59 +0200] "GET /git/foo.git/info/refs?service=git-receive-pack HTTP/1.1" 401 351 "-" "git/1.8.2.1"
> 192.168.1.84 tracsrv.local magnus [10/Apr/2013:22:25:04 +0200] "GET /git/foo.git/info/refs?service=git-receive-pack HTTP/1.1" 200 202 "-" "git/1.8.2.1"
> 192.168.1.84 tracsrv.local magnus [10/Apr/2013:22:25:09 +0200] "POST /git/foo.git/git-receive-pack HTTP/1.1" 200 73 "-" "git/1.8.2.1"
> 
> That is, *both* the GET and POST queries require a valid username
> (trying to push without a valid user will fail with a 403 already on
> the GET query).  Maybe Apache 2.x simply behaves *very* differently
> from lighttpd, but I still can't see how a rule to require a valid
> user only on the POST can ever work.

Right. But that is not configured at all by the apache config shown in the manpage:

               <LocationMatch "^/git/.*/git-receive-pack$">
                       AuthType Basic
                       AuthName "Git Access"
                       Require group committers
                       ...
               </LocationMatch>

which should not match on the info/refs request at all. That is why I suspect there is something else wrong in your lighttpd config, or something wrong in the conversion of the apache config to lighttpd.

Anyway, it sounds like you found a working config.

-Peff