Re: Subject: [PATCH] Push to create

From: Junio C Hamano <gitster@pobox.com>
Date: Mar 3, 2009, 08:22 UTC
Message-ID: <7v63irf21u.fsf@gitster.siamese.dyndns.org>
In-Reply-To: <20090303080603.GA3158@coredump.intra.peff.net>

Jeff King <peff@peff.net> writes:

Show 10 quoted lines

> On Mon, Mar 02, 2009 at 11:55:51PM -0800, Junio C Hamano wrote:
>
>> As with the previous "git init --remote" patch, my design constraints
>> includes keeping the door open for "git shell" users to optionally allow
>> this mode of operation.
>
> OK, I thought your original comment was "I don't think this constraint
> (thinking only of normal shell users) is right, but here is a patch
> anyway". Which did leave me confused, since it seemed like your patch
> did not cater just to such users. But I see now what you meant.

Yeah, I wanted to see if we can give git-shell only people a sane way to host a group project, so that was why I mentioned "chgrp/chmod" in the follow-up message to the "init --remote" series.

Show 7 quoted lines

> However, if you are thinking of "git shell" users, then is it not a
> potential security problem to allow them to create new repositories
> without the admin explicitly enabling it? If a site is depending on
> hooks in existing repositories to implement some kind of policy, then
> isn't this a way to bypass it (not to make changes in those existing
> repos, obviously, but let's say there is a policy about how disk usage
> is counted).

Yes and no. I think "git shell" sites fall broadly into two categories. The ones arranged ala gitosis without per-user UNIX account, it certainly is an issue. The ones with per-user UNIX account would not let anywhere other than $HOME written, so it is not.

My sole interest lies in building a track record of suggested patches to eliminate the excuse people would use to complain that we do not attempt to allow repositories to be created remotely. I've shown two possible ways. It now is turn for those who want to have the feature to fill in the details. These are weatherbaloon patches, and it is not my itch to scratch anyway.

Show 8 quoted lines

> Even if it isn't a security issue, it might simply be broken. Shawn has
> said that Gerrit needs extra magic when creating a repository, and I
> wouldn't be surprised if github and repo.or.cz were the same. With your
> patch, what switch should a Gerrit admin flip to prevent people from
> creating broken repos?
>
> What about places that might simply want to put some policy in place,
> like kernel.org having all linux repos point to Linus as alternates?

These are all valid points and people who are interested in creating repositories remotely must think about them when they finally decide to scratch their own itch. I am merely helping by showing where to add hooks.