threads / discuss / 16457

How to hide a git repository?

Subject: How to hide a git repository?

## tl;dr

13 messages between Nov 25, 2008 and Nov 25, 2008.

replies: 12people: 8as markdown or json

Gary Yang· Nov 25, 2008, 00:32 UTC · lore
We have two repositories, one is /pub/git/dev/linux/kernel, another is /pub/git/pub/linux/kernel. The /pub/git/pub/linux/kernel is open to public for people to download released code. /pub/git/dev/linux/kernel is used for our development. We would like to hide /pub/git/dev/linux/kernel from public. How to do it?

Why we want to hide /pub/git/dev/linux/kernel from public? We work on our development at /pub/git/dev/linux/kernel. We push our released code to /pub/git/pub/linux/kernel from /pub/git/dev/linux/kernel once we completed our development. We do not want people to download code from /pub/git/dev/linux/kernel since it is not stable.
Heikki Orsila· Nov 25, 2008, 00:37 UTC · re: Gary Yang · lore

Re: How to hide a git repository?

On Mon, Nov 24, 2008 at 04:32:58PM -0800, Gary Yang wrote:
Show 6 quoted lines
> 
> We have two repositories, one is /pub/git/dev/linux/kernel, another 
> is /pub/git/pub/linux/kernel. The /pub/git/pub/linux/kernel is open to 
> public for people to download released code. /pub/git/dev/linux/kernel 
> is used for our development. We would like to hide 
> /pub/git/dev/linux/kernel from public. How to do it?
Tell "git daemon" only to publish /pub/git/pub/linux/kernel.
-- 
Heikki Orsila
heikki.orsila@iki.fi
http://www.iki.fi/shd
Gary Yang· Nov 25, 2008, 01:40 UTC · re: Heikki Orsila · lore

Re: How to hide a git repository?

How to tell "git daemon" only to publish /pub/git/pub/linux/kernel ?
--- On Mon, 11/24/08, Heikki Orsila <shdl@zakalwe.fi> wrote:
Show 29 quoted lines
> From: Heikki Orsila <shdl@zakalwe.fi>
> Subject: Re: How to hide a git repository?
> To: "Gary Yang" <garyyang6@yahoo.com>
> Cc: git@vger.kernel.org
> Date: Monday, November 24, 2008, 4:37 PM
> On Mon, Nov 24, 2008 at 04:32:58PM -0800, Gary Yang wrote:
> > 
> > We have two repositories, one is
> /pub/git/dev/linux/kernel, another 
> > is /pub/git/pub/linux/kernel. The
> /pub/git/pub/linux/kernel is open to 
> > public for people to download released code.
> /pub/git/dev/linux/kernel 
> > is used for our development. We would like to hide 
> > /pub/git/dev/linux/kernel from public. How to do it?
> 
> Tell "git daemon" only to publish
> /pub/git/pub/linux/kernel.
> 
> -- 
> Heikki Orsila
> heikki.orsila@iki.fi
> http://www.iki.fi/shd
> --
> To unsubscribe from this list: send the line
> "unsubscribe git" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at 
> http://vger.kernel.org/majordomo-info.html
Bruno Cesar Ribas· Nov 25, 2008, 03:58 UTC · re: Gary Yang · lore

Re: How to hide a git repository?

On Mon, Nov 24, 2008 at 05:40:22PM -0800, Gary Yang wrote:
> How to tell "git daemon" only to publish /pub/git/pub/linux/kernel ?
$ man git-daemon
<snip>
It verifies that the directory has the magic file
       "git-daemon-export-ok", and it will refuse to export any git directory
       that hasn´t explicitly been marked for export this way (unless the
       --export-all parameter is specified). If you pass some directory paths
       as git-daemon arguments, you can further restrict the offers to a
       whitelist comprising of those.
</snip>
Hope this helps
Show 40 quoted lines
> 
> 
> --- On Mon, 11/24/08, Heikki Orsila <shdl@zakalwe.fi> wrote:
> 
> > From: Heikki Orsila <shdl@zakalwe.fi>
> > Subject: Re: How to hide a git repository?
> > To: "Gary Yang" <garyyang6@yahoo.com>
> > Cc: git@vger.kernel.org
> > Date: Monday, November 24, 2008, 4:37 PM
> > On Mon, Nov 24, 2008 at 04:32:58PM -0800, Gary Yang wrote:
> > > 
> > > We have two repositories, one is
> > /pub/git/dev/linux/kernel, another 
> > > is /pub/git/pub/linux/kernel. The
> > /pub/git/pub/linux/kernel is open to 
> > > public for people to download released code.
> > /pub/git/dev/linux/kernel 
> > > is used for our development. We would like to hide 
> > > /pub/git/dev/linux/kernel from public. How to do it?
> > 
> > Tell "git daemon" only to publish
> > /pub/git/pub/linux/kernel.
> > 
> > -- 
> > Heikki Orsila
> > heikki.orsila@iki.fi
> > http://www.iki.fi/shd
> > --
> > To unsubscribe from this list: send the line
> > "unsubscribe git" in
> > the body of a message to majordomo@vger.kernel.org
> > More majordomo info at 
> > http://vger.kernel.org/majordomo-info.html
> 
> 
>       
> --
> To unsubscribe from this list: send the line "unsubscribe git" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
-- 
Bruno Ribas - ribas@c3sl.ufpr.br
http://www.inf.ufpr.br/ribas
C3SL: http://www.c3sl.ufpr.br
Gary Yang· Nov 25, 2008, 02:16 UTC · re: Gary Yang · lore

Re: How to hide a git repository?

Do I have to create two git servers? One is for public to download the released code. For example: gitpub.mycompany.com:/pub/linux/kernel. gitpub.mycompany.com is accessible to public. Another is for internal development. For example: gitdev.mycompany.com:/dev/linux/kernel. gitdev.mycompany.com is only accessible to our development team. I push code from gitdev.mycompany.com:/dev/linux/kernel to gitpub.mycompany.com:/publinux/kernel once we completed our development. Is this the only way to do it? 
--- On Mon, 11/24/08, Gary Yang <garyyang6@yahoo.com> wrote:
Show 30 quoted lines
> From: Gary Yang <garyyang6@yahoo.com>
> Subject: How to hide a git repository?
> To: git@vger.kernel.org
> Date: Monday, November 24, 2008, 4:32 PM
> We have two repositories, one is /pub/git/dev/linux/kernel,
> another is /pub/git/pub/linux/kernel. The
> /pub/git/pub/linux/kernel is open to public for people to
> download released code. /pub/git/dev/linux/kernel is used
> for our development. We would like to hide
> /pub/git/dev/linux/kernel from public. How to do it?
> 
> Why we want to hide /pub/git/dev/linux/kernel from public?
> We work on our development at /pub/git/dev/linux/kernel. We
> push our released code to /pub/git/pub/linux/kernel from
> /pub/git/dev/linux/kernel once we completed our development.
>  We do not want people to download code from
> /pub/git/dev/linux/kernel since it is not stable.  
> 
> 
> 
> 
> 
> 
>       
> --
> To unsubscribe from this list: send the line
> "unsubscribe git" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at 
> http://vger.kernel.org/majordomo-info.html
Nicolas Morey-Chaisemartin· Nov 25, 2008, 06:15 UTC · re: Gary Yang · lore

Re: How to hide a git repository?

I guess you could export the public one through git daemon and/or your web server, and access your private tree through SSH. This way you ensure only authentificated people will be able to clone your private tree.

--- Nicolas Morey-Chaisemartin

Gary Yang a écrit :
Show 47 quoted lines
> Do I have to create two git servers? One is for public to download the released code. For example: gitpub.mycompany.com:/pub/linux/kernel. gitpub.mycompany.com is accessible to public. Another is for internal development. For example: gitdev.mycompany.com:/dev/linux/kernel. gitdev.mycompany.com is only accessible to our development team. I push code from gitdev.mycompany.com:/dev/linux/kernel to gitpub.mycompany.com:/publinux/kernel once we completed our development. Is this the only way to do it? 
>
>
> --- On Mon, 11/24/08, Gary Yang <garyyang6@yahoo.com> wrote:
>
>   
>> From: Gary Yang <garyyang6@yahoo.com>
>> Subject: How to hide a git repository?
>> To: git@vger.kernel.org
>> Date: Monday, November 24, 2008, 4:32 PM
>> We have two repositories, one is /pub/git/dev/linux/kernel,
>> another is /pub/git/pub/linux/kernel. The
>> /pub/git/pub/linux/kernel is open to public for people to
>> download released code. /pub/git/dev/linux/kernel is used
>> for our development. We would like to hide
>> /pub/git/dev/linux/kernel from public. How to do it?
>>
>> Why we want to hide /pub/git/dev/linux/kernel from public?
>> We work on our development at /pub/git/dev/linux/kernel. We
>> push our released code to /pub/git/pub/linux/kernel from
>> /pub/git/dev/linux/kernel once we completed our development.
>>  We do not want people to download code from
>> /pub/git/dev/linux/kernel since it is not stable.  
>>
>>
>>
>>
>>
>>
>>       
>> --
>> To unsubscribe from this list: send the line
>> "unsubscribe git" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at 
>> http://vger.kernel.org/majordomo-info.html
>>     
>
>
>       
> --
> To unsubscribe from this list: send the line "unsubscribe git" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>
>
>
Daniel Barkalow· Nov 25, 2008, 18:38 UTC · re: Gary Yang · lore

Re: How to hide a git repository?

On Mon, 24 Nov 2008, Gary Yang wrote:
> Do I have to create two git servers? One is for public to download the 
> released code. For example: gitpub.mycompany.com:/pub/linux/kernel.

The public can't generally use this URL, because it's an ssh URL, and they won't be able to connect with ssh. They can only really use git://gitpub.mycompany.com/pub/linux/kernel or something similar.

The normal pattern is to have R/W access with ssh and anonymous read access via git://...; you can then have multiple repositories on the same host, with the git server only serving the public one. All of them will be accessible to the ssh methods (restricted by the user's UNIX permissions on the files in those directories).

	-Daniel
*This .sig left intentionally blank*
Thomas Koch· Nov 25, 2008, 19:01 UTC · re: Daniel Barkalow · lore

Re: How to hide a git repository?

Am Tuesday 25 November 2008 19:38:02 schrieb Daniel Barkalow:
Show 17 quoted lines
> On Mon, 24 Nov 2008, Gary Yang wrote:
> > Do I have to create two git servers? One is for public to download the
> > released code. For example: gitpub.mycompany.com:/pub/linux/kernel.
>
> The public can't generally use this URL, because it's an ssh URL, and they
> won't be able to connect with ssh. They can only really use
> git://gitpub.mycompany.com/pub/linux/kernel or something similar.
>
> The normal pattern is to have R/W access with ssh and anonymous read
> access via git://...; you can then have multiple repositories on the same
> host, with the git server only serving the public one. All of them will be
> accessible to the ssh methods (restricted by the user's UNIX permissions
> on the files in those directories).
>
> 	-Daniel
> *This .sig left intentionally blank*
> --

Do you now of a way to show public repos with gitweb to the public and private repos to the staff with the same gitweb installation?

Best regards,
-- 
Thomas Koch, Software Developer
http://www.koch.ro

Young Media Concepts GmbH
Sonnenstr. 4
CH-8280 Kreuzlingen
Switzerland

Tel    +41 (0)71 / 508 24 86
Fax    +41 (0)71 / 560 53 89
Mobile +49 (0)170 / 753 89 16
Web    www.ymc.ch
Daniel Barkalow· Nov 25, 2008, 19:08 UTC · re: Thomas Koch · lore

Re: How to hide a git repository?

On Tue, 25 Nov 2008, Thomas Koch wrote:
> Do you now of a way to show public repos with gitweb to the public and
> private repos to the staff with the same gitweb installation?

I don't really know much about gitweb, but I'd expect that you can have the same physical machine, the same gitweb executable, the same apache, different virtual hosts, and different configurations for each virtual host. Without having different URLs in some way, there's no way for the system to cause web browsers of staff members to authenticate themselves in order to reveal the private repos.

	-Daniel
*This .sig left intentionally blank*
Jakub Narebski· Nov 25, 2008, 20:10 UTC · re: Thomas Koch · lore

Re: How to hide a git repository?

Thomas Koch <thomas@koch.ro> writes:
> Am Tuesday 25 November 2008 19:38:02 schrieb Daniel Barkalow:
> > On Mon, 24 Nov 2008, Gary Yang wrote:
Show 12 quoted lines
> > > Do I have to create two git servers? One is for public to download the
> > > released code. For example: gitpub.mycompany.com:/pub/linux/kernel.
> >
> > The public can't generally use this URL, because it's an ssh URL, and they
> > won't be able to connect with ssh. They can only really use
> > git://gitpub.mycompany.com/pub/linux/kernel or something similar.
> >
> > The normal pattern is to have R/W access with ssh and anonymous read
> > access via git://...; you can then have multiple repositories on the same
> > host, with the git server only serving the public one. All of them will be
> > accessible to the ssh methods (restricted by the user's UNIX permissions
> > on the files in those directories).

To control access via SSH protocol (which can be used both for fetching and for pushing), you can either configure accounts and user/groups permissions on repository directories, or you can use external tool like ssh_acl or Gitosis.

To control access via HTTP you can employ authorization and authentication from your web server; for push this would be matter of setting up WebDAV.

To control access via anonymous git:// protocol, you can use whitelist and blacklist mechanism built in git-daemon; by default only repositories with git-daemon-export-ok in them (in .git) are exported, if I understand correctly.

Additionally, if protocol is authenticated you can use hooks mechanism like example contrib/hooks/update-paranoid to restrict access (and with finer granularity too).

> Do you now of a way to show public repos with gitweb to the public and
> private repos to the staff with the same gitweb installation?

You can quite simply restrict access to some directories/repositories, or the fact that they are listed in list of all projects for _all_ clients quite easily (see description of GITWEB_EXPORT_OK in gitweb/README and gitweb/INSTALL).

If you have something more fancy, check out newest gitweb and take a
look at gitweb/INSTALL: you can now, thanks to commit dd7f5f1 by
Alexander Gavrilov, see
  http://permalink.gmane.org/gmane.comp.version-control.git/99962
HTH
-- 
Jakub Narebski
Poland
ShadeHawk on #git
Junio C Hamano· Nov 25, 2008, 21:03 UTC · re: Jakub Narebski · lore

Re: How to hide a git repository?

Jakub Narebski <jnareb@gmail.com> writes:
> If you have something more fancy, check out newest gitweb and take a
> look at gitweb/INSTALL: you can now, thanks to commit dd7f5f1 by
> Alexander Gavrilov, see
>   http://permalink.gmane.org/gmane.comp.version-control.git/99962
Somehow I had an impression that you weren't enthused about that patch.
Jakub Narebski· Nov 25, 2008, 21:19 UTC · re: Junio C Hamano · lore

Re: How to hide a git repository?

On Tue, 25 Nov 2008, Junio C Hamano wrote:
Show 9 quoted lines
> Jakub Narebski <jnareb@gmail.com> writes:
> 
> > If you have something more fancy, check out newest gitweb and take a
> > look at gitweb/INSTALL: you can now, thanks to commit dd7f5f1 by
> > Alexander Gavrilov, see
> >   http://permalink.gmane.org/gmane.comp.version-control.git/99962
> 
> Somehow I had an impression that you weren't enthused about that
> patch.

I didn't like original version, but quite like the one that got in git.git: very flexible and nonintrusive. I have acked it, haven't I?

-- 
Jakub Narebski
Poland
Junio C Hamano· Nov 25, 2008, 21:46 UTC · re: Jakub Narebski · lore

Re: How to hide a git repository?

Jakub Narebski <jnareb@gmail.com> writes:
Show 13 quoted lines
> On Tue, 25 Nov 2008, Junio C Hamano wrote:
>> Jakub Narebski <jnareb@gmail.com> writes:
>> 
>> > If you have something more fancy, check out newest gitweb and take a
>> > look at gitweb/INSTALL: you can now, thanks to commit dd7f5f1 by
>> > Alexander Gavrilov, see
>> >   http://permalink.gmane.org/gmane.comp.version-control.git/99962
>> 
>> Somehow I had an impression that you weren't enthused about that
>> patch. 
>
> I didn't like original version, but quite like the one that got in 
> git.git: very flexible and nonintrusive. I have acked it, haven't I?
Yeah, indeed you did.  Thanks.

← back to recent threads