# Advise on a push only repo 4 messages from 2015-01-15 to 2015-01-15. Participants: Jason Pyeron, Junio C Hamano. Thread: https://gitlist.dev/t/38375 ## Jason Pyeron, 2015-01-15 18:02 Subject: Advise on a push only repo Message-ID: <9782FD24F9FA45659CCE5171E73E49E7@black> URL: https://gitlist.dev/e/9782FD24F9FA45659CCE5171E73E49E7%40black ``` I am setting up a continous integration (CI) system for an open source project and I want to allow forking developers to use the system, but I do not want anyone to do a clone or fetch from the CI git repo, the repo. Any advice on limiting the https smart protocol to push only, blocking clone and fetch? Looking at http-backend.c 542 static struct service_cmd { 543 const char *method; 544 const char *pattern; 545 void (*imp)(char *); 546 } services[] = { 547 {"GET", "/HEAD$", get_head}, 548 {"GET", "/info/refs$", get_info_refs}, 549 {"GET", "/objects/info/alternates$", get_text_file}, 550 {"GET", "/objects/info/http-alternates$", get_text_file}, 551 {"GET", "/objects/info/packs$", get_info_packs}, 552 {"GET", "/objects/[0-9a-f]{2}/[0-9a-f]{38}$", get_loose_object}, 553 {"GET", "/objects/pack/pack-[0-9a-f]{40}\\.pack$", get_pack_file}, 554 {"GET", "/objects/pack/pack-[0-9a-f]{40}\\.idx$", get_idx_file}, 555 556 {"POST", "/git-upload-pack$", service_rpc}, 557 {"POST", "/git-receive-pack$", service_rpc} 558 }; I feel I could just filter /git-receive-pack and /objects/ . I am going to build my test system now. -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- - - - Jason Pyeron PD Inc. http://www.pdinc.us - - Principal Consultant 10 West 24th Street #100 - - +1 (443) 269-1555 x333 Baltimore, Maryland 21218 - - - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- This message is copyright PD Inc, subject to license 20080407P00. ``` ## Junio C Hamano, 2015-01-15 19:31 Subject: Re: Advise on a push only repo Message-ID: URL: https://gitlist.dev/e/xmqqa91j7sej.fsf%40gitster.dls.corp.google.com In-Reply-To: <9782FD24F9FA45659CCE5171E73E49E7@black> ``` "Jason Pyeron" writes: > I am setting up a continous integration (CI) system for an open source > project and I want to allow forking developers to use the system, but > I do not want anyone to do a clone or fetch from the CI git repo, the > repo. > > Any advice on limiting the https smart protocol to push only, blocking clone and fetch? > > Looking at http-backend.c > 542 static struct service_cmd { > ... > 558 }; Looking at http-backend.c 19 struct rpc_service { 20 const char *name; 21 const char *config_name; 22 signed enabled : 2; 23 }; 24 25 static struct rpc_service rpc_service[] = { 26 { "upload-pack", "uploadpack", 1 }, 27 { "receive-pack", "receivepack", -1 }, 28 }; So it would be natural to assume that there must be a way to enable/disable these two services, no? Looking at http_config() there, I would guess perhaps: [http] uploadpack = false getanyfile = false but I am not sure if the latter is needed (or anybody seriously tested it, for that matter). ``` ## Jason Pyeron, 2015-01-15 22:13 Subject: RE: Advise on a push only repo Message-ID: <4C328D132E8343F395AA9A72CC3BD4C1@black> URL: https://gitlist.dev/e/4C328D132E8343F395AA9A72CC3BD4C1%40black In-Reply-To: ``` > -----Original Message----- > From: Junio C Hamano > Sent: Thursday, January 15, 2015 14:31 > > "Jason Pyeron" writes: > > > I am setting up a continous integration (CI) system for an > open source > > project and I want to allow forking developers to use the > system, but > > I do not want anyone to do a clone or fetch from the CI git > repo, the > > repo. > > > > Any advice on limiting the https smart protocol to push > only, blocking clone and fetch? > > > > Looking at http-backend.c > > 542 static struct service_cmd { > > ... > > 558 }; > > Looking at http-backend.c > > 19 struct rpc_service { > 20 const char *name; > 21 const char *config_name; > 22 signed enabled : 2; > 23 }; > 24 > 25 static struct rpc_service rpc_service[] = { > 26 { "upload-pack", "uploadpack", 1 }, > 27 { "receive-pack", "receivepack", -1 }, > 28 }; > > So it would be natural to assume that there must be a way to > enable/disable these two services, no? > > Looking at http_config() there, I would guess perhaps: > > [http] > uploadpack = false > getanyfile = false > > but I am not sure if the latter is needed (or anybody seriously > tested it, for that matter). Perfect! Had to add receivepack=true for the anonymous part. root@twenty-one-100 /opt/git/public # cat /etc/httpd/conf.d/git.conf SetEnv GIT_PROJECT_ROOT /opt/git SetEnv GIT_HTTP_EXPORT_ALL ScriptAlias /git/ /usr/libexec/git-core/git-http-backend/ Options ExecCGI Indexes Order allow,deny Allow from all Require all granted root@twenty-one-100 /opt/git/public # cat /opt/git/public/config [core] repositoryformatversion = 0 filemode = true bare = true [http] receivepack = true uploadpack = false getanyfile = false Test get known object... root@twenty-one-100 /opt/git/public # dir objects/bd/e1557acecaf3cebb4775b7b734f095e6010c15 -r--r--r--. 1 apache apache 163 Jan 15 16:56 objects/bd/e1557acecaf3cebb4775b7b734f095e6010c15 root@twenty-one-100 /opt/git/public # curl http://127.0.0.1/git/public/objects/bd/e1557acecaf3cebb4775b7b734f095e6010c15 -v * About to connect() to 127.0.0.1 port 80 (#0) * Trying 127.0.0.1... connected * Connected to 127.0.0.1 (127.0.0.1) port 80 (#0) > GET /git/public/objects/bd/e1557acecaf3cebb4775b7b734f095e6010c15 HTTP/1.1 > User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.16.2.3 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2 > Host: 127.0.0.1 > Accept: */* > < HTTP/1.1 403 Forbidden < Date: Thu, 15 Jan 2015 22:08:48 GMT < Server: Apache/2.2.15 (CentOS) < Expires: Fri, 01 Jan 1980 00:00:00 GMT < Pragma: no-cache < Cache-Control: no-cache, max-age=0, must-revalidate < Content-Length: 0 < Connection: close < Content-Type: text/plain; charset=UTF-8 < * Closing connection #0 root@twenty-one-100 /opt/git/public # fg tail -f /var/log/httpd/*_log (wd: /opt/git) ==> /var/log/httpd/error_log <== [Thu Jan 15 17:08:48 2015] [error] [client 127.0.0.1] Unsupported service: getanyfile ==> /var/log/httpd/access_log <== 127.0.0.1 - - [15/Jan/2015:17:08:48 -0500] "GET /git/public/objects/bd/e1557acecaf3cebb4775b7b734f095e6010c15 HTTP/1.1" 403 - "-" "curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.16.2.3 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2" ^Z [1]+ Stopped tail -f /var/log/httpd/*_log (wd: /opt/git) (wd now: /opt/git/public) root@twenty-one-100 /opt/git/public # -- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- - - - Jason Pyeron PD Inc. http://www.pdinc.us - - Principal Consultant 10 West 24th Street #100 - - +1 (443) 269-1555 x333 Baltimore, Maryland 21218 - - - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- This message is copyright PD Inc, subject to license 20080407P00. ``` ## Junio C Hamano, 2015-01-15 22:24 Subject: Re: Advise on a push only repo Message-ID: URL: https://gitlist.dev/e/xmqqegqv65sz.fsf%40gitster.dls.corp.google.com In-Reply-To: <4C328D132E8343F395AA9A72CC3BD4C1@black> ``` "Jason Pyeron" writes: >> Looking at http_config() there, I would guess perhaps: >> >> [http] >> uploadpack = false >> getanyfile = false >> >> but I am not sure if the latter is needed (or anybody seriously >> tested it, for that matter). > > Perfect! Had to add receivepack=true for the anonymous part. Good. ```