From 66faf55839912e8b5da901432ab37938c8d55974 Mon Sep 17 00:00:00 2001 From: Pierre-Yves Chibon Date: May 13 2015 07:41:49 +0000 Subject: [PATCH 1/12] Add a configuration key to specify if the server runs gitolite 2 or 3 --- diff --git a/files/pagure.cfg.sample b/files/pagure.cfg.sample index f346ecd..ac7606f 100644 --- a/files/pagure.cfg.sample +++ b/files/pagure.cfg.sample @@ -74,6 +74,9 @@ GITOLITE_CONFIG = os.path.join( ### Folder where to run gl-compile-conf from GITOLITE_HOME = None +### Version of gitolite used: 2 or 3? +GITOLITE_VERSION = 2 + ### Folder containing all the public ssh keys for gitolite GITOLITE_KEYDIR = None diff --git a/pagure/default_config.py b/pagure/default_config.py index bdad85d..10cd35a 100644 --- a/pagure/default_config.py +++ b/pagure/default_config.py @@ -89,6 +89,9 @@ GITOLITE_CONFIG = os.path.join( # Home folder of the gitolite user -- Folder where to run gl-compile-conf from GITOLITE_HOME = None +# Version of gitolite used: 2 or 3? +GITOLITE_VERSION = 2 + # Folder containing all the public ssh keys for gitolite GITOLITE_KEYDIR = None From 020c6f29864d44204c9fd21ea3a795c13d955509 Mon Sep 17 00:00:00 2001 From: Pierre-Yves Chibon Date: May 13 2015 07:42:07 +0000 Subject: [PATCH 2/12] Try compiling the gitolite configurationf for gitolite 3 --- diff --git a/pagure/__init__.py b/pagure/__init__.py index ef2a6e3..ab00039 100644 --- a/pagure/__init__.py +++ b/pagure/__init__.py @@ -141,17 +141,30 @@ def generate_gitolite_acls(): SESSION, APP.config['GITOLITE_CONFIG']) gitolite_folder = APP.config.get('GITOLITE_HOME', None) + gitolite_version = APP.config.get('GITOLITE_VERSION', 2) if gitolite_folder: - cmd = 'GL_RC=%s GL_BINDIR=%s gl-compile-conf' % ( - APP.config.get('GL_RC'), APP.config.get('GL_BINDIR') - ) - subprocess.Popen( - cmd, - shell=True, - stdout=subprocess.PIPE, - stderr=subprocess.PIPE, - cwd=gitolite_folder - ) + if gitolite_version < 3: + cmd = 'GL_RC=%s GL_BINDIR=%s gl-compile-conf' % ( + APP.config.get('GL_RC'), APP.config.get('GL_BINDIR') + ) + subprocess.Popen( + cmd, + shell=True, + stdout=subprocess.PIPE, + stderr=subprocess.PIPE, + cwd=gitolite_folder + ) + else: + cmd = 'GL_RC=%s GL_BINDIR=%s gitolite compile && gitolite trigger POST_COMPILE' % ( + APP.config.get('GL_RC'), APP.config.get('GL_BINDIR') + ) + subprocess.Popen( + cmd, + shell=True, + stdout=subprocess.PIPE, + stderr=subprocess.PIPE, + cwd=gitolite_folder + ) def generate_gitolite_key(user, key): # pragma: no cover From 0b6af2ea678faad83b372fe030fb968398b21f94 Mon Sep 17 00:00:00 2001 From: Pierre-Yves Chibon Date: May 13 2015 07:50:52 +0000 Subject: [PATCH 3/12] Adjust the authorized_keys file depending on the gitolite version set --- diff --git a/pagure/__init__.py b/pagure/__init__.py index ab00039..0755c83 100644 --- a/pagure/__init__.py +++ b/pagure/__init__.py @@ -188,13 +188,21 @@ def generate_authorized_key_file(): # pragma: no cover gitolite_home, '.ssh', 'authorized_keys') with open(authorized_file, 'w') as stream: stream.write('# gitolite start\n') + gitolite_version = APP.config.get('GITOLITE_VERSION', 2) for user in users: if not user.public_ssh_key: continue - row = 'command="/usr/bin/gl-auth-command %s",' \ - 'no-port-forwarding,no-X11-forwarding,'\ - 'no-agent-forwarding,no-pty %s' % ( - user.user, user.public_ssh_key) + if gitolite_version < 3: + row = 'command="/usr/bin/gl-auth-command %s",' \ + 'no-port-forwarding,no-X11-forwarding,'\ + 'no-agent-forwarding,no-pty %s' % ( + user.user, user.public_ssh_key) + else: + row = 'command="HOME=/srv/git '\ + '/usr/share/gitolite3/gitolite-shell %s",' \ + 'no-port-forwarding,no-X11-forwarding,'\ + 'no-agent-forwarding,no-pty %s' % ( + user.user, user.public_ssh_key) stream.write(row + '\n') stream.write('# gitolite end\n') From 8a90425fdd02b680da3481677bfbb1a8bbba1cb5 Mon Sep 17 00:00:00 2001 From: Pierre-Yves Chibon Date: May 13 2015 08:19:12 +0000 Subject: [PATCH 4/12] Fix the gitolite3 command to compile the configuration and reduce redundancy --- diff --git a/pagure/__init__.py b/pagure/__init__.py index 0755c83..20c1b56 100644 --- a/pagure/__init__.py +++ b/pagure/__init__.py @@ -147,24 +147,19 @@ def generate_gitolite_acls(): cmd = 'GL_RC=%s GL_BINDIR=%s gl-compile-conf' % ( APP.config.get('GL_RC'), APP.config.get('GL_BINDIR') ) - subprocess.Popen( - cmd, - shell=True, - stdout=subprocess.PIPE, - stderr=subprocess.PIPE, - cwd=gitolite_folder - ) else: - cmd = 'GL_RC=%s GL_BINDIR=%s gitolite compile && gitolite trigger POST_COMPILE' % ( - APP.config.get('GL_RC'), APP.config.get('GL_BINDIR') - ) - subprocess.Popen( - cmd, - shell=True, - stdout=subprocess.PIPE, - stderr=subprocess.PIPE, - cwd=gitolite_folder + cmd = 'HOME=%s gitolite compile && HOME=%s gitolite trigger '\ + 'POST_COMPILE' % ( + APP.config.get('GITOLITE_HOME'), + APP.config.get('GITOLITE_HOME') ) + proc = subprocess.Popen( + cmd, + shell=True, + stdout=subprocess.PIPE, + stderr=subprocess.PIPE, + cwd=gitolite_folder + ) def generate_gitolite_key(user, key): # pragma: no cover From 5fedede440f49fc34385fbac0bba3f89a3282292 Mon Sep 17 00:00:00 2001 From: Pierre-Yves Chibon Date: May 13 2015 08:19:34 +0000 Subject: [PATCH 5/12] Add an example .rc file for gitolite3 --- diff --git a/files/gitolite3.rc b/files/gitolite3.rc new file mode 100644 index 0000000..1a20d42 --- /dev/null +++ b/files/gitolite3.rc @@ -0,0 +1,195 @@ +# configuration variables for gitolite + +# This file is in perl syntax. But you do NOT need to know perl to edit it -- +# just mind the commas, use single quotes unless you know what you're doing, +# and make sure the brackets and braces stay matched up! + +# (Tip: perl allows a comma after the last item in a list also!) + +# HELP for commands can be had by running the command with "-h". + +# HELP for all the other FEATURES can be found in the documentation (look for +# "list of non-core programs shipped with gitolite" in the master index) or +# directly in the corresponding source file. + +%RC = ( + + # ------------------------------------------------------------------ + + # default umask gives you perms of '0700'; see the rc file docs for + # how/why you might change this + UMASK => 0077, + + # look for "git-config" in the documentation + GIT_CONFIG_KEYS => '', + + # comment out if you don't need all the extra detail in the logfile + LOG_EXTRA => 1, + # syslog options + # 1. leave this section as is for normal gitolite logging + # 2. uncomment this line to log only to syslog: + # LOG_DEST => 'syslog', + # 3. uncomment this line to log to syslog and the normal gitolite log: + # LOG_DEST => 'syslog,normal', + + # roles. add more roles (like MANAGER, TESTER, ...) here. + # WARNING: if you make changes to this hash, you MUST run 'gitolite + # compile' afterward, and possibly also 'gitolite trigger POST_COMPILE' + ROLES => { + READERS => 1, + WRITERS => 1, + }, + + # enable caching (currently only Redis). PLEASE RTFM BEFORE USING!!! + # CACHE => 'Redis', + + # ------------------------------------------------------------------ + + # rc variables used by various features + + # the 'info' command prints this as additional info, if it is set + # SITE_INFO => 'Please see http://blahblah/gitolite for more help', + + # the CpuTime feature uses these + # display user, system, and elapsed times to user after each git operation + # DISPLAY_CPU_TIME => 1, + # display a warning if total CPU times (u, s, cu, cs) crosses this limit + # CPU_TIME_WARN_LIMIT => 0.1, + + # the Mirroring feature needs this + # HOSTNAME => "foo", + + # TTL for redis cache; PLEASE SEE DOCUMENTATION BEFORE UNCOMMENTING! + # CACHE_TTL => 600, + + # ------------------------------------------------------------------ + + # suggested locations for site-local gitolite code (see cust.html) + + # this one is managed directly on the server + # LOCAL_CODE => "$ENV{HOME}/local", + + # or you can use this, which lets you put everything in a subdirectory + # called "local" in your gitolite-admin repo. For a SECURITY WARNING + # on this, see http://gitolite.com/gitolite/non-core.html#pushcode + # LOCAL_CODE => "$rc{GL_ADMIN_BASE}/local", + + # ------------------------------------------------------------------ + + # List of commands and features to enable + + ENABLE => [ + + # COMMANDS + + # These are the commands enabled by default + 'help', + 'desc', + 'info', + 'perms', + 'writable', + + # Uncomment or add new commands here. + # 'create', + # 'fork', + # 'mirror', + # 'readme', + # 'sskm', + # 'D', + + # These FEATURES are enabled by default. + + # essential (unless you're using smart-http mode) + 'ssh-authkeys', + + # creates git-config enties from gitolite.conf file entries like 'config foo.bar = baz' + 'git-config', + + # creates git-daemon-export-ok files; if you don't use git-daemon, comment this out + 'daemon', + + # creates projects.list file; if you don't use gitweb, comment this out + #'gitweb', + + # These FEATURES are disabled by default; uncomment to enable. If you + # need to add new ones, ask on the mailing list :-) + + # user-visible behaviour + + # prevent wild repos auto-create on fetch/clone + # 'no-create-on-read', + # no auto-create at all (don't forget to enable the 'create' command!) + # 'no-auto-create', + + # access a repo by another (possibly legacy) name + # 'Alias', + + # give some users direct shell access. See documentation in + # sts.html for details on the following two choices. + # "Shell $ENV{HOME}/.gitolite.shell-users", + # 'Shell alice bob', + + # set default roles from lines like 'option default.roles-1 = ...', etc. + # 'set-default-roles', + + # show more detailed messages on deny + # 'expand-deny-messages', + + # show a message of the day + # 'Motd', + + # system admin stuff + + # enable mirroring (don't forget to set the HOSTNAME too!) + # 'Mirroring', + + # allow people to submit pub files with more than one key in them + # 'ssh-authkeys-split', + + # selective read control hack + # 'partial-copy', + + # manage local, gitolite-controlled, copies of read-only upstream repos + # 'upstream', + + # updates 'description' file instead of 'gitweb.description' config item + # 'cgit', + + # allow repo-specific hooks to be added + # 'repo-specific-hooks', + + # performance, logging, monitoring... + + # be nice + # 'renice 10', + + # log CPU times (user, system, cumulative user, cumulative system) + # 'CpuTime', + + # syntactic_sugar for gitolite.conf and included files + + # allow backslash-escaped continuation lines in gitolite.conf + # 'continuation-lines', + + # create implicit user groups from directory names in keydir/ + # 'keysubdirs-as-groups', + + # allow simple line-oriented macros + # 'macros', + + # Kindergarten mode + + # disallow various things that sensible people shouldn't be doing anyway + # 'Kindergarten', + ], + +); + +# ------------------------------------------------------------------------------ +# per perl rules, this should be the last line in such a file: +1; + +# Local variables: +# mode: perl +# End: +# vim: set syn=perl: From 1f02b7177851dd97b0b3b1fd7d7ecbd7dad9f656 Mon Sep 17 00:00:00 2001 From: Pierre-Yves Chibon Date: May 13 2015 08:21:32 +0000 Subject: [PATCH 6/12] Do not hard-code the gitolite home folder --- diff --git a/pagure/__init__.py b/pagure/__init__.py index 20c1b56..566e2e1 100644 --- a/pagure/__init__.py +++ b/pagure/__init__.py @@ -193,11 +193,11 @@ def generate_authorized_key_file(): # pragma: no cover 'no-agent-forwarding,no-pty %s' % ( user.user, user.public_ssh_key) else: - row = 'command="HOME=/srv/git '\ + row = 'command="HOME=%s '\ '/usr/share/gitolite3/gitolite-shell %s",' \ 'no-port-forwarding,no-X11-forwarding,'\ 'no-agent-forwarding,no-pty %s' % ( - user.user, user.public_ssh_key) + gitolite_home, user.user, user.public_ssh_key) stream.write(row + '\n') stream.write('# gitolite end\n') From d4a7e7afb21bafafd39aa193a72bf276af3cb42d Mon Sep 17 00:00:00 2001 From: Pierre-Yves Chibon Date: May 13 2015 08:23:13 +0000 Subject: [PATCH 7/12] Make gitolite 3 be the default version of gitolite supported --- diff --git a/files/pagure.spec b/files/pagure.spec index c25cb3d..c798ee0 100644 --- a/files/pagure.spec +++ b/files/pagure.spec @@ -65,7 +65,7 @@ Requires: python-munch Requires: mod_wsgi # No dependency of the app per se, but required to make it working. -Requires: gitolite +Requires: gitolite3 %description diff --git a/pagure/default_config.py b/pagure/default_config.py index 10cd35a..e576b4c 100644 --- a/pagure/default_config.py +++ b/pagure/default_config.py @@ -90,7 +90,7 @@ GITOLITE_CONFIG = os.path.join( GITOLITE_HOME = None # Version of gitolite used: 2 or 3? -GITOLITE_VERSION = 2 +GITOLITE_VERSION = 3 # Folder containing all the public ssh keys for gitolite GITOLITE_KEYDIR = None From d0272caf7d1cb23eb6b8de0f0e96f64d91de4577 Mon Sep 17 00:00:00 2001 From: Pierre-Yves Chibon Date: May 13 2015 09:54:16 +0000 Subject: [PATCH 8/12] We said gitolite3 by default --- diff --git a/files/pagure.cfg.sample b/files/pagure.cfg.sample index ac7606f..2c8fcac 100644 --- a/files/pagure.cfg.sample +++ b/files/pagure.cfg.sample @@ -75,7 +75,7 @@ GITOLITE_CONFIG = os.path.join( GITOLITE_HOME = None ### Version of gitolite used: 2 or 3? -GITOLITE_VERSION = 2 +GITOLITE_VERSION = 3 ### Folder containing all the public ssh keys for gitolite GITOLITE_KEYDIR = None From d1af06f6e422ece0ff22c959f11038e7481ed200 Mon Sep 17 00:00:00 2001 From: Pierre-Yves Chibon Date: May 13 2015 10:06:02 +0000 Subject: [PATCH 9/12] Default to gitolite v3 in the code as well --- diff --git a/pagure/__init__.py b/pagure/__init__.py index 566e2e1..18bd4df 100644 --- a/pagure/__init__.py +++ b/pagure/__init__.py @@ -141,7 +141,7 @@ def generate_gitolite_acls(): SESSION, APP.config['GITOLITE_CONFIG']) gitolite_folder = APP.config.get('GITOLITE_HOME', None) - gitolite_version = APP.config.get('GITOLITE_VERSION', 2) + gitolite_version = APP.config.get('GITOLITE_VERSION', 3) if gitolite_folder: if gitolite_version < 3: cmd = 'GL_RC=%s GL_BINDIR=%s gl-compile-conf' % ( @@ -183,7 +183,7 @@ def generate_authorized_key_file(): # pragma: no cover gitolite_home, '.ssh', 'authorized_keys') with open(authorized_file, 'w') as stream: stream.write('# gitolite start\n') - gitolite_version = APP.config.get('GITOLITE_VERSION', 2) + gitolite_version = APP.config.get('GITOLITE_VERSION', 3) for user in users: if not user.public_ssh_key: continue From 34024e5fcba1b33e76239f48036a82c0d9ea90f0 Mon Sep 17 00:00:00 2001 From: Pierre-Yves Chibon Date: May 13 2015 10:09:42 +0000 Subject: [PATCH 10/12] Carefully check which gitolite version has been set in the config and refuse v1 --- diff --git a/pagure/__init__.py b/pagure/__init__.py index 18bd4df..d97dd26 100644 --- a/pagure/__init__.py +++ b/pagure/__init__.py @@ -143,16 +143,20 @@ def generate_gitolite_acls(): gitolite_folder = APP.config.get('GITOLITE_HOME', None) gitolite_version = APP.config.get('GITOLITE_VERSION', 3) if gitolite_folder: - if gitolite_version < 3: + if gitolite_version == 3: cmd = 'GL_RC=%s GL_BINDIR=%s gl-compile-conf' % ( APP.config.get('GL_RC'), APP.config.get('GL_BINDIR') ) - else: + elif gitolite_version == 2: cmd = 'HOME=%s gitolite compile && HOME=%s gitolite trigger '\ 'POST_COMPILE' % ( APP.config.get('GITOLITE_HOME'), APP.config.get('GITOLITE_HOME') ) + else: + raise pagure.exceptions.PagureException( + 'Non-supported gitolite version "%s"' % gitolite_version + ) proc = subprocess.Popen( cmd, shell=True, @@ -187,17 +191,21 @@ def generate_authorized_key_file(): # pragma: no cover for user in users: if not user.public_ssh_key: continue - if gitolite_version < 3: + if gitolite_version == 3: row = 'command="/usr/bin/gl-auth-command %s",' \ 'no-port-forwarding,no-X11-forwarding,'\ 'no-agent-forwarding,no-pty %s' % ( user.user, user.public_ssh_key) - else: + elif gitolite_version == 2: row = 'command="HOME=%s '\ '/usr/share/gitolite3/gitolite-shell %s",' \ 'no-port-forwarding,no-X11-forwarding,'\ 'no-agent-forwarding,no-pty %s' % ( gitolite_home, user.user, user.public_ssh_key) + else: + raise pagure.exceptions.PagureException( + 'Non-supported gitolite version "%s"' % gitolite_version + ) stream.write(row + '\n') stream.write('# gitolite end\n') From 35b1d0ffb5ea725273aa308aa9042700d880cfdf Mon Sep 17 00:00:00 2001 From: Pierre-Yves Chibon Date: May 13 2015 10:10:00 +0000 Subject: [PATCH 11/12] Catch exceptions thrown if the gitolite version in the config is wrong --- diff --git a/pagure/ui/admin.py b/pagure/ui/admin.py index b824e80..7b076a2 100644 --- a/pagure/ui/admin.py +++ b/pagure/ui/admin.py @@ -13,6 +13,7 @@ from functools import wraps import flask from sqlalchemy.exc import SQLAlchemyError +import pagure.exceptions import pagure.forms import pagure.lib from pagure import (APP, SESSION, @@ -60,8 +61,11 @@ def admin_generate_acl(): """ Regenerate the gitolite ACL file. """ form = pagure.forms.ConfirmationForm() if form.validate_on_submit(): - generate_gitolite_acls() - flask.flash('Gitolite ACLs updated') + try: + generate_gitolite_acls() + flask.flash('Gitolite ACLs updated') + except pagure.exceptions.PagureException, err: + flask.flash(str(err), 'error') return flask.redirect(flask.url_for('admin_index')) @@ -71,8 +75,11 @@ def admin_refresh_ssh(): """ Regenerate the gitolite ACL file. """ form = pagure.forms.ConfirmationForm() if form.validate_on_submit(): - generate_authorized_key_file() - flask.flash('Authorized file updated') + try: + generate_authorized_key_file() + flask.flash('Authorized file updated') + except pagure.exceptions.PagureException, err: + flask.flash(str(err), 'error') return flask.redirect(flask.url_for('admin_index')) From e04a5440b1eb98eff2df5d152a9c0c4dd18aa740 Mon Sep 17 00:00:00 2001 From: Pierre-Yves Chibon Date: May 13 2015 10:12:05 +0000 Subject: [PATCH 12/12] Invert the gitolite version check to be what it should --- diff --git a/pagure/__init__.py b/pagure/__init__.py index d97dd26..9e054e0 100644 --- a/pagure/__init__.py +++ b/pagure/__init__.py @@ -143,11 +143,11 @@ def generate_gitolite_acls(): gitolite_folder = APP.config.get('GITOLITE_HOME', None) gitolite_version = APP.config.get('GITOLITE_VERSION', 3) if gitolite_folder: - if gitolite_version == 3: + if gitolite_version == 2: cmd = 'GL_RC=%s GL_BINDIR=%s gl-compile-conf' % ( APP.config.get('GL_RC'), APP.config.get('GL_BINDIR') ) - elif gitolite_version == 2: + elif gitolite_version == 3: cmd = 'HOME=%s gitolite compile && HOME=%s gitolite trigger '\ 'POST_COMPILE' % ( APP.config.get('GITOLITE_HOME'), @@ -191,12 +191,12 @@ def generate_authorized_key_file(): # pragma: no cover for user in users: if not user.public_ssh_key: continue - if gitolite_version == 3: + if gitolite_version == 2: row = 'command="/usr/bin/gl-auth-command %s",' \ 'no-port-forwarding,no-X11-forwarding,'\ 'no-agent-forwarding,no-pty %s' % ( user.user, user.public_ssh_key) - elif gitolite_version == 2: + elif gitolite_version == 3: row = 'command="HOME=%s '\ '/usr/share/gitolite3/gitolite-shell %s",' \ 'no-port-forwarding,no-X11-forwarding,'\