Commits
- Commit:
6771d4253a7655812f9e1b5f25d98d86ec416951
- From:
- Omar Polo <op@omarpolo.com>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
always cast ctype' is*() arguments to unsigned char
ok stsp@
- Commit:
3fe5d0fee4a9e03753cf693bf839bf26cb872d54
- From:
- Omar Polo <op@omarpolo.com>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
got send: show server error
Print the error message reported by the remote server when failing to
update a branch (for e.g. because of a server-side check.) Reported by
gonzalo@, with help and ok stsp@.
- Commit:
e28099979b03e56c094eb0e2f04137b96510f632
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
fix crash in got-send-pack when server does not announce any capabilities
- Commit:
c0876f4c1ecc4e8ccd484a059314ce6de9bdda50
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
avoid incomplete writes of pack file data in got-send-pack
- Commit:
3efd8e3122b7d03a046d23fd5eed22c1b78f8ceb
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
introduce gotd(8), a Git repository server reachable via ssh(1)
This is an initial barebones implementation which provides the absolute
minimum of functionality required to serve got(1) and git(1) clients.
Basic fetch/send functionality has been tested and seems to work here,
but this server is not yet expected to be stable.
More testing is welcome. See the man pages for setup instructions.
The current design uses one reader and one writer process per repository,
which will have to be extended to N readers and N writers in the future.
At startup, each process will chroot(2) into its assigned repository.
This works because gotd(8) can only be started as root, and will then
fork+exec, chroot, and privdrop.
At present the parent process runs with the following pledge(2) promises:
"stdio rpath wpath cpath proc getpw sendfd recvfd fattr flock unix unveil"
The parent is the only process able to modify the repository in a way
that becomes visible to Git clients. The parent uses unveil(2) to
restrict its view of the filesystem to /tmp and the repositories
listed in the configuration file gotd.conf(5).
Per-repository chroot(2) processes use "stdio rpath sendfd recvfd".
The writer defers to the parent for modifying references in the
repository to point at newly uploaded commits. The reader is fine
without such help, because Git repositories can be read without
having to create any lock-files.
gotd(8) requires a dedicated user ID, which should own repositories
on the filesystem, and a separate secondary group, which should not
have filesystem-level repository access, and must be allowed access
to the gotd(8) socket.
To obtain Git repository access, users must be members of this
secondary group, and must have their login shell set to gotsh(1).
gotsh(1) connects to the gotd(8) socket and speaks Git-protocol
towards the client on the other end of the SSH connection.
gotsh(1) is not an interactive command shell.
At present, authenticated clients are granted read/write access to
all repositories and all references (except for the "refs/got/" and
the "refs/remotes/" namespaces, which are already being protected
from modification).
While complicated access control mechanism are not a design goal,
making it possible to safely offer anonymous Git repository access
over ssh(1) is on the road map.
- Commit:
b6b86fd1b9828e38d59915e62fddce62952b8b75
- From:
- Josiah Frentsos <jfrent@tilde.team>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
remove trailing whitespace; patch by Josiah Frentsos
- Commit:
717a78d4f87c3704afe34c77e211349932575d5b
- From:
- Omar Polo <op@omarpolo.com>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
fix snprintf error handling
follow the "proper secure idiom" described in the CAVEATS section of
printf(3). reminded by tb@ and millert@
- Commit:
17c93e37adaf6ec18654a4d9cea0846a0d5394f3
- From:
- Florian Obser <florian@narrans.de>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
Do not ignore error from got_pathlist_append.
Found by llvm's scan-build (dead store).
OK stsp
- Commit:
8b925c6ccd3968917253ea191906a1710c40ed2d
- From:
- Thomas Adam <thomas@xteddy.org>
- Date:
portable: add back sys/queue.h
Now that the handling of including sys/queue.h is better, there's no
need to remove those lines from the source. Copy the location of those
original sys/queue.h lines from upstream at the same line number, so as
to avoid any conflicts in the future.
- Commit:
5d120ea8410ddc2808e476d554ba931dc19d8c50
- From:
- Omar Polo <op@omarpolo.com>
- Date:
use capsicum on FreeBSD
Thanks to the design of Got, the libexec helpers don't need any resource
(in fact they run under pledge "stdio recvfd" on OpenBSD) and so using
cap_enter(2) on FreeBSD is dead-easy.
While the main process can't be sandboxed on FreeBSD (needs to exec the
helpers), all the tough work is done by these small libexec helpers
which is also the biggest attack surface.
tested by naddy, ok thomas
- Commit:
e9f1a409ccc66a6fb79a3022695ca78ad26972ea
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
imsg_add() frees its msg argument on error; avoid double-free in error paths
- Commit:
fa8129f71e6d8a352929f74ba0fc4f8aa59ba216
- From:
- Christian Weisgerber <naddy@mips.inka.de>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
const-ify tables
ok thomas_adam millert
- Commit:
b7e51f67a8bbcb435bb261279973a2523eda2768
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
apply time-based rate-limiting to got-send-pack upload progress output
- Commit:
97799ccd4b67a81f97039305d4fdd66588da9962
- From:
- Thomas Adam <thomas@xteddy.org>
- Date:
portable: add support for landlock
landlock is a new set of linux APIs that is conceptually similar to
unveil(2): the idea is to restrict what a process can do on a
specified part of the filesystem. There are some differences in the
behaviour: the major one being that the landlock ruleset is inherited
across execve(2).
This just restricts the libexec helpers by completely revoking ANY
filesystem access; after all they are the biggest attack surface. got
send/fetch/clone *may* end up spawning ssh(1), so at the moment is not
possible to landlock the main process.
From Omar Polo.
- Commit:
35add24aa636945d591ac62534d3caf3e906621a
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
plug memory leaks in got-fetch-pack and got-send-pack
ok naddy
- Commit:
881327824d65ca303150795897d7f39b5f5370be
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas.adam@smoothwall.net>
- Date:
whitespace fix from Omar Polo
- Commit:
01bb5a15144ece7ca707994fb56e1847c76a1a92
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas.adam@smoothwall.net>
- Date:
fix some integers that had a slightly wrong type; patch by Omar Polo
- Commit:
92a9e85d28a30997176ce0d3c2915e3ea70782c7
- From:
- Thomas Adam <thomas@xteddy.org>
- Date:
portable: add FreeBSD support
This adds the capability to compile got-portable on FreeBSD.
- Commit:
dd038bc6ec835ad3fd3c0b5303b8af9ad506c8cc
- From:
- Thomas Adam <thomas@xteddy.org>
- Via:
- Thomas Adam <thomas.adam@smoothwall.net>
- Date:
portable: initial Linux compilation
This commit modifies the GoT main branch to be able to compile it under
linux.
- Commit:
77d7d3bb1aabafae6c020c8a07a6e9f4f7885c9b
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
de-duplicate a constant used by both 'got fetch' and 'got send'
Both GOT_FETCH_PKTMAX and GOT_SEND_PKTMAX had the same value.
Declare this value as GOT_PKT_MAX in got_lib_pkt.h instead.
- Commit:
abc59930d57a2d46c310e1b0c758c948554bc1af
- From:
- Christian Weisgerber <naddy@mips.inka.de>
- Date:
indentation fixes
- Commit:
bd3d9e54cb422cb58d52b267c6a8afc3376842d2
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
move more code used by got-send-pack and got-fetch-pack to a common file
Move functions and data structures which implement Git protocol features
required for fetching and sending pack files to new files lib/gitproto.c
and lib/got_lib_gitproto.h.
This code was duplicated in got-fetch-pack and got-send-pack.
No functional change.
- Commit:
f024663dea0dea05a0d4c17d2314f38f73e85bc6
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
move pkt code used by got-fetch-pack and got-send-pack to a common file
The Git protocol uses a simple packet framing format. The got-fetch-pack
and got-send-pack programs contained identical copies of functions to
support this format. Move related functions to new file lib/pkt.c and
link both programs against this common implementation.
No functional change.
- Commit:
27b75514d9b1c8e9f188ef9c483760647a8c1b72
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
do not send a pack file when 'got send' is only deleting branches
The git protocol spec says the client MUST NOT send a pack file
if the only command used is 'delete'.
Fixes 'got send -d' against Github's server which closed the session
upon receiving the empty pack file we sent. This problem wasn't caught
by regression tests since git-daemon does accept an empty pack file.
Problem reported by jrick.
- Commit:
2ae2891d0e4f8e66706be6eb6394c199f18b7691
- From:
- Stefan Sperling <stsp@stsp.name>
- Date:
remove github capabilities workaround from got-send-pack, it is not needed
This workaround was inherited from git9, which claims that Github did
not send capabilities. Protocol traces show that Github's server does
in fact advertise its capabilities. Git protocol capabilities are hidden
behind a NUL byte in the middle of the first refline sent by the server.
This makes them easy to miss when treating a refline as a C string.
I guess this is why Ori concluded that Github didn't send any capabilities.
Or perhaps Github has been fixed since.