How to hide a git repository?

We have two repositories, one is /pub/git/dev/linux/kernel, another is /pub/git/pub/linux/kernel. The /pub/git/pub/linux/kernel is open to public for people to download released code. /pub/git/dev/linux/kernel is used for our development. We would like to hide /pub/git/dev/linux/kernel from public. How to do it?

Why we want to hide /pub/git/dev/linux/kernel from public?
We work on our development at /pub/git/dev/linux/kernel. We push our released code to /pub/git/pub/linux/kernel from /pub/git/dev/linux/kernel once we completed our development.  We do not want people to download code from /pub/git/dev/linux/kernel since it is not stable.  






      

On Mon, Nov 24, 2008 at 04:32:58PM -0800, Gary Yang wrote:

We have two repositories, one is /pub/git/dev/linux/kernel, another 
is /pub/git/pub/linux/kernel. The /pub/git/pub/linux/kernel is open to 
public for people to download released code. /pub/git/dev/linux/kernel 
is used for our development. We would like to hide 
/pub/git/dev/linux/kernel from public. How to do it?

Tell "git daemon" only to publish /pub/git/pub/linux/kernel.

-- 
Heikki Orsila
heikki.orsila@iki.fi
http://www.iki.fi/shd

How to tell "git daemon" only to publish /pub/git/pub/linux/kernel ?

--- On Mon, 11/24/08, Heikki Orsila <shdl@zakalwe.fi> wrote:

From: Heikki Orsila <redacted>
Subject: Re: How to hide a git repository?
To: "Gary Yang" <redacted>
Cc: git@vger.kernel.org
Date: Monday, November 24, 2008, 4:37 PM
On Mon, Nov 24, 2008 at 04:32:58PM -0800, Gary Yang wrote:

quoted

We have two repositories, one is

/pub/git/dev/linux/kernel, another 

quoted

is /pub/git/pub/linux/kernel. The

/pub/git/pub/linux/kernel is open to 

quoted

public for people to download released code.

/pub/git/dev/linux/kernel 

quoted

is used for our development. We would like to hide 
/pub/git/dev/linux/kernel from public. How to do it?

Tell "git daemon" only to publish
/pub/git/pub/linux/kernel.

-- 
Heikki Orsila
heikki.orsila@iki.fi
http://www.iki.fi/shd
--
To unsubscribe from this list: send the line
"unsubscribe git" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at 
http://vger.kernel.org/majordomo-info.html

Do I have to create two git servers? One is for public to download the released code. For example: gitpub.mycompany.com:/pub/linux/kernel. gitpub.mycompany.com is accessible to public. Another is for internal development. For example: gitdev.mycompany.com:/dev/linux/kernel. gitdev.mycompany.com is only accessible to our development team. I push code from gitdev.mycompany.com:/dev/linux/kernel to gitpub.mycompany.com:/publinux/kernel once we completed our development. Is this the only way to do it? 

--- On Mon, 11/24/08, Gary Yang <garyyang6@yahoo.com> wrote:

From: Gary Yang <redacted>
Subject: How to hide a git repository?
To: git@vger.kernel.org
Date: Monday, November 24, 2008, 4:32 PM
We have two repositories, one is /pub/git/dev/linux/kernel,
another is /pub/git/pub/linux/kernel. The
/pub/git/pub/linux/kernel is open to public for people to
download released code. /pub/git/dev/linux/kernel is used
for our development. We would like to hide
/pub/git/dev/linux/kernel from public. How to do it?

Why we want to hide /pub/git/dev/linux/kernel from public?
We work on our development at /pub/git/dev/linux/kernel. We
push our released code to /pub/git/pub/linux/kernel from
/pub/git/dev/linux/kernel once we completed our development.
 We do not want people to download code from
/pub/git/dev/linux/kernel since it is not stable.  






      
--
To unsubscribe from this list: send the line
"unsubscribe git" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at 
http://vger.kernel.org/majordomo-info.html

On Mon, Nov 24, 2008 at 05:40:22PM -0800, Gary Yang wrote:

How to tell "git daemon" only to publish /pub/git/pub/linux/kernel ?

$ man git-daemon

<snip>
It verifies that the directory has the magic file
       "git-daemon-export-ok", and it will refuse to export any git directory
       that hasn´t explicitly been marked for export this way (unless the
       --export-all parameter is specified). If you pass some directory paths
       as git-daemon arguments, you can further restrict the offers to a
       whitelist comprising of those.
</snip>

Hope this helps

-- 
Bruno Ribas - ribas@c3sl.ufpr.br
http://www.inf.ufpr.br/ribas
C3SL: http://www.c3sl.ufpr.br

I guess you could export the public one through git daemon and/or your
web server, and access your private tree through SSH.
This way you ensure only authentificated people will be able to clone
your private tree.

---
Nicolas Morey-Chaisemartin



Gary Yang a écrit :

On Mon, 24 Nov 2008, Gary Yang wrote:

Do I have to create two git servers? One is for public to download the 
released code. For example: gitpub.mycompany.com:/pub/linux/kernel.

The public can't generally use this URL, because it's an ssh URL, and they 
won't be able to connect with ssh. They can only really use 
git://gitpub.mycompany.com/pub/linux/kernel or something similar.

The normal pattern is to have R/W access with ssh and anonymous read 
access via git://...; you can then have multiple repositories on the same 
host, with the git server only serving the public one. All of them will be 
accessible to the ssh methods (restricted by the user's UNIX permissions 
on the files in those directories).

	-Daniel
*This .sig left intentionally blank*

Am Tuesday 25 November 2008 19:38:02 schrieb Daniel Barkalow:

On Mon, 24 Nov 2008, Gary Yang wrote:

quoted

Do I have to create two git servers? One is for public to download the
released code. For example: gitpub.mycompany.com:/pub/linux/kernel.

The public can't generally use this URL, because it's an ssh URL, and they
won't be able to connect with ssh. They can only really use
git://gitpub.mycompany.com/pub/linux/kernel or something similar.

The normal pattern is to have R/W access with ssh and anonymous read
access via git://...; you can then have multiple repositories on the same
host, with the git server only serving the public one. All of them will be
accessible to the ssh methods (restricted by the user's UNIX permissions
on the files in those directories).

	-Daniel
*This .sig left intentionally blank*
--

Do you now of a way to show public repos with gitweb to the public and
private repos to the staff with the same gitweb installation?

Best regards,
-- 
Thomas Koch, Software Developer
http://www.koch.ro

Young Media Concepts GmbH
Sonnenstr. 4
CH-8280 Kreuzlingen
Switzerland

Tel    +41 (0)71 / 508 24 86
Fax    +41 (0)71 / 560 53 89
Mobile +49 (0)170 / 753 89 16
Web    www.ymc.ch

On Tue, 25 Nov 2008, Thomas Koch wrote:

Do you now of a way to show public repos with gitweb to the public and
private repos to the staff with the same gitweb installation?

I don't really know much about gitweb, but I'd expect that you can have 
the same physical machine, the same gitweb executable, the same 
apache, different virtual hosts, and different configurations for each 
virtual host. Without having different URLs in some way, there's no way 
for the system to cause web browsers of staff members to authenticate 
themselves in order to reveal the private repos.

	-Daniel
*This .sig left intentionally blank*

Thomas Koch [off-list ref] writes:

Am Tuesday 25 November 2008 19:38:02 schrieb Daniel Barkalow:

quoted

On Mon, 24 Nov 2008, Gary Yang wrote:

quoted

quoted

Do I have to create two git servers? One is for public to download the
released code. For example: gitpub.mycompany.com:/pub/linux/kernel.

The public can't generally use this URL, because it's an ssh URL, and they
won't be able to connect with ssh. They can only really use
git://gitpub.mycompany.com/pub/linux/kernel or something similar.

The normal pattern is to have R/W access with ssh and anonymous read
access via git://...; you can then have multiple repositories on the same
host, with the git server only serving the public one. All of them will be
accessible to the ssh methods (restricted by the user's UNIX permissions
on the files in those directories).

To control access via SSH protocol (which can be used both for
fetching and for pushing), you can either configure accounts and
user/groups permissions on repository directories, or you can use
external tool like ssh_acl or Gitosis.

To control access via HTTP you can employ authorization and
authentication from your web server; for push this would be matter of
setting up WebDAV.

To control access via anonymous git:// protocol, you can use whitelist
and blacklist mechanism built in git-daemon; by default only
repositories with git-daemon-export-ok in them (in .git) are exported,
if I understand correctly.


Additionally, if protocol is authenticated you can use hooks mechanism
like example contrib/hooks/update-paranoid to restrict access (and
with finer granularity too).

Do you now of a way to show public repos with gitweb to the public and
private repos to the staff with the same gitweb installation?

You can quite simply restrict access to some directories/repositories,
or the fact that they are listed in list of all projects for _all_
clients quite easily (see description of GITWEB_EXPORT_OK in
gitweb/README and gitweb/INSTALL).

If you have something more fancy, check out newest gitweb and take a
look at gitweb/INSTALL: you can now, thanks to commit dd7f5f1 by
Alexander Gavrilov, see
  http://permalink.gmane.org/gmane.comp.version-control.git/99962

HTH
-- 
Jakub Narebski
Poland
ShadeHawk on #git