Gitolite Essentials: Sophisticated access control for your Git server is now in reach with this fantastic introduction to Gitolite. In easy to follow chapters it takes you through the steps to managing users and repositories securely and efficiently.

What do you get with Print?

Instant access to your digital copy whilst your Print order is Shipped

Paperback book shipped to your preferred address

Redeem a companion digital copy on all Print orders

Access this title in our online reader with advanced features

DRM FREE - Read whenever, wherever and however you want

AI Assistant (beta) to help accelerate your learning

Gitolite Essentials

Chapter 1. Getting Started with Gitolite

Git is one of the most popular version control systems currently available, and several thousands of projects, new and old, have started using it in the past few years. You might have also used it, and shortly after, realized that Git does not do much for Access Control by itself. You need an access control system that is simple and quick to install and get running, yet flexible and powerful enough for your future needs.

This chapter will describe what Gitolite is, and why you might need it. It shows a few examples of the basic features, and also shows you how you can try out Gitolite safely. It assumes that you have some basic knowledge of Git, and have used Git both locally and with a remote repository.

Common Access Control needs

Git server administrators face a bit of a challenge. The high uptake rate of Git means that there are thousands of developers who are not really familiar with Git, and who therefore may be running Git commands that cause irreversible or highly disruptive changes to the Git repository. Furthermore, Git itself does not help much with this; whatever access controls it has, apply to the entire repository, and cannot be made more fine-grained.

For instance, the master branch in most projects represents the most stable code. Yet, a junior developer can easily run a command such as git push origin +master, (which pushes the developer's local branch onto the server) and thus overwrite weeks or months of hardwork by the rest of the team. People with deeper Git expertise can probably recover the lost commits, but it would certainly take time and effort.

Worse, Git's command syntax sometimes makes it worse. For example, the command to delete the master branch is only slightly different from a normal push, that is, git push origin :master (notice the extra colon?).

The most common need, therefore, is to prevent these kinds of accidents: overwriting (or rewinding) one or more commits, and deleting a branch or a tag.

Git itself does provide some measure of protection. You can set the config items receive.denyDeletes and receive.denyNonFastForwards to true. Unfortunately, this is a bit of a blunt instrument—now no one can delete or rewind any branch!

In larger setups with several repositories and several developers, you may also be concerned about allowing everyone to read all repositories. Or it may be that some roles (such as a test engineer) should not need to write to the repository; read-only access is sufficient. Up to a certain point, this problem can be solved with Unix permissions and user/group permissions applied judiciously. Perhaps even POSIX ACLs can be used if you're comfortable with that sort of thing.

However, using POSIX ACLs and user/group permissions has several disadvantages:

Each Git user needs a corresponding Unix user ID on the server.
Managing access rights can only be done by using the usermod and setfacl commands.
Checking the current set of permissions is not straightforward. You will need to run multiple commands and correlate their output manually.
Auditing changes in permissions over time is impossible because no history is kept by the system.

These disadvantages require a lot of effort to manage even a few repositories and users, and even a modestly sized setup would quickly become unmanageable.

Sampling of Gitolite's power features

The access control examples show the most commonly used feature of Gitolite, the repository and branch level access control, but of course Gitolite has many more features. In this section, we will briefly look at a few of them while noting that there are many more waiting in the wings for you to find as you read this book.

Creating groups

Gitolite allows you to create groups of users or repositories for convenience. Think back to Alice and Bob, our junior developers. Let's say you had several rules that Alice and Bob needed to be mentioned in. Clearly, this is too cumbersome; every time a new developer joined the team, you'd have to change all the rules to add him or her.

Gitolite lets you do this by using the following command:

@junior-devs    =  alice bob

Later, it lets you do this by using the following command:

repo foo
  RW                    =  @junior-devs
  RW+                   =  carol david
  RW+  sandbox/         =  @junior-devs

This allows you to add the junior developer in just one place at the top of the configuration file instead of potentially several places all over. More importantly, from the administrator's point of view, it serves as excellent documentation for the rules themselves; isn't it easier to reason about the rules when a descriptive group name is used rather than actual usernames?

Personal branches

Gitolite allows the administrator to give each developer a unique set of branches, called personal branches, that only he or she can create, push, or delete. This is a very convenient way to allow quick backups of work-in-progress branches, or share code for preliminary review.

We saw how the sandbox area was defined:

  RW+  sandbox/  =  alice bob

However, this does nothing to prevent one junior developer from accidentally wiping out another's branches. For example, Alice could delete a branch called sandbox/bob/work that Bob may have pushed. You can use the special word USER as a directory name to solve this problem:

  RW+  sandbox/USER/  =  alice bob

This works as if you had specified each user individually, like this:

  RW+  sandbox/alice/   =  alice
  RW+  sandbox/bob/     =  bob

Now, the set of branches that Alice is allowed to push is limited to those starting with sandbox/alice/, and she can no longer push or delete a branch called, say, sandbox/bob/work.

Personal repositories

With Gitolite, the administrator can choose to let the user create their own repositories, in addition to the ones that the administrator themselves creates. For this example, ignore the syntax, which will be explained in a much later chapter, but just focus on the functionality now:

repo dev/CREATOR/[a-z].*
  C       =  @staff
  RW+     =  CREATOR

This allows members of the @staff group to create repositories whose names match the pattern supplied, which just means dev/<username>/<anything starting with a lowercase alphabetic character>. For example, a user called alice will be able to create repositories such as dev/alice/foo and dev/alice/bar.

Trying out Gitolite

It's very easy to try out Gitolite in a safe environment without affecting anything else in the system in any permanent manner. Gitolite has a fairly complete set of test scripts, and the officially supported method of trying out Gitolite simply uses a couple of these test scripts to automatically install and set up Gitolite.

At the end of this process, you will have a version of Gitolite all set up and ready to use. You will also have an "admin" user, and six "normal" users, using which you can try out most of the features of Gitolite (with the exception of some advanced features such as mirroring).

Preparing for the setup

You will need the following in order to try out Gitolite:

A Unix (Linux, BSD, HP-UX, AIX, Solaris, and so on) server
Git version 1.7.1 or later installed on the server
Perl 5.8.8 or later version installed on the server
An OpenSSH-compatible SSH daemon installed and running on the server
Root access to the server in order to create a new throw away user to do the testing in

At the time of writing this book, Git 1.7.1 is over three years old, and Perl 5.8.8 is quite a bit older than that, so almost any recent Linux or BSD system should work fine.

Installing and setting up a test instance

With the prerequisites at hand, here's how you would get yourself a test instance of Gitolite to try out:

Log in as root (using whatever commands your OS/distro requires to do that) and create a new throw away user. You can call this anything you want, but we will use the name gitolite-test here. Please do not use an existing user for this!
Log in as the gitolite-test user.
Get the Gitolite sources from the official repository, git clone git://github.com/gitolite/gitolite.
You can get this from any other clone of the gitolite sources if your server cannot directly access the internet. Just substitute the URL you have in the preceding clone command.
Switch to the directory that was just cloned using the following command:
```
cd gitolite
```
Install and set up Gitolite in test mode using the following command:
```
env GITOLITE_TEST=y prove t/ssh*
```
Go back to the HOME directory:
```
cd
```

This will churn through two of the test scripts. You will see a warning about an authorized_keys file being created, which you can ignore, and finally a message saying All tests successful, with some statistics on the test run.

At the end of that process, you should have the following: one "admin" user (called admin) and six normal users (named u1 through u6). These users are simulated using an ssh feature. If you are familiar with ssh, you can look in ~/.ssh/config to see how this is done.

Playing with Gitolite

You can now use the test setup of gitolite from the previous section. Here's a sample set of commands with notes to start you off:

Clone the special gitolite-admin repository:

$ git clone admin:gitolite-admin 
Cloning into 'gitolite-admin'... 
remote: Counting objects: 8, done. 
remote: Compressing objects: 100% (4/4), done. 
remote: Total 8 (delta 1), reused 0 (delta 0) 
Receiving objects: 100% (8/8), done. 
Resolving deltas: 100% (1/1), done.

Examine the contents of the clone:

$ cd gitolite-admin/ 
$ ls -a 
.  ..  conf  .git 
$ ls -a conf 
.  ..  gitolite.conf

Edit the conf/gitolite.conf file and add the following lines, which tell Gitolite to create a new repository called bar and allow users u1 and u2 all rights to it:

repo bar
  RW+  =  u1 u2

Save the file, then add the change (git add) and commit the file (git commit):

$ git add conf/gitolite.conf 
$ git commit -m 'added repo bar' 
[master 1111cee] added repo bar 
 1 file changed, 3 insertions(+) 
$ git push 
Counting objects: 7, done. 
Delta compression using up to 4 threads. 
Compressing objects: 100% (2/2), done. 
Writing objects: 100% (4/4), 338 bytes | 0 bytes/s, done. 
Total 4 (delta 1), reused 0 (delta 0) 
remote: Initialized empty Git repository in /home/gitolite-test/repositories/bar.git/ 
To admin:gitolite-admin 
   f226f28..1111cee  master -> master

As you can see, we've just created a new repository called bar. If you look at the output carefully, you might notice, among the familiar output of a git push command, a line saying that an empty Git repository was initialized on the server. This is useful because you don't have to log on to the server to create the repository—Gitolite takes care of it.

Let's look at some access rights. Running ssh against the server and supplying info as the command will show you what repositories you have access to:

$ ssh admin info 
hello admin, this is gitolite-test@server running gitolite3 v3.5.3.1-6-g5bdc750 on git 1.8.3.1 

 R W  gitolite-admin 
 R W  testing 
$ ssh u1 info 
hello u1, this is gitolite-test@server running gitolite3 v3.5.3.1-6-g5bdc750 on git 1.8.3.1 

 R W  bar 
 R W  foo 
 R W  testing 
$ ssh u3 info 
hello u3, this is gitolite-test@server running gitolite3 v3.5.3.1-6-g5bdc750 on git 1.8.3.1 

 R W  foo 
 R W  testing

The preceding command shows you a list of the repositories you have access to, and for each of them, whether you can read and write to the repository, or you have read-only access.

Tip

A note on command and URL syntax

Remember that we are running the Gitolite server, as well as simulating the seven different users, on the same Unix user (which is gitolite-test). As a result, you are able to use commands such as git clone admin:gitolite-admin and ssh u1 info. In a real setup, you will represent yourself, and the server will be elsewhere. The commands will be of the form git clone gitolite-test@server:gitolite-admin and ssh gitolite-test@server info.

Description

The book is written to suit an easy-reading style, using typical problems in access control to illustrate the need for each Gitolite feature explained. This book is for system administrators or development managers who need to keep a lid on Git-based development workflows. Basic knowledge of Git as well as of the Unix shell is helpful.

What do you get with Print?

Instant access to your digital copy whilst your Print order is Shipped

Paperback book shipped to your preferred address

Redeem a companion digital copy on all Print orders

Access this title in our online reader with advanced features

DRM FREE - Read whenever, wherever and however you want

AI Assistant (beta) to help accelerate your learning

Frequently bought together

$50.99

$34.99

Total $ 85.98

Jeff Aug 01, 2014

Great overall description of what Gitolite can do. Being the original creator won't take donations, this is a great way to give back.

Amazon Verified review

Darren M Jun 10, 2014

I purchased this book as I was hoping to get more information than what is already available for free online; however I was disappointed that it really doesn't have much more. There are some sections that expand beyond what is already available, but then others are omitted entirely - such as no mention of subconf. For me it didn't have what I was looking for.

Gitolite Essentials: Sophisticated access control for your Git server is now in reach with this fantastic introduction to Gitolite. In easy to follow chapters it takes you through the steps to managing users and repositories securely and efficiently.

What do you get with Print?

Gitolite Essentials

Chapter 1. Getting Started with Gitolite

Common Access Control needs

Access Control example with Gitolite

Tip

Sampling of Gitolite's power features

Creating groups

Personal branches

Personal repositories

Gitolite and the Git control flow

Trying out Gitolite

Preparing for the setup

Installing and setting up a test instance

Playing with Gitolite

Tip

Summary

Page 1 of 7

Description

Product Details

What do you get with Print?

Product Details

Frequently bought together

Table of Contents

Recommendations for you

Customer reviews

People who bought this also bought

About the author

FAQs

Gitolite Essentials: Sophisticated access control for your Git server is now in reach with this fantastic introduction to Gitolite. In easy to follow chapters it takes you through the steps to managing users and repositories securely and efficiently.

What do you get with Print?

Contact Details

Shipping Address

Billing Address

Description

Product Details

What do you get with Print?

Contact Details

Shipping Address

Billing Address

Product Details

Packt Subscriptions

Frequently bought together

Table of Contents

Recommendations for you

Customer reviews

People who bought this also bought

About the author

FAQs

Create a Free Account To Continue Reading

Sign in to activate your 7-day free access