From debbugs-submit-bounces@debbugs.gnu.org Sun Apr 30 12:31:16 2017 Received: (at submit) by debbugs.gnu.org; 30 Apr 2017 16:31:16 +0000 Received: from localhost ([127.0.0.1]:47958 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d4rki-0003P8-Ha for submit@debbugs.gnu.org; Sun, 30 Apr 2017 12:31:16 -0400 Received: from eggs.gnu.org ([208.118.235.92]:38810) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d4rkh-0003Ow-AE for submit@debbugs.gnu.org; Sun, 30 Apr 2017 12:31:15 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1d4rkb-0000Yo-Bb for submit@debbugs.gnu.org; Sun, 30 Apr 2017 12:31:10 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=-0.0 required=5.0 tests=BAYES_40 autolearn=disabled version=3.3.2 Received: from lists.gnu.org ([2001:4830:134:3::11]:54708) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1d4rkb-0000Yj-8j for submit@debbugs.gnu.org; Sun, 30 Apr 2017 12:31:09 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58014) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1d4rka-0006bg-Aa for guix-patches@gnu.org; Sun, 30 Apr 2017 12:31:08 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1d4rkX-0000Xa-81 for guix-patches@gnu.org; Sun, 30 Apr 2017 12:31:08 -0400 Received: from mail.lassieur.org ([83.152.10.219]:36608) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1d4rkW-0000WV-QR for guix-patches@gnu.org; Sun, 30 Apr 2017 12:31:05 -0400 Received: from rodion (88.191.118.83 [88.191.118.83]) by mail.lassieur.org (OpenSMTPD) with ESMTPSA id 9323d54e (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256:NO) for ; Sun, 30 Apr 2017 16:30:58 +0000 (UTC) User-agent: mu4e 0.9.18; emacs 25.2.1 From: =?utf-8?Q?Cl=C3=A9ment?= Lassieur To: guix-patches@gnu.org Subject: Avoid references to the store in authorized_keys Message-ID: <87wpa1q2po.fsf@lassieur.org> Date: Sun, 30 Apr 2017 18:30:57 +0200 MIME-Version: 1.0 Content-Type: text/plain X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x X-Received-From: 2001:4830:134:3::11 X-Spam-Score: -4.1 (----) X-Debbugs-Envelope-To: submit X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -4.1 (----) Note that if gitolite is already installed, one has to remove the references from authorized_keys manually first, because otherwise the old (bugged) gitolite will be used instead of the one in the PATH, and authorized_keys will never be updated. From debbugs-submit-bounces@debbugs.gnu.org Sun Apr 30 12:33:19 2017 Received: (at 26717) by debbugs.gnu.org; 30 Apr 2017 16:33:19 +0000 Received: from localhost ([127.0.0.1]:47964 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d4rmg-0003SH-TF for submit@debbugs.gnu.org; Sun, 30 Apr 2017 12:33:19 -0400 Received: from mail.lassieur.org ([83.152.10.219]:58262) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d4rmf-0003S8-FE for 26717@debbugs.gnu.org; Sun, 30 Apr 2017 12:33:17 -0400 Received: from localhost.localdomain (88.191.118.83 [88.191.118.83]) by mail.lassieur.org (OpenSMTPD) with ESMTPSA id ff623103 (TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128:NO) for <26717@debbugs.gnu.org>; Sun, 30 Apr 2017 16:33:15 +0000 (UTC) From: =?UTF-8?q?Cl=C3=A9ment=20Lassieur?= To: 26717@debbugs.gnu.org Subject: [PATCH] gnu: gitolite: Avoid references to the store in authorized_keys. Date: Sun, 30 Apr 2017 18:32:44 +0200 Message-Id: <20170430163244.2830-1-clement@lassieur.org> X-Mailer: git-send-email 2.12.2 X-Spam-Score: -0.0 (/) X-Debbugs-Envelope-To: 26717 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.0 (/) * gnu/packages/version-control.scm (gitolite)[arguments]: Substitute '$glshell' with 'gitolite-shell' in ssh-authkeys. --- gnu/packages/version-control.scm | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/gnu/packages/version-control.scm b/gnu/packages/version-control.scm index e0770dc58..1cad0f285 100644 --- a/gnu/packages/version-control.scm +++ b/gnu/packages/version-control.scm @@ -628,7 +628,13 @@ also walk each side of a merge and test those changes individually.") ;; invokes Perl. (substitute* (find-files "." ".*") ((" perl -") - (string-append " " perl " -")))))) + (string-append " " perl " -"))) + + ;; Avoid references to the store in authorized_keys. + ;; This works because gitolite-shell is in the PATH. + (substitute* "src/triggers/post-compile/ssh-authkeys" + (("\\$glshell \\$user") + "gitolite-shell $user"))))) (replace 'install (lambda* (#:key outputs #:allow-other-keys) (let* ((output (assoc-ref outputs "out")) -- 2.12.2 From debbugs-submit-bounces@debbugs.gnu.org Sun Apr 30 15:31:35 2017 Received: (at 26717) by debbugs.gnu.org; 30 Apr 2017 19:31:35 +0000 Received: from localhost ([127.0.0.1]:48064 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d4uZ6-0000u9-H0 for submit@debbugs.gnu.org; Sun, 30 Apr 2017 15:31:35 -0400 Received: from perdizione.investici.org ([94.23.50.208]:28212) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d4uYz-0000tp-4A for 26717@debbugs.gnu.org; Sun, 30 Apr 2017 15:31:27 -0400 Received: from [94.23.50.208] (perdizione [94.23.50.208]) (Authenticated sender: niasterisk@grrlz.net) by localhost (Postfix) with ESMTPSA id 6B1E012014B; Sun, 30 Apr 2017 19:31:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cryptolab.net; s=stigmate; t=1493580679; bh=G6ZTDfAz5Xmq7sxMwZ7VpwJmXhfq63dXMLYCS97R2xU=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=HM9KczI+QfJIQkqumIRpVKilnd8xEhzNktVh40YW+siSG0lR5n1N1bdoPsq6jjQPG cnoj26GGDaw9oYpnTLI5mPt0JF+hVF7bjyWWg6dYrXsuNsUcBUfnyF63FhGiQZn4Yx bd5xjmcnJDVbxt+YVsIUoBYQPn/QjomcozpPjF64= Date: Sun, 30 Apr 2017 19:31:17 +0000 From: ng0 To: =?utf-8?Q?Cl=C3=A9ment?= Lassieur Subject: Re: bug#26717: [PATCH] gnu: gitolite: Avoid references to the store in authorized_keys. Message-ID: <20170430193117.setdri6ykdbbmza3@abyayala> Mail-Followup-To: =?utf-8?Q?Cl=C3=A9ment?= Lassieur , 26717@debbugs.gnu.org References: <87wpa1q2po.fsf@lassieur.org> <20170430163244.2830-1-clement@lassieur.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20170430163244.2830-1-clement@lassieur.org> X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 26717 Cc: 26717@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: 0.0 (/) Clément Lassieur transcribed 1.3K bytes: > * gnu/packages/version-control.scm (gitolite)[arguments]: Substitute > '$glshell' with 'gitolite-shell' in ssh-authkeys. > --- > gnu/packages/version-control.scm | 8 +++++++- > 1 file changed, 7 insertions(+), 1 deletion(-) > > diff --git a/gnu/packages/version-control.scm b/gnu/packages/version-control.scm > index e0770dc58..1cad0f285 100644 > --- a/gnu/packages/version-control.scm > +++ b/gnu/packages/version-control.scm > @@ -628,7 +628,13 @@ also walk each side of a merge and test those changes individually.") > ;; invokes Perl. > (substitute* (find-files "." ".*") > ((" perl -") > - (string-append " " perl " -")))))) > + (string-append " " perl " -"))) > + > + ;; Avoid references to the store in authorized_keys. > + ;; This works because gitolite-shell is in the PATH. > + (substitute* "src/triggers/post-compile/ssh-authkeys" > + (("\\$glshell \\$user") > + "gitolite-shell $user"))))) > (replace 'install > (lambda* (#:key outputs #:allow-other-keys) > (let* ((output (assoc-ref outputs "out")) > -- > 2.12.2 > > > > This looks good. I have yet to test it. Do you think we could fix the hook files of gitolite like this too? -- https://pragmatique.xyz PGP: https://people.pragmatique.xyz/ng0/ From debbugs-submit-bounces@debbugs.gnu.org Sun Apr 30 17:58:03 2017 Received: (at 26717) by debbugs.gnu.org; 30 Apr 2017 21:58:03 +0000 Received: from localhost ([127.0.0.1]:48176 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d4wqx-0004M2-6C for submit@debbugs.gnu.org; Sun, 30 Apr 2017 17:58:03 -0400 Received: from mail.lassieur.org ([83.152.10.219]:58268) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d4wqv-0004Lb-2G for 26717@debbugs.gnu.org; Sun, 30 Apr 2017 17:58:01 -0400 Received: from rodion (80.12.33.11 [80.12.33.11]) by mail.lassieur.org (OpenSMTPD) with ESMTPSA id 4c449674 (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256:NO); Sun, 30 Apr 2017 21:57:59 +0000 (UTC) References: <87wpa1q2po.fsf@lassieur.org> <20170430163244.2830-1-clement@lassieur.org> <20170430193117.setdri6ykdbbmza3@abyayala> User-agent: mu4e 0.9.18; emacs 25.2.1 From: =?utf-8?Q?Cl=C3=A9ment?= Lassieur To: ng0 Subject: Re: bug#26717: [PATCH] gnu: gitolite: Avoid references to the store in authorized_keys. In-reply-to: <20170430193117.setdri6ykdbbmza3@abyayala> Date: Sun, 30 Apr 2017 23:57:58 +0200 Message-ID: <87lgqhd0d5.fsf@lassieur.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -0.0 (/) X-Debbugs-Envelope-To: 26717 Cc: Marius Bakke , 26717@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.0 (/) ng0 writes: > Clément Lassieur transcribed 1.3K bytes: >> * gnu/packages/version-control.scm (gitolite)[arguments]: Substitute >> '$glshell' with 'gitolite-shell' in ssh-authkeys. >> --- >> gnu/packages/version-control.scm | 8 +++++++- >> 1 file changed, 7 insertions(+), 1 deletion(-) >> >> diff --git a/gnu/packages/version-control.scm b/gnu/packages/version-control.scm >> index e0770dc58..1cad0f285 100644 >> --- a/gnu/packages/version-control.scm >> +++ b/gnu/packages/version-control.scm >> @@ -628,7 +628,13 @@ also walk each side of a merge and test those changes individually.") >> ;; invokes Perl. >> (substitute* (find-files "." ".*") >> ((" perl -") >> - (string-append " " perl " -")))))) >> + (string-append " " perl " -"))) >> + >> + ;; Avoid references to the store in authorized_keys. >> + ;; This works because gitolite-shell is in the PATH. >> + (substitute* "src/triggers/post-compile/ssh-authkeys" >> + (("\\$glshell \\$user") >> + "gitolite-shell $user"))))) >> (replace 'install >> (lambda* (#:key outputs #:allow-other-keys) >> (let* ((output (assoc-ref outputs "out")) >> -- >> 2.12.2 >> >> >> >> > > This looks good. I have yet to test it. Do you think we could fix the hook files of gitolite like this too? Well, I don't think so because the mechanism used in hooks is different: the reference to the store is in the shebang and shebangs need absolute paths, they don't look at PATH. We could use 'env' though, as suggested by Marius here: http://lists.gnu.org/archive/html/guix-patches/2017-03/msg00339.html. As in: #!/run/current-system/profile/bin/env perl Assuming /run/current-system/profile/bin/env exists on all possible setups. WDYT? From debbugs-submit-bounces@debbugs.gnu.org Wed May 03 15:47:30 2017 Received: (at 26717-done) by debbugs.gnu.org; 3 May 2017 19:47:30 +0000 Received: from localhost ([127.0.0.1]:53196 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d60FG-0003Vs-5H for submit@debbugs.gnu.org; Wed, 03 May 2017 15:47:30 -0400 Received: from mail.lassieur.org ([83.152.10.219]:58388) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d60FE-0003Vj-Gg for 26717-done@debbugs.gnu.org; Wed, 03 May 2017 15:47:29 -0400 Received: from rodion (88.191.118.83 [88.191.118.83]) by mail.lassieur.org (OpenSMTPD) with ESMTPSA id f679fb5f (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256:NO); Wed, 3 May 2017 19:47:26 +0000 (UTC) References: <87wpa1q2po.fsf@lassieur.org> <20170430163244.2830-1-clement@lassieur.org> <20170430193117.setdri6ykdbbmza3@abyayala> User-agent: mu4e 0.9.18; emacs 25.2.1 From: =?utf-8?Q?Cl=C3=A9ment?= Lassieur To: ng0 Subject: Re: bug#26717: [PATCH] gnu: gitolite: Avoid references to the store in authorized_keys. In-reply-to: <20170430193117.setdri6ykdbbmza3@abyayala> Date: Wed, 03 May 2017 21:47:26 +0200 Message-ID: <87r3057mep.fsf@lassieur.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -0.0 (/) X-Debbugs-Envelope-To: 26717-done Cc: 26717-done@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.0 (/) ng0 writes: > Clément Lassieur transcribed 1.3K bytes: >> * gnu/packages/version-control.scm (gitolite)[arguments]: Substitute >> '$glshell' with 'gitolite-shell' in ssh-authkeys. >> --- >> gnu/packages/version-control.scm | 8 +++++++- >> 1 file changed, 7 insertions(+), 1 deletion(-) >> >> diff --git a/gnu/packages/version-control.scm b/gnu/packages/version-control.scm >> index e0770dc58..1cad0f285 100644 >> --- a/gnu/packages/version-control.scm >> +++ b/gnu/packages/version-control.scm >> @@ -628,7 +628,13 @@ also walk each side of a merge and test those changes individually.") >> ;; invokes Perl. >> (substitute* (find-files "." ".*") >> ((" perl -") >> - (string-append " " perl " -")))))) >> + (string-append " " perl " -"))) >> + >> + ;; Avoid references to the store in authorized_keys. >> + ;; This works because gitolite-shell is in the PATH. >> + (substitute* "src/triggers/post-compile/ssh-authkeys" >> + (("\\$glshell \\$user") >> + "gitolite-shell $user"))))) >> (replace 'install >> (lambda* (#:key outputs #:allow-other-keys) >> (let* ((output (assoc-ref outputs "out")) >> -- >> 2.12.2 >> >> >> >> > > This looks good. I have yet to test it. Do you think we could fix the hook files of gitolite like this too? Thank you :) I pushed it. From debbugs-submit-bounces@debbugs.gnu.org Thu May 04 04:50:22 2017 Received: (at 26717) by debbugs.gnu.org; 4 May 2017 08:50:22 +0000 Received: from localhost ([127.0.0.1]:53513 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d6CSs-0006Fy-7G for submit@debbugs.gnu.org; Thu, 04 May 2017 04:50:22 -0400 Received: from mail.lassieur.org ([83.152.10.219]:58408) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1d6CSq-0006Fp-1n for 26717@debbugs.gnu.org; Thu, 04 May 2017 04:50:20 -0400 Received: from newt (46.218.109.88 [46.218.109.88]) by mail.lassieur.org (OpenSMTPD) with ESMTPSA id fc07d92a (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256:NO); Thu, 4 May 2017 08:50:17 +0000 (UTC) References: <87wpa1q2po.fsf@lassieur.org> <20170430163244.2830-1-clement@lassieur.org> <20170430193117.setdri6ykdbbmza3@abyayala> <87lgqhd0d5.fsf@lassieur.org> User-agent: mu4e 0.9.18; emacs 25.2.1 From: =?utf-8?Q?Cl=C3=A9ment?= Lassieur To: ng0 Subject: Re: bug#26717: [PATCH] gnu: gitolite: Avoid references to the store in authorized_keys. In-reply-to: <87lgqhd0d5.fsf@lassieur.org> Date: Thu, 04 May 2017 10:50:17 +0200 Message-ID: <87d1bpatva.fsf@lassieur.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -0.0 (/) X-Debbugs-Envelope-To: 26717 Cc: Marius Bakke , 26717@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.0 (/) Clément Lassieur writes: > ng0 writes: >> This looks good. I have yet to test it. Do you think we could fix the hook files of gitolite like this too? > > Well, I don't think so because the mechanism used in hooks is different: > the reference to the store is in the shebang and shebangs need absolute > paths, they don't look at PATH. We could use 'env' though, as suggested > by Marius here: > http://lists.gnu.org/archive/html/guix-patches/2017-03/msg00339.html. > As in: > > #!/run/current-system/profile/bin/env perl > > Assuming /run/current-system/profile/bin/env exists on all possible > setups. WDYT? This won't work on a non-GuixSD OS. I can't find a simple solution. From unknown Tue Sep 09 12:24:26 2025 Received: (at fakecontrol) by fakecontrolmessage; To: internal_control@debbugs.gnu.org From: Debbugs Internal Request Subject: Internal Control Message-Id: bug archived. Date: Thu, 01 Jun 2017 11:24:04 +0000 User-Agent: Fakemail v42.6.9 # This is a fake control message. # # The action: # bug archived. thanks # This fakemail brought to you by your local debbugs # administrator