git through http (or https)

git through http (or https)

[Mark Wielaard]

Hi,

The elfutils git page https://sourceware.org/git/?p=elfutils.git
lists 3 clone URLS:

git://sourceware.org/git/elfutils.git
ssh://sourceware.org/git/elfutils.git
http://sourceware.org/git/elfutils.git

The first two work, but the last one does a 304 redirect to https
but then gives a 403 forbidden.

Could the http (or https) fetch be fixed?
http (or https) is for some people behind restrictive firewalls the
only way to fetch git sources. And it would allow us to redirect
the old fedorahosted http git URL to sourceware.

Thanks,

Mark

Re: git through http (or https)

[Frank Ch. Eigler]

Hi -

> [...]
> http://sourceware.org/git/elfutils.git
> The first two work, but the last one does a 304 redirect to https
> but then gives a 403 forbidden.

This is more or less working now.  (We were missing the
http-dumb-transport hooks/post-update).

- FChE

Re: git through http (or https)

[Mark Wielaard]

On Tue, Jan 03, 2017 at 06:40:52PM -0500, Frank Ch. Eigler wrote:
> > http://sourceware.org/git/elfutils.git
> > The first two work, but the last one does a 304 redirect to https
> > but then gives a 403 forbidden.
> 
> This is more or less working now.  (We were missing the
> http-dumb-transport hooks/post-update).

Very nice. git clone and pull are now working on the http
(and https) URLs.

If the redirect to https is always on then maybe use
https://sourceware.org/git in gitweb_config.perl for
the git_base_url_list?

Also directly viewing https://sourceware.org/git/elfutils.git
still doesn't work because it gets redirected to the underlying
directory which is forbidden to view directly. If I read the
gitweb man page right then the rewrite rules in
htdocs/git/.htaccess would make that work. But they are
currently commented out. Could they be enabled?

That would make redirecting the old fedorahosted git URL
for elfutils work for all cases.

Thanks,

Mark

Re: git through http (or https)

[Frank Ch. Eigler]

Hi -

> [...]  Also directly viewing https://sourceware.org/git/elfutils.git
> still doesn't work [...]

None of the sourceware git repos serve that URL straight to web
browsers.  Try instead:
https://sourceware.org/git/
https://sourceware.org/git/?p=elfutils.git;a=summary

- FChE

Re: git through http (or https)

[Mark Wielaard]

Hi Frank,

On Thu, Jan 05, 2017 at 11:03:16AM -0500, Frank Ch. Eigler wrote:
> > [...]  Also directly viewing https://sourceware.org/git/elfutils.git
> > still doesn't work [...]
> 
> None of the sourceware git repos serve that URL straight to web
> browsers.  Try instead:
> https://sourceware.org/git/
> https://sourceware.org/git/?p=elfutils.git;a=summary

Yes, that is what the rewrite rules would fix.
If you enable the rules in htdocs/git/.htaccess then you can
view the repository using more human readable/discoverable
links. So if you could do that, that would be appreciated.

That is how fedorahosted is also setup (like most git web URLS).
The main issue is that the git clone URL currently
forwards to the underlying directory which then gives a Forbidden
page. That is just confusing. Even if you don't want nicer
URLs for viewing then having the main git clone URL actually
work (might just forward for the ?p=repo.git page) would at
least not make it look like the repository is not there/broken.

If you like, and trust me with admin access, I can also
come up and experiment with the rewrite rules for the .htaccess
file myself.

Thanks,

Mark

Re: git through http (or https)

[Frank Ch. Eigler]

Hi -

> [...]  Yes, that is what the rewrite rules would fix.  If you enable
> the rules in htdocs/git/.htaccess [...]

I put you on the fileacl for /sourceware/www/sourceware/htdocs/git/.htaccess
to play (carefully) with.  It may not be quite so easy due to our symlinks
and various group permissions.

- FChE

Re: git through http (or https)

[Mark Wielaard]

On Thu, Jan 05, 2017 at 03:25:01PM -0500, Frank Ch. Eigler wrote:
> > [...]  Yes, that is what the rewrite rules would fix.  If you enable
> > the rules in htdocs/git/.htaccess [...]
> 
> I put you on the fileacl for /sourceware/www/sourceware/htdocs/git/.htaccess
> to play (carefully) with.  It may not be quite so easy due to our symlinks
> and various group permissions.

You are right. It isn't simple because of the symlinks inside the directory
which seem to get resolved/matched/rewritten before/after any explicit
rewrite rule. In the end the best I could come up with was the following.
It makes sure the "advertised" http[s]://sourceware.org/git/foobar.git
links resolve. But they don't result in "pretty" URLs. I do think it is
better than the current Forbidden results though.

# This seems to be the best we can do given directory/.htaccess rewrite rules
# do get rewritten/matched themselves before/after the rewrite rules even if
# we use the [L] flag. So we match on the ending '/' that comes from following
# the symlink to the underlying directory. Then we do a browser [R]edirect so
# that the results doesn't get rewritten/matched again. This at least rewrite
# the user visible http://sourceware.org/git/foobar.git URLs to something that
# isn't Forbidden (the underlying git directory).
RewriteEngine on
RewriteBase /git/
RewriteRule ^([a-zA-Z/_-]+\.git)/$ ?p=$1 [R,L]

I believe the above is safe and keeps everything working as intended.
But please feel free to revert/remove the rewrite rule if it doesn't
or if you are afraid it might conflict with something.

Thanks,

Mark

Re: git through http (or https)

[Frank Ch. Eigler]

Hi -

> RewriteEngine on
> RewriteBase /git/
> RewriteRule ^([a-zA-Z/_-]+\.git)/$ ?p=$1 [R,L]

Nice solution, works for me.

- FChE