git howtos

# Infrastructure service git

# git.torproject.org and associated services

# Overview

Our git setup consists of three interdependent services:

 * git-rw.torproject.org:  ssh accessible and writeable git repositories

 * git.torproject.org: https:// read-only anonymous access

 * [https://gitweb.torproject.org/ gitweb.torproject.org]: web browsing repositories

 * [gitweb.torproject.org](https://gitweb.torproject.org/): web browsing repositories

When a developer pushes to git-rw, the repository is mirrored to git and so

made available via the gitweb service.

# Regular repositories

would affect the access to the repository. In the case that replies are to be

signed, include the ticket number in the signed text to avoid replay attacks.

The git team member will edit the gitolite configuration to add a new block

(alphabetically sorted within the configuration file) that looks like the

following:

```

repo metrics-cloud

    RW                                       = @metrics-cloud

    config hooks.email-enabled               = true

    config hooks.mailinglist                 = tor-commits@lists.torproject.org

    config hooks.irc-enabled                 = true

    config hooks.ircproject                  = or

    config hooks.githuburl                   = torproject/metrics-cloud

    config hooks.gitlaburl                   = torproject/metrics/metrics-cloud

metrics-cloud "The Tor Project" = "Configurations for Tor Metrics cloud orchestration"

```

The last line of this file is what is used to provide configuration to gitweb.

In this case, the permissions are delegated to a group and not an individual

user. Groups are defined at the top of the file, again in alphabetical order:

```

@metrics-cloud                               = karsten irl

```

Upon push, the new repository will be created. It may take some minutes to

appear on the gitweb. Do not fear, the old list that did not yet include the

new repository has just been cached.

## Adding developers to a repository

If you want access to an existing repository please have somebody who already

[Request a user be added to an existing repository](https://trac.torproject.org/projects/tor/newticket?summary=Please%20add%20%3Cusername%3E%20to%20repository%20%3Crepository%3E.git&component=Internal%20Services/Service%20-%20git&type=task)

The git team member will either add a permissions line to the configuration for

the repository or will add a username to the group, depending on how the

repository is configured.

## Deleting accidentally pushed tags/branches

These requests are for a destructive action and should be signed. You should

also sanity check the request and not just blindly copy/paste the list of

branch names.

The git team member will need to:

1. Edit the gitolite configuration to allow RW+ access for the specified branch

   or tag.

2. Push an empty reference to the remote reference to delete it. In doing this,

   all the hooks will run ensuring that the gitweb mirror and all other external

   mirrors are kept in sync.

3. Revert the commit that gave the git team member this access.

The additional permission line will look something like:

```

    RW+ refs/heads/travis-ci                = irl

    RW+ refs/tags/badtag-v1.0               = irl

```

This is to protect the git team member from accidentally deleting everything,

do not just give yourself `RW+` permissions for the whole repository unless you

are feeling brave, even when someone has accidentally pushed their entire

history of personal branches to the canonical repository.

# User repositories

Developers who have a tpo LDAP account can request personal git repositories be

by other users than the owner. Let's keep it that way or this will get

complicated.

Users will have full access to their own repos and can therefore delete

branches, tags, and perform non-fast-forward pushes.

# Learning what git repos you can read/write

Once you have an LDAP account and have an ssh key set up for it, run:

{{{

```

ssh git@git-rw.torproject.org

}}}

```

and it will tell you what bits you have on which repos. The first column is who

can read (@ for everybody, R for you, blank for not you), and the second column

Some repositories are mirrored to https://github.com/torproject

# Admin details

git-rw runs on `cupani.torproject.org` and runs as the git user. Users in the

gitolite (gid 1504) group can become the git user. The gitolite installation

is contained inside `/srv/git.torproject.org` with the repositories being found

in the `repositories` folder there.

Anonymous git and gitweb run on `vineale.torproject.org` and as the gitweb

user. Users in the gitweb (gid 1505) group can become the gitweb user.

Data for these services can be found in `/srv/gitweb.torproject.org`.