web interface with gitolite ACL?

[Marc Chantreux]

hello,

we use gitolite+cweb at work and some people argue gitlab would be nicer
because of the web interface ... well ... i have to admit their
interface is sexy but the most important point is ACL: is there a web
interface to git that honor the read/write ACLs of gitolite?

regards

--
Marc Chantreux (eiro on github and freenode)
http://eiro.github.com/
http://eiro.github.com/atom.xml
"Don't believe everything you read on the Internet"
-- Abraham Lincoln

[Sitaram Chamarty]

On 05/15/2015 01:36 PM, Marc Chantreux wrote:
> hello,
>
> we use gitolite+cweb at work and some people argue gitlab would be nicer
> because of the web interface ... well ... i have to admit their
> interface is sexy but the most important point is ACL: is there a web
> interface to git that honor the read/write ACLs of gitolite?

Not as far as I know. It's not easy to get the full power of a text
file into a GUI frame of any kind; it'll always end up being dumbed
down. Text files have sequence and structure, which we understand
intuitively; GUIs don't, and when you force them to, it looks... well,
it looks forced :)

The simple stuff is easy, but I don't think gitlab has proper branch
level permissions even today. I tried to search the docs just now, but
found only something called "protected" branches, which is not granular
enough even for my needs in 2009 when I first wrote gitolite. YNMV.

Gitolite has *lots* of features that are just impossible to GUI-fy.

However, they appear to have all the social coding stuff (code reviews,
comments, issues/tracking, and so on), which I am told is pretty useful.
I wouldn't know; I once changed the topic of #gitolite to

Social Coding. Without the 'social'.

;-)

PS: were you on IRC just now? Someone asked the exact same thing...

[Marc Chantreux]

On Fri, May 15, 2015 at 02:07:30PM +0530, Sitaram Chamarty wrote:
> Not as far as I know. It's not easy to get the full power of a text

... thanks a lot for this answer: need more readings about it all.

> PS: were you on IRC just now? Someone asked the exact same thing...

no but i can /join fast if you tell me the channel.

[Sitaram Chamarty]

On 05/15/2015 02:13 PM, Marc Chantreux wrote:
> On Fri, May 15, 2015 at 02:07:30PM +0530, Sitaram Chamarty wrote:
>> Not as far as I know. It's not easy to get the full power of a text
>
> ... thanks a lot for this answer: need more readings about it all.
>
>> PS: were you on IRC just now? Someone asked the exact same thing...
>
> no but i can /join fast if you tell me the channel.

it's #gitolite on freenode but frankly I gave more detail in this thread
than on IRC so you shouldn't feel compelled to join just for this,
though of course everyone is always welcome :)

[Marc Chantreux]

On Fri, May 15, 2015 at 02:16:42PM +0530, Sitaram Chamarty wrote:
> it's #gitolite on freenode but frankly I gave more detail in this thread
> than on IRC so you shouldn't feel compelled to join just for this,
> though of course everyone is always welcome :)

i have to admit i really prefer mailing lists to exchange about those
kind of ideas.

thanks again and regards

[m...@risca.eu]

> is there a web
> interface to git that honor the read/write ACLs of gitolite?

Maybe something could be possible using gitweb+gitolite. I remember
having read something on the topic but I couldn't find any more the link
to the howto...

This article [1] does what you want, but I remember to have seen also
other ideas to solve the issue.

[1] http://gitolite.com/gitolite/g2/ggshb.html

[Tim Nordell]

We have a per-user trimmed web-view using cgit.

I've created a script that is a frontend to running cgit.  It generates a per-user CGIT configuration file that trims what repositories a given user has access to.  It caches this result, and it stores a md5sum of the user's groups that they belong to in the header of the cgit configuration file.  If this md5sum changes, it regenerates the cgit configuration file.  Also if a special file I added is touched it also regenerates your per-user configuration file if your per-user configuration file is older than that special file.  I update that special file's timestamp any time permissions for any repository is changed, or if any repository is created or removed.  Additionally, I modified cgit so that the cache key for the repository index pages contains the user's ID so that those are cached individually, while the repository specific pages are cached universally.

(I also have the smart-git over http hooked into gitolite so the same page address that feeds the webpage is also the same clone URL users would use.)

- Tim

--
You received this message because you are subscribed to the Google Groups "gitolite" group.
To unsubscribe from this group and stop receiving emails from it, send an email to gitolite+u...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Sitaram Chamarty]

On 05/15/2015 07:22 PM, Tim Nordell wrote:
> We have a per-user trimmed web-view using cgit.
>
> I've created a script that is a frontend to running cgit. It
> generates a per-user CGIT configuration file that trims what
> repositories a given user has access to. It caches this result, and

[snipped]

oh wow; cgit needs all that? gitweb has a way to say "here, call this
perl function with the repo name and the user name, and I'll use the
result of the function to decide if I should show the repo or not".

doc: http://gitolite.com/gitolite/gitweb-daemon.html#repo-specific-authorisation-in-gitweb
sample code: http://gitolite.com/gitolite/gitweb.conf.html

[Tim Nordell]

Sitaram -

Does that hide the fact that repository X exists?  Curious.

Cgit has, since I created our setup, the ability to run a LUA script to determine if someone has access to a given repository.  That could theoretically call into gitolite's access control mechanisms.

- Tim

[Sitaram Chamarty]

On 05/15/2015 09:16 PM, Tim Nordell wrote:
> Sitaram -
>
> Does that hide the fact that repository X exists? Curious.

Pretty sure it does, per the documentation. (You do have to set one
more config option called "strict_<something I forgot>" though but that
is not a hardship).