prime8dev

git.go (4299B)

---

 package ssh
 
 import (
 	"errors"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"regexp"
 	"strings"
 
 	charmssh "github.com/charmbracelet/ssh"
 )
 
 const defaultGitReposDir = "/srv/git/repos"
 
 var repoNameRegex = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._-]*$`)
 
 // gitReposDir is where the bare repositories live (env GIT_REPOS_DIR).
 func gitReposDir() string {
 	if dir := strings.TrimSpace(os.Getenv("GIT_REPOS_DIR")); dir != "" {
 		return dir
 	}
 	return defaultGitReposDir
 }
 
 // repoName maps the path a git client asks for ("janitor.git", "/janitor",
 // "~/janitor.git") to a bare repo name.
 func repoName(requested string) (string, bool) {
 	name := strings.TrimPrefix(strings.TrimSpace(requested), "~")
 	name = strings.Trim(name, "/")
 	name = strings.TrimSuffix(name, ".git")
 	if !repoNameRegex.MatchString(name) || strings.Contains(name, "..") {
 		return "", false
 	}
 	return name, true
 }
 
 // publicRepoDir maps a requested path to a public bare repo directory. Only
 // repos marked with git-daemon-export-ok are served to guests.
 func publicRepoDir(requested string) (string, bool) {
 	name, ok := repoName(requested)
 	if !ok {
 		return "", false
 	}
 	dir := filepath.Join(gitReposDir(), name+".git")
 	if _, err := os.Stat(filepath.Join(dir, "git-daemon-export-ok")); err != nil {
 		return "", false
 	}
 	return dir, true
 }
 
 // ownerRepoDir maps a requested path to any existing bare repo, private
 // ones included.
 func ownerRepoDir(requested string) (string, bool) {
 	name, ok := repoName(requested)
 	if !ok {
 		return "", false
 	}
 	dir := filepath.Join(gitReposDir(), name+".git")
 	if _, err := os.Stat(filepath.Join(dir, "HEAD")); err != nil {
 		return "", false
 	}
 	return dir, true
 }
 
 // gitService returns the git service a session asks for, or "".
 func gitService(sess charmssh.Session) string {
 	cmd := sess.Command()
 	if len(cmd) != 2 {
 		return ""
 	}
 	switch cmd[0] {
 	case "git-upload-pack", "git-receive-pack":
 		return cmd[0]
 	}
 	return ""
 }
 
 // serveGit runs a git service for the session and returns its exit code.
 // Guests may only fetch public repos. The owner may fetch any repo and push,
 // and a push to a new name creates it (private until marked export-ok).
 func serveGit(sess charmssh.Session, service string, owner bool) int {
 	requested := sess.Command()[1]
 	var (
 		dir string
 		ok  bool
 	)
 	switch {
 	case service == "git-upload-pack" && owner:
 		dir, ok = ownerRepoDir(requested)
 	case service == "git-upload-pack":
 		dir, ok = publicRepoDir(requested)
 	case owner:
 		dir, ok = ownerRepoDir(requested)
 		if !ok {
 			dir, ok = createRepo(sess, requested)
 		}
 	default:
 		_, _ = sess.Stderr().Write([]byte("fatal: push needs the owner's key\n"))
 		return 128
 	}
 	if !ok {
 		_, _ = sess.Stderr().Write([]byte("fatal: repository not found\n"))
 		return 128
 	}
 
 	var cmd *exec.Cmd
 	if service == "git-upload-pack" {
 		cmd = exec.CommandContext(sess.Context(), "git-upload-pack", "--strict", "--timeout=60", dir)
 	} else {
 		cmd = exec.CommandContext(sess.Context(), "git", "-c", "core.hooksPath="+gitHooksDir(), "receive-pack", dir)
 	}
 	cmd.Env = append(os.Environ(), "GIT_PROTOCOL="+sessionEnv(sess, "GIT_PROTOCOL"))
 	cmd.Stdin = sess
 	cmd.Stdout = sess
 	cmd.Stderr = sess.Stderr()
 
 	if err := cmd.Run(); err != nil {
 		var exitErr *exec.ExitError
 		if errors.As(err, &exitErr) {
 			return exitErr.ExitCode()
 		}
 		return 128
 	}
 	return 0
 }
 
 // gitHooksDir holds the hooks every push runs (env GIT_HOOKS_DIR). The repos'
 // own hooks are host scripts that don't exist in the container.
 func gitHooksDir() string {
 	if dir := strings.TrimSpace(os.Getenv("GIT_HOOKS_DIR")); dir != "" {
 		return dir
 	}
 	return "/app/git-hooks"
 }
 
 func createRepo(sess charmssh.Session, requested string) (string, bool) {
 	name, ok := repoName(requested)
 	if !ok {
 		return "", false
 	}
 	dir := filepath.Join(gitReposDir(), name+".git")
 	cmd := exec.CommandContext(sess.Context(), "git", "init", "-q", "--bare", "-b", "master", dir)
 	cmd.Stderr = sess.Stderr()
 	if err := cmd.Run(); err != nil {
 		return "", false
 	}
 	_, _ = sess.Stderr().Write([]byte("created private repo " + name + ".git\n"))
 	return dir, true
 }
 
 func sessionEnv(sess charmssh.Session, key string) string {
 	for _, kv := range sess.Environ() {
 		if k, v, ok := strings.Cut(kv, "="); ok && k == key {
 			return v
 		}
 	}
 	return ""
 }