.TH HEDGE 1 hedge
.SH NAME
hedge \- git access control for ssh
.SH SYNOPSIS
.B hedge
.I id
.SH DESCRIPTION
.B hedge
is run as the forced command of an ssh key and lets the identity
.I id
fetch from or push to the repositories the
.B acl
file grants it.
It reads the git command from
.BR SSH_ORIGINAL_COMMAND ,
checks it and hands it to
.B gitshell
as
.IR verb " '" root / repo .git'.
Any other command, including an interactive login, is refused.
.P
.B git-upload-pack
and
.B git-upload-archive
need read access,
.B git-receive-pack
needs write access.
Write access implies read access.
.P
The repository path may be quoted, may start with a slash and may end
with a slash or
.BR .git .
What remains must consist of
.BR / -separated
segments matching
.BR ^[A-Za-z0-9_][A-Za-z0-9._-]*$ ,
so nested repositories such as
.B group/repo
are allowed.
.SH FILES
.TP
.B acl
One grant per line:
.IP
.nf
.IR repo " " read | write " " id
.fi
.IP
Fields are separated by a single space and
.I repo
is written without
.BR .git .
There are no comments or wildcards.
.TP
.IR root / repo .git
The bare repositories.
.SH EXIT STATUS
.TP
.B 1
Access was denied or
.B gitshell
could not be run.
.P
Otherwise the exit status is that of
.BR git-shell .
.SH EXAMPLES
.B acl:
.P
.nf
greenhouse write lostduk
greenhouse read alice
.fi
.P
.BR authorized_keys :
.P
.nf
command="/usr/local/bin/hedge lostduk",restrict ssh-ed25519 AAAA...
.fi
.P
Clone with
.IR "git clone git@host:greenhouse" .
.SH CUSTOMIZATION
.B hedge
is configured by editing
.I config.h
and recompiling.
.SH SEE ALSO
.BR git-shell (1),
.BR sshd (8)