greenhouse

greenhouse / hedge / hedge.196 lines · 1695B · raw
1.TH HEDGE 1 hedge\-VERSION
2.SH NAME
3hedge \- git access control for ssh
4.SH SYNOPSIS
5.B hedge
6.I id
7.br
8.B hedge
9.B \-v
10.SH DESCRIPTION
11.B hedge
12is run as the forced command of an ssh key and lets the identity
13.I id
14fetch from or push to the repositories the
15.B acl
16file grants it.
17It reads the git command from
18.BR SSH_ORIGINAL_COMMAND ,
19checks it and hands it to
20.B gitshell
21as
22.IR verb " '" root / repo .git'.
23Any other command, including an interactive login, is refused.
24.P
25.B git-upload-pack
26and
27.B git-upload-archive
28need read access,
29.B git-receive-pack
30needs write access.
31Write access implies read access.
32.P
33The repository path may be quoted, may start with a slash and may end
34with a slash or
35.BR .git .
36What remains must consist of
37.BR / -separated
38segments matching
39.BR ^[A-Za-z0-9_][A-Za-z0-9._-]*$ ,
40so nested repositories such as
41.B group/repo
42are allowed.
43.SH OPTIONS
44.TP
45.B \-v
46prints version information to stderr, then exits.
47.SH FILES
48.TP
49.B acl
50One grant per line:
51.IP
52.nf
53.IR repo " " read | write " " id
54.fi
55.IP
56Fields are separated by a single space and
57.I repo
58is written without
59.BR .git .
60There are no comments or wildcards.
61.TP
62.IR root / repo .git
63The bare repositories.
64.SH EXIT STATUS
65.TP
66.B 1
67Access was denied or
68.B gitshell
69could not be run.
70.P
71Otherwise the exit status is that of
72.BR git-shell .
73.SH EXAMPLES
74.B acl:
75.P
76.nf
77greenhouse write lostduk
78greenhouse read alice
79.fi
80.P
81.BR authorized_keys :
82.P
83.nf
84command="/usr/local/bin/hedge lostduk",restrict ssh-ed25519 AAAA...
85.fi
86.P
87Clone with
88.IR "git clone git@host:greenhouse" .
89.SH CUSTOMIZATION
90.B hedge
91is configured by editing
92.I config.h
93and recompiling.
94.SH SEE ALSO
95.BR git-shell (1),
96.BR sshd (8)