You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@subversion.apache.org by Duncan Booth <du...@suttoncourtenay.org.uk> on 2006/05/03 12:47:29 UTC
Automatic updating on a checkin
The FAQ has an answer for "I'm managing a website in my repository. How can
I make the live site automatically update after every commit?", but I want
to update a working copy on a system which isn't the subversion server.
Does anyone have any suggestions how best to arrange that a checkin to the
subversion server does an update on another server (or more likely separate
servers: a development one for the trunk checkins and a live one which
updates only from a specific branch or tag)? I can think of lots of ways to
do it, but if anyone who has already done this would be willing to share
their experience I think it might make my life easier.
Options I've thought of so far:
Polling. Easy to implement, but doesn't scale at all nicely.
rsh and wget both sound plausible, but I need to figure out whether to
worry about security.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: Automatic updating on a checkin
Posted by Rainer Sokoll <R....@intershop.de>.
On Wed, May 03, 2006 at 12:47:29PM +0000, Duncan Booth wrote:
> The FAQ has an answer for "I'm managing a website in my repository. How can
> I make the live site automatically update after every commit?", but I want
> to update a working copy on a system which isn't the subversion server.
>
> Does anyone have any suggestions how best to arrange that a checkin to the
> subversion server does an update on another server (or more likely separate
> servers: a development one for the trunk checkins and a live one which
> updates only from a specific branch or tag)?
I would use a post-commit hook that ssh'es into the remote server and
then there calls svn up.
No polling needed, but nearly realtime.
Rainer
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: Automatic updating on a checkin
Posted by Nico Kadel-Garcia <nk...@comcast.net>.
Duncan Booth wrote:
> The FAQ has an answer for "I'm managing a website in my repository.
> How can I make the live site automatically update after every
> commit?", but I want to update a working copy on a system which isn't
> the subversion server.
>
> Does anyone have any suggestions how best to arrange that a checkin
> to the subversion server does an update on another server (or more
> likely separate servers: a development one for the trunk checkins and
> a live one which updates only from a specific branch or tag)? I can
> think of lots of ways to do it, but if anyone who has already done
> this would be willing to share their experience I think it might make
> my life easier.
I've used an export of the web directory via WebDAV/HTTPS, and a cron job to
do the updates on a scheduled basis. Alternatively, if the directory can be
exported via CIFS or AFS (as a more reliable and secure from off-site
network directory mounting technique), the user can then do their own
updates in order to do their own resolution of any conflicts.
OpenAFS to Linux and Windows clients is something I've used in the past, but
I've never tried a subversion location with it. Unfortunately, too many web
editing tools auto-expand URL's for you, so that "href=filename.html"
becomes "hrefe=file:///E:/webdir/filename.html", and life gets severely
nutty.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: Automatic updating on a checkin
Posted by Duncan Booth <du...@suttoncourtenay.org.uk>.
Mads B. Tandrup wrote:
> Duncan Booth wrote:
>>
>> The hook would be running as the apache user on the subversion
>> server, so the 'svn up' needs to be kicked off as a different user. I
>> would rather not trust the apache user from the svn server further
>> than necessary, so I would like some solution which allows a specific
>> command to be run but not others: maybe ssh+sudo, or should that be
>> sudo+ssh?
>>
>
> Have a look at the OpenSSH sshd documentation. Under "AUTHORIZED_KEYS
> FILE FORMAT" you'll find the following option:
>
> command="command"
> Specifies that the command is executed whenever this key is used
> for authentication. The command supplied by the user (if any) is
> ignored. The command is run on a pty if the client requests a
> pty; otherwise it is run without a tty. If an 8-bit clean chan-
> nel is required, one must not request a pty or should specify no-
> pty. A quote may be included in the command by quoting it with a
> backslash. This option might be useful to restrict certain pub-
> lic keys to perform just a specific operation. An example might
> be a key that permits remote backups but nothing else. Note that
> the client may specify TCP and/or X11 forwarding unless they are
> explicitly prohibited. Note that this option applies to shell,
> command or subsystem execution.
>
> So you will be able to generate an SSH key for your Apache server
> which only supports doing an "svn up /foo/bar".
>
Ok, I think I now have this working. The post-commit hook script uses the
following ssh command:
/usr/bin/ssh -x -n -o BatchMode=yes -i <path to id file> <user>@<remote
host> post-commit $REPOS $REV
(with obvious substitutions for bits in angle brackets). For some reason I
don't quite understand, until I added the BatchMode option the commit kept
hanging even though it shouldn't be prompting for a password.
On the remote system, /home/<user>/.ssh/authorized_keys looks like:
command="/home/<user>/post-commit-hook",no-pty,no-X11-forwarding,no-port-
forwarding ssh-dss ...
and the hook script itself can get at the arguments (if it should need
them) in $SSH_ORIGINAL_COMMAND
That seems to meet my wishes quite nicely: the explicit id file means I can
link different repositories to different hook scripts on the remote machine
and tie each one down to a specific command.
Thanks.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: Automatic updating on a checkin
Posted by Duncan Booth <du...@suttoncourtenay.org.uk>.
Mads B. Tandrup wrote:
> Duncan Booth wrote:
>>
>> The hook would be running as the apache user on the subversion
>> server, so the 'svn up' needs to be kicked off as a different user. I
>> would rather not trust the apache user from the svn server further
>> than necessary, so I would like some solution which allows a specific
>> command to be run but not others: maybe ssh+sudo, or should that be
>> sudo+ssh?
>>
>
> Have a look at the OpenSSH sshd documentation. Under "AUTHORIZED_KEYS
> FILE FORMAT" you'll find the following option:
>
> command="command"
> Specifies that the command is executed whenever this key is used
> for authentication. The command supplied by the user (if any) is
> ignored. The command is run on a pty if the client requests a
> pty; otherwise it is run without a tty. If an 8-bit clean chan-
> nel is required, one must not request a pty or should specify no-
> pty. A quote may be included in the command by quoting it with a
> backslash. This option might be useful to restrict certain pub-
> lic keys to perform just a specific operation. An example might
> be a key that permits remote backups but nothing else. Note that
> the client may specify TCP and/or X11 forwarding unless they are
> explicitly prohibited. Note that this option applies to shell,
> command or subsystem execution.
>
> So you will be able to generate an SSH key for your Apache server
> which only supports doing an "svn up /foo/bar".
>
Ah, thanks for that, I didn't know about that option. I think that I should
be able to do something with that.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: Automatic updating on a checkin
Posted by "Mads B. Tandrup" <ma...@yahoo.com>.
Duncan Booth wrote:
>
> The hook would be running as the apache user on the subversion server, so
> the 'svn up' needs to be kicked off as a different user. I would rather not
> trust the apache user from the svn server further than necessary, so I
> would like some solution which allows a specific command to be run but not
> others: maybe ssh+sudo, or should that be sudo+ssh?
>
Have a look at the OpenSSH sshd documentation. Under "AUTHORIZED_KEYS FILE FORMAT" you'll find the following option:
command="command"
Specifies that the command is executed whenever this key is used
for authentication. The command supplied by the user (if any) is
ignored. The command is run on a pty if the client requests a
pty; otherwise it is run without a tty. If an 8-bit clean chan-
nel is required, one must not request a pty or should specify no-
pty. A quote may be included in the command by quoting it with a
backslash. This option might be useful to restrict certain pub-
lic keys to perform just a specific operation. An example might
be a key that permits remote backups but nothing else. Note that
the client may specify TCP and/or X11 forwarding unless they are
explicitly prohibited. Note that this option applies to shell,
command or subsystem execution.
So you will be able to generate an SSH key for your Apache server which only supports doing an "svn up /foo/bar".
Best regards,
Mads
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: Automatic updating on a checkin
Posted by Duncan Booth <du...@suttoncourtenay.org.uk>.
Ryan Schmidt wrote:
> On May 3, 2006, at 14:47, Duncan Booth wrote:
>
>> The FAQ has an answer for "I'm managing a website in my repository.
>> How can
>> I make the live site automatically update after every commit?", but
>> I want
>> to update a working copy on a system which isn't the subversion
>> server.
>
> How about a post-commit hook which does this:
>
> /usr/bin/ssh your.remote.host svn up /path/to/working/copy/on/remote/
> host
Actually, it probably isn't 'svn up', I'll probably just want to run a
shell script so that I can do other things like restarting programs if
necessary, but that doesn't matter. The problem is that on its own that
doesn't quite work.
The hook would be running as the apache user on the subversion server, so
the 'svn up' needs to be kicked off as a different user. I would rather not
trust the apache user from the svn server further than necessary, so I
would like some solution which allows a specific command to be run but not
others: maybe ssh+sudo, or should that be sudo+ssh?
Alternatively I use something like wget on a URL, which has different but
possibly simpler security issues.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: Automatic updating on a checkin
Posted by Ryan Schmidt <su...@ryandesign.com>.
On May 3, 2006, at 14:47, Duncan Booth wrote:
> The FAQ has an answer for "I'm managing a website in my repository.
> How can
> I make the live site automatically update after every commit?", but
> I want
> to update a working copy on a system which isn't the subversion
> server.
How about a post-commit hook which does this:
/usr/bin/ssh your.remote.host svn up /path/to/working/copy/on/remote/
host
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org