Redmine

      if Setting.serve_git_repositories? and (repository == nil or repository.url.blank?)

          content_tag('p', form.text_field(:url, :value => GitManager.repositories_root + '/' + repository.project.identifier + '.git'), :label => 'Path to .git directory', :size => 60, :required => true)

      else

          content_tag('p', form.text_field(:url, :label => 'Path to .git directory', :size => 60, :required => true, :disabled => (repository && !repository.root_url.blank?)))

      end

require "strscan"

require 'thread'

class AuthorizedKeysEntry

  COMMENT=/^#/

  BLANK=/^\s+$/

  AUTHORIZED_KEYS_PARSER=/^(?:(.+) )?(ssh-dss|ssh-rsa) ([^ ]+)(?: (.+))?$/

  KEY_TYPES=['ssh-dss','ssh-rsa']

  KEY_FORMAT=/\A[\w\/\+\=]+\z/

  IDENTIFIER_FORMAT=/\A[\w@\.\-]+\z/

  @@authorized_keys_filename="~/.ssh/authorized_keys"

  attr_reader :identifier, :key, :type

  attr_accessor :options

  @authorized_keys_lock = Mutex.new

  # Create object from string from authorized_keys

  def initialize(authorized_keys_string = nil)

    @key = ''

    @options = []

    create_from_authorized_keys(authorized_keys_string) if authorized_keys_string != nil

  end

  def identifier=(identifier)

    @identifier = identifier

    @validated = false

  end

  def key=(key)

    @key = key

    @validated = false

  end

  def type=(type)

    @type = type

    @validated = false

  end

  def save

    raise "Invalid key format" if !validate

    AuthorizedKeysEntry.save_entry(self)

  end

  def self.find_by_identifier(identifier)

    read_entries do |entry|

      return entry if entry.identifier == identifier

    end

    return nil

  end

  def validate

    return true if @key == ""

    return false if !@options.kind_of?(Array)

    return true if @validated

    # Clean key from any garbage user might have entered while copying the key

    @key = @key.gsub(/\A(ssh-dss|ssh-rsa)\s/,"").gsub(/\s\w+@[\.\w\-\n]+\s*\Z/,"").gsub(/\s/,'')

    return false if (@key=~KEY_FORMAT) == nil or !KEY_TYPES.include?(@type)

    return false if (@identifier=~IDENTIFIER_FORMAT) == nil

    Tempfile.open("redmine") do |file|

      file << get_id_dsa_pub_format

      file.close

      @validated = system "ssh-keygen -B -f #{file.path()} &> /dev/null"

    end

    return @validated

  end

  def to_s

    get_authorized_keys_format

  end

  def self.authorized_keys_filename=(filename)

    @@authorized_keys_filename = filename

  end

  private

  def create_from_authorized_keys(line)

    m = AUTHORIZED_KEYS_PARSER.match(line)

    raise ArgumentError, "Invalid format of authorized_keys entry" if m == nil

    @options, @type, @key, @identifier = m[1], m[2], m[3], m[4]

    @options = AuthorizedKeysEntry.parse_options(@options)

  end

  def get_authorized_keys_format

    raise ArgumentError, 'Entry must have the type set' if @type == nil

    s = ""

    s += @options.join(",") + " " if !@options.empty?

    s += @type + " " + @key

    s += " " + @identifier if @identifier

    return s

  end

  def get_id_dsa_pub_format

    raise ArgumentError, 'Entry must have the type set' if @type == nil

    s = ""

    s += @type + " " + @key

    s += " " + @identifier if @identifier

    return s

  end

  def self.parse_options(options)

    result = []

    return result if options == nil

    scanner = StringScanner.new(options)

    while !scanner.eos?

      scanner.skip(/[ \t]*/)

      # scan a long option

      if out = scanner.scan(/[-a-z0-9A-Z_]+=\".*?\"/) or out = scanner.scan(/[-a-z0-9A-Z_]+/)

        result << out

      else

        # found an unscannable token, let's abort

        break

      end

      # eat a comma

      scanner.skip(/[\t]*,[\t]*/)

    end

    return result

  end

  def self.read_entries

    filename = File.expand_path(@@authorized_keys_filename)

    return if !File.exists?(filename)

    File.open(filename) do |file|

      file.flock(File::LOCK_SH)

      begin

        file.each_line do |line|

          next if COMMENT.match(line) or BLANK.match(line)

          yield AuthorizedKeysEntry.new(line)

        end

      ensure

        file.flock(File::LOCK_UN)

      end

    end 

  end

  def self.save_entry(entry)

    filename = File.expand_path(@@authorized_keys_filename)

    FileUtils.mkdir_p(File.dirname(filename))

    found = false

    entries = []

    file = nil

    begin

      if File.exist?(filename)

        file = File.open(filename, "r")

        # TODO: somehow handle flock blocking

        file.flock(File::LOCK_EX)

        file.each_line do |line|

          next if COMMENT.match(line) or BLANK.match(line)

          entries << AuthorizedKeysEntry.new(line)

        end

        entries.each do |e|

          if entry.identifier == e.identifier

            return if entry.key == e.key and entry.type == e.type

            found = true

	    if entry.key != ""

              e.key = entry.key

              e.type = entry.type

              e.options = entry.options

            else

              entries.delete(e)

            end

	    break

          end

        end

      end

      if !found and entry.key != ""

        entries << entry

      end

      File.open(filename, "w") do |write_file|

        write_file.flock(File::LOCK_EX) if file == nil

        entries.each do |entry|

          write_file << entry.to_s + "\n"

        end

      end

    ensure

      file.close if file != nil

    end

  end

end

  # returns issue ids found in message

  # three arrays are returned, references issues, fixed ones and wrong numbers (not Issues)

  def self.find_issue_ids(message, project)

    return [[],[]] if message.blank?

    return [[],[]] if kw_regexp.blank?

    fixed_issues = []

    wrong_issue_ids = []

      message.scan(%r{([\s\(,-]|^)#(\d+)(?=[[:punct:]]|\s|<|$)}).each { |m| target_issue_ids << m[1] }

      found_issues = project.issues.find_all_by_id(target_issue_ids)

      references_issues += found_issues

      found_issues.each { |issue| target_issue_ids.delete(issue.id.to_s) }

      wrong_issue_ids += target_issue_ids

    message.scan(Regexp.new("(#{kw_regexp})[\s:]+(([\s,;&]*#?\\d+)+)", Regexp::IGNORECASE)).each do |match|

      target_issues = project.issues.find_all_by_id(target_issue_ids)

      target_issues.each { |issue| target_issue_ids.delete(issue.id.to_s) }

      wrong_issue_ids += target_issue_ids

      if fix_keywords.include?(action.downcase)

        fixed_issues += target_issues

      else

        referenced_issues += target_issues

    return [referenced_issues.uniq, fixed_issues.uniq, wrong_issue_ids.uniq]

  end

  def scan_comment_for_issue_ids

    return if comments.blank?

    # status and optional done ratio applied

    fix_status = IssueStatus.find_by_id(Setting.commit_fix_status_id)

    done_ratio = Setting.commit_fix_done_ratio.blank? ? nil : Setting.commit_fix_done_ratio.to_i

    referenced_issues, fixed_issues, wrong_issues = Changeset.find_issue_ids(comments, repository.project)

    # update status of issues

    logger.debug "Issues fixed by changeset #{self.revision}: #{issue_ids.join(', ')}." if logger && logger.debug?

    fixed_issues.each do |issue|

      # the issue may have been updated by the closure of another one (eg. duplicate)

      issue.reload

      # don't change the status is the issue is closed

      next if issue.status.is_closed?

      csettext = "r#{self.revision}"

      if self.scmid && (! (csettext =~ /^r[0-9]+$/))

        csettext = "commit:\"#{self.scmid}\""

      end

      journal = issue.init_journal(user || User.anonymous, l(:text_status_changed_by_changeset, csettext))

      issue.status = fix_status

      issue.done_ratio = done_ratio if done_ratio

      issue.save

      Mailer.deliver_issue_edit(journal) if Setting.notified_events.include?('issue_updated')

    end

    self.issues = (referenced_issues + fixed_issues).uniq

class GitChecks::Committer < GitManager::CommitCheck

  def self.check(revision, branch, user, role, project, git)

    # Check: committer name and email

    if revision.author != "#{user.name} <#{user.mail}>"

      return [ "Commit author name or email is wrong",

	       "    Execute following commands and _recreate_ commit:",

               "    git config --global user.name \"#{user.name}\"",

	       "                git config --global user.email #{user.mail}",

      ]

    end

    return []

  end

end

class GitChecks::DeleteBranch < GitManager::RefCheck

  def self.check(old_rev, new_rev, new_rev_type, branch, user, role, project, git)

    if new_rev_type == "delete"

      return "Deleting branch can be done only by repository manager"

    end

    return []

  end

end

class GitChecks::FastForward < GitManager::RefCheck

  def self.check(old_rev, new_rev, new_rev_type, branch, user, role, project, git)

    # Check: fast forward

    if old_rev != git.class::EMPTY_COMMIT and git.merge_base(old_rev, new_rev) != old_rev

      return "Only fast-forward commits are allowed"

    end

    return []

  end

end

class GitChecks::InitialCommit < GitManager::RefCheck

  def self.check(old_rev, new_rev, new_rev_type, branch, user, role, project, git)

    if old_rev == git.class::EMPTY_COMMIT and !role.allowed_to?(:manage_repository)

      return "Initial commit can be done only by repository manager"

    end

    return []

  end

end

class GitChecks::Issue < GitManager::CommitCheck

  def self.check(revision, branch, user, role, project, git)

    references_issues, fixes_issues, wrong_issues = Changeset.find_issue_ids(revision.message, project)

    issues = references_issues + fixes_issues

    errors = []

    if !wrong_issues.empty?

      errors << "Some issue numbers are wrong: #{wrong_issues.join(',')}"

    end

    issues.each do |issue_number|

      issue = Issue.find(issue_number)

      if issue.closed?

        errors << "Issue \##{issue.id} is closed. Reopen it and commit again"

      end

      if issue.assigned_to != user

        if issue.assigned_to != nil

          owner_info = "It belongs to #{issue.assigned_to.firstname} #{issue.assigned_to.lastname}"

        else

          owner_info = "It is unassigned"

        end

        errors << "Issue \##{issue.id} is not assigned to You. #{owner_info}"

      end

    end

    return errors

  end

end

require 'net/http'

require 'uri'

require 'redmine/scm/adapters/git_adapter'

class GitManager

  COMMANDS_READONLY = [

    'git-upload-pack',

  ]

  COMMANDS_WRITE = [

    'git-receive-pack',

  ]

  # TODO: make configurable

  REPOSITORIES_ROOT='~/repositories/'

  REDMINE_LOGIN_ENV_NAME='REDMINE_LOGIN'

  def self.repositories_root

    return File.expand_path(REPOSITORIES_ROOT)

  end

  # Executed by SSH when somebody logs into Redmine's SSH account

  # using public key.

  # Restricts the user to access only Git repositories he is allowed to.

  def self.serve

    begin

      command = serve_get_original_command

      user = serve_get_user

      git_command, project_identifier = parse_git_command(command)

      project, repository = find_project_and_repo(project_identifier)

      role = user.role_for_project(project)

      if COMMANDS_READONLY.include?(git_command)

        if !role.allowed_to?(:view_changesets)

          raise "User #{user} (#{role.name}) is not allowed to read project #{project}\n"

        end

        if !repository.scm.info

          raise "Empty repository. Push some commit first"

        end

      elsif COMMANDS_WRITE.include?(git_command)

        if !role.allowed_to?(:commit_access)

          raise "User #{user} (#{role.name}) is not allowed to write to project #{project}\n"

        end

        if !repository.scm.info

          warn "Creating new repository.\n"

          repository.scm.init(project.description)

        end

      else

        raise "Unknown command '#{verb}'"

      end

    rescue

      warn "Error: #{$!}.\n"

      exit 1

    end

    ENV[REDMINE_LOGIN_ENV_NAME]=user.login

    exec 'git', 'shell', '-c', "#{git_command} '#{repository.url}'"

  end

  def self.get_authorized_keys_options_for_login(login)

    return [ 'command="ruby ' + RAILS_ROOT + '/script/runner GitManager.serve \'' + login + '\' -e ' + ENV["RAILS_ENV"] +

	  '"', 'no-port-forwarding','no-X11-forwarding','no-agent-forwarding','no-pty' ]

  end

  private

  def self.serve_get_original_command

    command = ENV["SSH_ORIGINAL_COMMAND"]

    if command == nil or command==""

      raise "SSH_ORIGINAL_COMMAND not set. Use Git to access this account"

    end

    if command=~/\n/

      raise "Command contains new line character"

    end

    return command

  end

  def self.serve_get_user

    login = ARGV[0]

    if login == nil or login==""

      raise "Needs login as parameter"

    end

    user = User.find_by_login(login)

    if user == nil

      raise "User not found #{login}"

    end

    return user

  end

  def self.parse_git_command(command)

    verb, args = command.split(" ",2)

    if verb == 'git'

       subverb, args = args.split(" ",2)

       verb = "%s-%s" % [ verb, subverb ]

    end

    project_identifier = args.gsub("'","")

    return verb, project_identifier

  end

  def self.find_project_and_repo(project_identifier)

    project = Project.find_by_identifier(project_identifier)

    if project == nil

      raise "Project not found \"#{project_identifier}\""

    end

    repository = project.repository

    if repository == nil

      raise "Project #{project} does not have repository\n"

    end

    if repository.class != Repository::Git

      raise "Project #{project} has non git repository #{repository.type}"

    end

    return project, repository

  end

  public

  class RefCheck

    @@checks = []

    # Check Git ref, subclassess should override

    def check(old_rev, new_rev, new_rev_type, branch, user, role, project, git)

      return true

    end

    def self.inherited(subclass)

      @@checks << subclass

    end

    def self.get_checks

      return @@checks

    end

  end

  class CommitCheck

    @@checks = []

    # Check Git ref, subclassess should override

    def check(revision, branch, user, role, project, git)

      return true

    end

    def self.inherited(subclass)

      @@checks << subclass

    end

    def self.get_checks

      return @@checks

    end

  end

  def self.load_checks

    files = Dir.glob(RAILS_ROOT + "/app/models/git_checks/*.rb")

    files.each do |f|

      f.sub!(/\A#{RAILS_ROOT}/,'')

      f.split('/')[3..-1].join('/').split('.').first.camelize.constantize

    end

  end

  load_checks

  def self.check_commits

    login = ENV[REDMINE_LOGIN_ENV_NAME]

    if login == nil

      warn "Redmine: Local user, not running checks"

      exit 0

    end

    begin

      user = User.find_by_login(login)

      raise "User not found" if user == nil

      repository = Repository.find_by_url(Dir.getwd)

      raise "Repository not managed by Redmine" if repository == nil

      raise "Non git repository" if repository.class != Repository::Git

      project = repository.project

      role = user.role_for_project(project)

      git = repository.scm

      warn ""

      warn "-------------------------------------------------------------"

      warn "Redmine is checking your changes for correctness..."

      warn "Authenticated as #{user.name} (#{role.name} in #{project.name})"

      error_found = false

      warn "Changes:"

      STDIN.each_line do |line|

        old_rev, new_rev, branch = line.split(" ")

        if new_rev == git.class::EMPTY_COMMIT

          new_rev_type = "delete"

        else

          new_rev_type = git.get_object_type(new_rev)

        end

        revisions = nil

        if new_rev_type == "commit"

          revisions = git.revisions("", old_rev, new_rev)

        end

        warn "    Ref: #{branch} type: #{new_rev_type}"

	errors = []

	# TODO: make checks configurable

        RefCheck.get_checks.each do |check|

          result = check.check(old_rev, new_rev, new_rev_type, branch, user, role, project, git)

          if result.kind_of?(Array)

            errors += result

	  else

            errors << result

          end

        end

        errors.each do |error|

          warn "            Error: #{error}"

        end

	error_found = true if !errors.empty?

        if revisions != nil

	  revisions.each do |revision|

	    warn "        Commit: #{revision.identifier}"

	    errors = []

            CommitCheck.get_checks.each do |check|

              result = check.check(revision, branch, user, role, project, git)

              if result.kind_of?(Array)

                errors += result

	      else

                errors << result

              end

            end

            errors.each do |error|

              warn "            Error: #{error}"

            end

	    error_found = true if !errors.empty?

          end

        end

      end

    end

    if error_found

      if !role.allowed_to?(:manage_repository)

        warn "Some commits were rejected. Correct them and try the push again."

        warn "-------------------------------------------------------------"

	warn ""

        exit 1

      else

        warn "You are repository manager. Checks results are ignored. "

        warn "-------------------------------------------------------------"

	exit 0

      end

    end

    warn "Changes look OK"

    warn "-------------------------------------------------------------"

    exit 0

  end

end

  def ssh_key

    return nil if ! Setting.serve_git_repositories?

    load_ssh_key if @ssh_key_entry == nil

    return @ssh_key_entry.key

  end

  def ssh_key_type

    return nil if ! Setting.serve_git_repositories?

    load_ssh_key if @ssh_key_entry == nil

    return @ssh_key_entry.type

  end

  def ssh_key=(key)

    return if ! Setting.serve_git_repositories?

    new_ssh_key if @ssh_key_entry == nil

    key = key.strip if key != nil

    @ssh_key_entry.key = key

  end

  def ssh_key_type=(key_type)

    return if ! Setting.serve_git_repositories?

    new_ssh_key if @ssh_key_entry == nil

    @ssh_key_entry.type = key_type

  end

  def validate

    return if !Setting.serve_git_repositories?

    return if @ssh_key_entry == nil

    errors.add(:ssh_key, "is not valid") if !@ssh_key_entry.validate

  end

  def after_save

    return if ! Setting.serve_git_repositories?

    return if @ssh_key_entry == nil

    @ssh_key_entry.options = GitManager.get_authorized_keys_options_for_login(login)

    @ssh_key_entry.save 

  end

  def new_ssh_key

    @ssh_key_entry = AuthorizedKeysEntry.new

    @ssh_key_entry.identifier = login

  end

  def load_ssh_key

    @ssh_key_entry = AuthorizedKeysEntry.find_by_identifier(login)

    new_ssh_key if @ssh_key_entry == nil

  end

<% if Setting.serve_git_repositories? %>

  <p><%= f.select :ssh_key_type, AuthorizedKeysEntry::KEY_TYPES %></p>

  <p><%= f.text_area :ssh_key, :rows => 10 %></p>

<% end %>

<% # TODO: Should be disabled when Git SCM is not enabled 

%>

<p><label><%= l(:setting_serve_git_repositories) %></label>

<%= check_box_tag 'settings[serve_git_repositories]', 1, Setting.serve_git_repositories? %>

<%= hidden_field_tag 'settings[serve_git_repositories]', 0 %>

</p>

serve_git_repositories:

  default: 0

field_ssh_key: SSH Public Key

field_ssh_key_type: SSH Public Key Type

setting_serve_git_repositories: Serve GIT repositories using Redmine's SSH account

field_ssh_key: SSH Public Key

field_ssh_key_type: SSH Public Key Type

setting_serve_git_repositories: Serve GIT repositories using Redmine's SSH account

field_ssh_key: SSH Public Key

field_ssh_key_type: SSH Public Key Type

setting_serve_git_repositories: Serve GIT repositories using Redmine's SSH account

field_ssh_key: SSH Public Key

field_ssh_key_type: SSH Public Key Type

setting_serve_git_repositories: Serve GIT repositories using Redmine's SSH account

field_ssh_key: SSH Public Key

field_ssh_key_type: SSH Public Key Type

setting_serve_git_repositories: Serve GIT repositories using Redmine's SSH account

field_ssh_key: SSH Public Key

field_ssh_key_type: SSH Public Key Type

setting_serve_git_repositories: Serve GIT repositories using Redmine's SSH account

field_ssh_key: SSH Public Key

field_ssh_key_type: SSH Public Key Type

setting_serve_git_repositories: Serve GIT repositories using Redmine's SSH account

field_ssh_key: SSH Public Key

field_ssh_key_type: SSH Public Key Type

setting_serve_git_repositories: Serve GIT repositories using Redmine's SSH account

field_ssh_key: SSH Public Key

field_ssh_key_type: SSH Public Key Type

setting_serve_git_repositories: Serve GIT repositories using Redmine's SSH account

field_ssh_key: SSH Public Key

field_ssh_key_type: SSH Public Key Type

setting_serve_git_repositories: Serve GIT repositories using Redmine's SSH account

field_ssh_key: SSH Public Key

field_ssh_key_type: SSH Public Key Type

setting_serve_git_repositories: Serve GIT repositories using Redmine's SSH account

field_ssh_key: SSH Public Key

field_ssh_key_type: SSH Public Key Type

setting_serve_git_repositories: Serve GIT repositories using Redmine's SSH account

field_ssh_key: SSH Public Key

field_ssh_key_type: SSH Public Key Type

setting_serve_git_repositories: Serve GIT repositories using Redmine's SSH account

field_ssh_key: SSH Public Key

field_ssh_key_type: SSH Public Key Type

setting_serve_git_repositories: Serve GIT repositories using Redmine's SSH account

field_ssh_key: SSH Public Key

field_ssh_key_type: SSH Public Key Type

setting_serve_git_repositories: Serve GIT repositories using Redmine's SSH account

field_ssh_key: SSH Public Key

field_ssh_key_type: SSH Public Key Type

setting_serve_git_repositories: Serve GIT repositories using Redmine's SSH account

field_ssh_key: SSH Public Key

field_ssh_key_type: SSH Public Key Type

setting_serve_git_repositories: Serve GIT repositories using Redmine's SSH account

field_ssh_key: Klucz publiczny SSH

field_ssh_key_type: Typ klucza SSH

setting_serve_git_repositories: Udostępnij repozytoria GIT poprzez konto SSH Redmine

field_ssh_key: SSH Public Key

field_ssh_key_type: SSH Public Key Type

setting_serve_git_repositories: Serve GIT repositories using Redmine's SSH account

field_ssh_key: SSH Public Key

field_ssh_key_type: SSH Public Key Type

setting_serve_git_repositories: Serve GIT repositories using Redmine's SSH account

field_ssh_key: SSH Public Key

field_ssh_key_type: SSH Public Key Type

setting_serve_git_repositories: Serve GIT repositories using Redmine's SSH account

field_ssh_key: SSH Public Key

field_ssh_key_type: SSH Public Key Type

setting_serve_git_repositories: Serve GIT repositories using Redmine's SSH account

field_ssh_key: SSH Public Key

field_ssh_key_type: SSH Public Key Type

setting_serve_git_repositories: Serve GIT repositories using Redmine's SSH account

field_ssh_key: SSH Public Key

field_ssh_key_type: SSH Public Key Type

setting_serve_git_repositories: Serve GIT repositories using Redmine's SSH account

field_ssh_key: SSH Public Key

field_ssh_key_type: SSH Public Key Type

setting_serve_git_repositories: Serve GIT repositories using Redmine's SSH account

field_ssh_key: SSH Public Key

field_ssh_key_type: SSH Public Key Type

setting_serve_git_repositories: Serve GIT repositories using Redmine's SSH account

field_ssh_key: SSH Public Key

field_ssh_key_type: SSH Public Key Type

setting_serve_git_repositories: Serve GIT repositories using Redmine's SSH account

field_ssh_key: SSH Public Key

field_ssh_key_type: SSH Public Key Type

setting_serve_git_repositories: Serve GIT repositories using Redmine's SSH account

field_ssh_key: SSH Public Key

field_ssh_key_type: SSH Public Key Type