delta/git.git/t/lib-httpd, branch jk/remove-remote-helpers-in-python

Merge branch 'jk/apache-test-for-2.4'

2013-06-23T21:53:17+00:00

* jk/apache-test-for-2.4:
  lib-httpd/apache.conf: check version only after mod_version loads
  t/lib-httpd/apache.conf: configure an MPM module for apache 2.4
  t/lib-httpd/apache.conf: load compat access module in apache 2.4
  t/lib-httpd/apache.conf: load extra auth modules in apache 2.4
  t/lib-httpd/apache.conf: do not use LockFile in apache >= 2.4

lib-httpd/apache.conf: check version only after mod_version loads

2013-06-21T20:58:06+00:00

Commit 0442743 introduced an  directive near the
top of the apache config file. However, at that point we
have not yet checked for and loaded the mod_version module.
This means that the directive will behave oddly if
mod_version is dynamically loaded, failing to match when it
should.

We can fix this by moving the whole block below the
LoadModule directive for mod_version.

Reported-by: Brian Gernhardt 
Signed-off-by: Jeff King 
Signed-off-by: Junio C Hamano

t/lib-httpd/apache.conf: configure an MPM module for apache 2.4

2013-06-14T17:29:04+00:00

Versions of Apache before 2.4 always had a "MultiProcessing
Module" (MPM) statically built in, which manages the worker
threads/processes. We do not care which one, as it is
largely a performance issue, and we put only a light load on
the server during our testing.

As of Apache 2.4, the MPM module is loadable just like any
other module, but exactly one such module must be loaded. On
a system where the MPMs are compiled dynamically (e.g.,
Debian unstable), this means that our test Apache server
will not start unless we provide the appropriate
configuration.

Unfortunately, we do not actually know which MPM modules are
available or appropriate for the system on which the tests
are running. This patch picks the "prefork" module, as it
is likely to be available on all Unix-like systems.

Signed-off-by: Jeff King 
Signed-off-by: Junio C Hamano

t/lib-httpd/apache.conf: load compat access module in apache 2.4

2013-06-14T17:29:01+00:00

In apache 2.4, the "Order" directive has gone away in favor
of a new system in mod_authz_host. However, since we want
our config file to remain compatible across multiple Apache
versions, we can use mod_access_compat to keep using the
older style.

Signed-off-by: Jeff King 
Signed-off-by: Junio C Hamano

t/lib-httpd/apache.conf: load extra auth modules in apache 2.4

2013-06-14T17:28:16+00:00

In apache 2.4, the "Auth*" and "Require" directives have
moved into the authn_core and authz_core modules,
respectively.

Signed-off-by: Jeff King 
Signed-off-by: Junio C Hamano

t/lib-httpd/apache.conf: do not use LockFile in apache >= 2.4

2013-06-14T17:27:54+00:00

The LockFile directive from earlier versions of apache has
been replaced by the Mutex directive. The latter seems to
give sane defaults and does not need any specific
customization, so we can get away with just adding a version
check to the use of LockFile.

Signed-off-by: Jeff King 
Signed-off-by: Junio C Hamano

Merge branch 'jk/doc-http-backend'

2013-04-22T01:40:09+00:00

Improve documentation to illustrate "push authenticated, fetch
anonymous" configuration for smart HTTP servers.

* jk/doc-http-backend:
  doc/http-backend: match query-string in apache half-auth example
  doc/http-backend: give some lighttpd config examples
  doc/http-backend: clarify "half-auth" repo configuration

doc/http-backend: match query-string in apache half-auth example

2013-04-14T05:27:06+00:00

When setting up a "half-auth" repository in which reads can
be done anonymously but writes require authentication, it is
best if the server can require authentication for both the
ref advertisement and the actual receive-pack POSTs. This
alleviates the need for the admin to set http.receivepack in
the repositories, and means that the client is challenged
for credentials immediately, instead of partway through the
push process (and git clients older than v1.7.11.7 had
trouble handling these challenges).

Since detecting a push during the ref advertisement requires
matching the query string, and this is non-trivial to do in
Apache, we have traditionally punted and instructed users to
just protect "/git-receive-pack$".  This patch provides the
mod_rewrite recipe to actually match the ref advertisement,
which is preferred.

While we're at it, let's add the recipe to our test scripts
so that we can be sure that it works, and doesn't get broken
(either by our changes or by changes in Apache).

Signed-off-by: Jeff King 
Acked-by: Jakub Narębski 
Signed-off-by: Junio C Hamano

http-backend: respect GIT_NAMESPACE with dumb clients

2013-04-10T01:06:44+00:00

Filter the list of refs returned via the dumb HTTP protocol according
to the active namespace, consistent with other clients of the
upload-pack service.

Signed-off-by: John Koleszar 
Signed-off-by: Junio C Hamano

Verify Content-Type from smart HTTP servers

2013-02-04T18:22:36+00:00

Before parsing a suspected smart-HTTP response verify the returned
Content-Type matches the standard. This protects a client from
attempting to process a payload that smells like a smart-HTTP
server response.

JGit has been doing this check on all responses since the dawn of
time. I mistakenly failed to include it in git-core when smart HTTP
was introduced. At the time I didn't know how to get the Content-Type
from libcurl. I punted, meant to circle back and fix this, and just
plain forgot about it.

Signed-off-by: Shawn Pearce 
Signed-off-by: Junio C Hamano