Subversion server running on Fedora 13

Running subversion server using apache daemon should be an easy task, except you're security n00b like me.

1. Installing required binaries:
   sudo yum install subversion httpd mod_dav_svn
   



2. mod_dav_svn creates scratch configuration file subversion.conf for httpd daemon in
   /etc/httpd/conf.d/. Unfortunately in this file there is a bug in comments dealing with new repository creation:
   
   

   
   #
   # Example configuration to enable HTTP access for a directory
   # containing Subversion repositories, "/var/www/svn".  Each repository
   # must be both:
   #
   #   a) readable and writable by the 'apache' user, and
   #
   #   b) labelled with the 'http_sys_content_rw_t' context if using
   #   SELinux
   #
   
   #
   # To create a new repository "http://localhost/repos/stuff" using
   # this configuration, run as root:
   #
   #   # cd /var/www/svn
   #   # svnadmin create stuff   
   #   # chown -R apache.apache stuff
   #   # chcon -R -t http_sys_content_t stuff
   

   
   Last line should rather set SELinux context to http_sys_content_rw_t:
   

   
   chcon -R -t http_sys_content_rw_t stuff
   

   
   But anyway let's set our httpd configuration to be:
   
   
   
   • path for all repositories /var/www/svn
   
   
   • for apache authentication I choose the simplest one Basic with password file stored in /var/svn/passwd
   
   
   • finally I choose to store global svn authorization file in /var/svn/svnauth
   
   
   
   so using above presettings our subversion.conf would look like:
   

   
   LoadModule dav_svn_module     modules/mod_dav_svn.so
   LoadModule authz_svn_module   modules/mod_authz_svn.so
   <Location /repos>
      DAV svn
      SVNParentPath /var/www/svn
      AuthzSVNAccessFile /var/svn/svnauth 
      SSLRequireSSL
      Order deny,allow  
      AuthType Basic
      AuthName "Subversion repository"
      AuthUserFile /var/svn/passwd
      Require valid-user
   </Location>
   ## logger for svn: /var/log/httpd/svn_log
   CustomLog logs/svn_log "%t %u %{SVN-ACTION}e" env=SVN-ACTION
   

   
   



3. apache authentication file is of course produced using htpasswd command:
   

   
   # for 1st user we're creating a file (-c) and choose MD5 encryption (-m)
   sudo htpasswd -cm /var/svn/passwd cibak 
    New password: xxxxx
    Retype new password: xxxxx
    Adding password for user cibak
   # all the others users only added with the same encryption
   sudo htpasswd -m /var/svn/passwd jack
    ...
    ...
   

   
   Once this file is ready we have to set correct SELinux policy:
   

   
   sudo chcon -t httpd_sys_content_t /var/svn/passwd
   




4. creation of a new repository:
   

   
   sudo svnadmin create /var/www/svn/myrepo
   sudo chown -R apache:apache /var/www/svn/myrepo
   sudo chcon -R -t http_sys_content_rw_t /var/www/svn/myrepo
   

   
   



5. creation of subversion authorization file /var/svn/svnauth in what ever you choose editor (I prefer emacs):
   

   
   # cibak has read-write rights to the whole repository, jack could only read 
   [myrepo:/]
   cibak = rw
   jack = r
   # but jack is able to write in his own directory  
   [myrepo:/jack]
   jack = rw
   

   
   Syntax of this file is better described in the Subversion bible.
   
   Of course ones again we should remember to set correct SELinux policy context:
   

   
   sudo chcon -t httpd_sys_content_t /var/svn/svnauth
   

   
   



6. restarting of httpd deamon is a last step to switch our repo on:
   

   
   sudo /etc/init.d/./httpd restart
   

   
   

et voila, our repository is accessible under https://localhost/repos/myrepo URL.

reallocate your code from one repository to another

I'm a bit too much python fan, so once again it would be a python script. Sorry! ;)

Imagine you want to move your code from one Subversion repository to another with all history preserved, but under different directory. No problem at all.

1. First you need to dump contents of, let's say, source repository to the dump file, probably filtering out someone else's stuff:
   
   

   
   $> svnadmin dump /path/to/src/repo | \
   svndumpfilter --drop-empty-revs --renumber-revs \ 
   --skip-missing-merge-sources include SRCDIR > SRCDIR.dump
   




2. Now filtering script:
   
   

   
   ##
   # @file realloc.py  
   # @author Krzysztof Daniel Ciba (Krzysztof.Ciba@NOSPAMgmail.com) 
   #
   import sys, os
   import optparse
   ##
   # @class realloc
   # @author Krzysztof Daniel Ciba (Krzysztof.Ciba@NOSPAMgmail.com)
   # @brief reads stdin dump file, changes all paths from SRC to DEST and prints it out to stdout
   class realloc( object ):
   
       ## c'tor
       # @param self "Me, myself and Irene"
       # @param src source path in dump file
       # @param dest destination path on dump file
       def __init__( self, src,  dest ):
           self.src = src
           self.dest = dest
           
       def run( self ):
           for line in sys.stdin:
               line = line.strip("\n")
               if ( "Node-path:" in line or
                    "Node-copyfrom-path:" in line ):
                   if self.src in line:
                       line = line.replace( self.src, self.dest )
               print line
               
   def check( option, opt_str, value, parser ):
       if ( str(value).startswith("/") ):
            raise optparse.OptionValueError( "value of " + opt_str + " should be a relative path!" )
       setattr( parser.values, option.dest, value )
   
   ## trigger processing
   if __name__ == "__main__":
       version = "%prog $Revision: 8715 $ by Krzysztof Daniel Ciba (Krzysztof.Ciba@NOSPAMgmail.com)"
       usage = "%prog [opts] [< indumpfile > outdumpfile]"
       parser = optparse.OptionParser( usage=usage, version=version )
       parser.add_option("--src", type="string", action="callback", callback=check, dest="src", help="source directory" )
       parser.add_option("--dest", type="string", action="callback", callback=check, dest="dest", help="destination directory" )
       opts, args = parser.parse_args(sys.argv[1:])
       if ( not opts.src and opts.dest ):
           parser.error("option --dest present but --src is missing")
       elif ( opts.src and not opts.dest ):
           parser.error("option --src present but --dest is missing")
       elif ( not opts.dest and not opts.dest ):
           parser.error( "options --src and --dest are required" )
       else:
           theApp = realloc( opts.src, opts.dest )
           sys.exit( theApp.run() )
   




3. and it's action
   
   

   
   $> realloc.py --src SRCPATH --dest DESTPATH < SRCPATH.dump > DESTPATH.dump
   




4. and standard loading to new repository:
   
   

   
   $> svnadmin load /path/to/new/repo < DESTPATH.dump
   

Not so much work, especially it could be used in pipes, i.e. dumping, filtering, reallocating and loading in the same time:

$> svnadmin dump /path/to/src/repo | svndumpfilter \ 
--drop-empty-revs --renumber-revs --skip-missing-merge-sources \ 
include SRCDIR | realloc.py --src SRCDIR --dest DESTDIR | \ 
svnadmin load /path/to/dest/repo  

Hmmm... Of course it could be made better in some simple way using sed. Yes, I'm using sed from time to time, but NOT this time. ;)

SVN hooks once again, this time tags, branches, log messages etc.

This one hook I wrote quite long ago is forcing users of Subversion repository to:

• provide log message on every commit (class logChecker)
  
• block removing of "/tags", "/branches" and "/trunk" directories from repo (class pathChecker)
  
• forcing branch and tag naming convention
  
• making subdirectories under /tags read-only
  

My company is running Subversion for storing all software packages and our repo hasn't got the default structure (/tags, /trunk and /branches as a top directories) — instead of that every package has got it's own /trunk, /tags and /branches subdirectories. So the repository structure is something like this:

/Path/
      PackageA/
               trunk/ 
                     src/
                     doc/
               tags/ 
                    PackageA-00-00-00/ 
                                      src/
                                      doc/
                    ...
               branches/
                    PackageA-00-00-00-branch/ 
                                            src/
                                            doc/
                  
      PackageB/
               ...
/OtherPath/
           PackageC/
           ...                   

Looks rather complicated, but it isn't. ;)

Also we've got tags and branches naming convention. Every tag should be made of package name, then a three (or four for tags made over a branch) groups of digits, e.g.: PackageName-ii-jj-kk or PackageName-ii-jj-kk-ll.
Every branch name is very similar to tag name, except there is additional (-branch) string at the end.

So here is the hook itself:


If you want to use this one, you have to modify it a little:

• replace 'librarian' or/and 'root' account name with your own repository admin
  
• put repository admin mail to block messages - replace this fake 'librarian@mail' address
  
• change regexp ffor tags and branches to match your criteria
  
• put svn-policy.py script into your repository hook directory ($REPO/hooks)
  
• modify "$REPO/hooks/pre-commit" script to switch this one on
  

  
  #!/bin/sh
  REPOS="$1"
  TXN="$2"
  SVNPOLICY=/path/to/repo/hooks/svn-policy.py # modify this line
  #SVN policy
  $SVNPOLICY  -t "$TXN" "$REPOS" || exit 1
  # All checks passed, so allow the commit.
  exit 0
  

  
  

Maybe the code needs some cleaning and better structure but anyway happy using, comments and questions are welcome!

Cheers,
Krzysztof

eol once again

Here is another pre-commit hook I wrote for Subversion repositories. Let's assume many people (not always smart enough) accessing and committing to your Subversion repository. They don't know how to configure their svn client, but you want to be sure, that all text files have the same line endings (e.g. Unix = LF). So, to be sure that all line endings are consistent, you could run this hook, which blocks commit operation if svn:eol-style is not set to required one.

As always you should modify also your pre-commit file, usually stored in repo/hooks directory, e.g.:

And that's it! ;)