VersionControl:PRs/maybelle-config/280: Difference between revisions
From PickiPedia: A knowledge base of bluegrass, old time psychedelic jams, and other public domain music
Jump to navigationJump to search
cryptograss/maybelle-config#280, as GitHub has it |
cryptograss/maybelle-config#280, as GitHub has it |
||
| (One intermediate revision by the same user not shown) | |||
| Line 5: | Line 5: | ||
|url=https://github.com/cryptograss/maybelle-config/pull/280 | |url=https://github.com/cryptograss/maybelle-config/pull/280 | ||
|author=magent-cryptograss | |author=magent-cryptograss | ||
|state= | |state=merged | ||
|base=production | |base=production | ||
|branch=magent/githouse-unlock | |branch=magent/githouse-unlock | ||
|opened=2026-11-06 05:33:11 | |opened=2026-11-06 05:33:11 | ||
|pushed=2026-11-06 05:32:20 | |pushed=2026-11-06 05:32:20 | ||
|merged= | |merged=2026-11-06 05:36:03 | ||
|closed= | |closed= | ||
|worked_on_by=magent, justin, re | |worked_on_by=magent, justin, re | ||
| Line 16: | Line 16: | ||
|deploy=redeploy maybelle (the fix); hunter at its next deploy (cosmetic) | |deploy=redeploy maybelle (the fix); hunter at its next deploy (cosmetic) | ||
}} | }} | ||
<pre class="pr-body">githouse's first deploy (#250, maybelle 6 Nov 05:08Z, hunter 05:22Z) had everything in place except the door: the relayed keys arrived on maybelle, `authorized_keys` had four lines by 05:23Z, and every push and the mirror's fetch still got `Permission denied (publickey)`. | |||
**Cause:** `useradd` leaves the `git` account's password field as `!`, which sshd reads as a locked account and refuses even by key. sshd logged to syslog inside the container, so `docker logs githouse` showed nothing, and the deploy's wait for `branches.json` passed because `init` writes that file too. | |||
**Reproduced and fixed in a throwaway container on hunter** (`githouse-test` and `githouse-locked`, both removed after): the deployed image's state, with the account locked, gave `User git not allowed because account is locked`; the fixed image accepted the same key, ran the forced command (`githouse: only git fetch and git push here`), and `git ls-remote` through it reached `auth` (`no repository nothing here`). | |||
**Changes:** | |||
- `Dockerfile`: `usermod -p '*' git`. An unusable password, not a locked one. The standard git-server fix. | |||
- `entrypoint.sh`: `sshd -D -e &`, so its log goes to stderr and `docker logs githouse` says why a key was refused. | |||
- `githouse.py`: the keys are rebuilt each round before the fetches, repositories or none (before, no repositories meant no `authorized_keys` ever). | |||
- `container_startup.py`: magent's key is published from `emergent-magent` only. The `magent` unix user exists in every container, so each had been publishing a `magent.pub` beside its own emergent's key; maybelle ignored them, but the relay should carry one key per name. | |||
Tests: `test_githouse.py` 17, `test_container_startup.py` 36 (one extended: the key is made but not published where `publish=False`). Both pass. render-diff is clean against production. | |||
Deploy: redeploy maybelle (the fix); hunter at its next deploy (cosmetic) | |||
Worked on by: magent, Justin, re, in #ramp</pre> | |||
Latest revision as of 17:06, 9 November 2026
| State | 🟣 merged 2026-11-06 05:36:03 |
|---|---|
| Worked on by | magent, justin, re |
| Moods | #ramp |
| Deploy | redeploy maybelle (the fix); hunter at its next deploy (cosmetic) |
| Branch | magent/githouse-unlock → production, by magent-cryptograss
|
| Opened · last pushed | 2026-11-06 05:33:11 · 2026-11-06 05:32:20 |
githouse's first deploy (#250, maybelle 6 Nov 05:08Z, hunter 05:22Z) had everything in place except the door: the relayed keys arrived on maybelle, `authorized_keys` had four lines by 05:23Z, and every push and the mirror's fetch still got `Permission denied (publickey)`. **Cause:** `useradd` leaves the `git` account's password field as `!`, which sshd reads as a locked account and refuses even by key. sshd logged to syslog inside the container, so `docker logs githouse` showed nothing, and the deploy's wait for `branches.json` passed because `init` writes that file too. **Reproduced and fixed in a throwaway container on hunter** (`githouse-test` and `githouse-locked`, both removed after): the deployed image's state, with the account locked, gave `User git not allowed because account is locked`; the fixed image accepted the same key, ran the forced command (`githouse: only git fetch and git push here`), and `git ls-remote` through it reached `auth` (`no repository nothing here`). **Changes:** - `Dockerfile`: `usermod -p '*' git`. An unusable password, not a locked one. The standard git-server fix. - `entrypoint.sh`: `sshd -D -e &`, so its log goes to stderr and `docker logs githouse` says why a key was refused. - `githouse.py`: the keys are rebuilt each round before the fetches, repositories or none (before, no repositories meant no `authorized_keys` ever). - `container_startup.py`: magent's key is published from `emergent-magent` only. The `magent` unix user exists in every container, so each had been publishing a `magent.pub` beside its own emergent's key; maybelle ignored them, but the relay should carry one key per name. Tests: `test_githouse.py` 17, `test_container_startup.py` 36 (one extended: the key is made but not published where `publish=False`). Both pass. render-diff is clean against production. Deploy: redeploy maybelle (the fix); hunter at its next deploy (cosmetic) Worked on by: magent, Justin, re, in #ramp