doc/manual.docbook
author Paul Crowley <paul@lshift.net>
Wed, 14 Oct 2009 18:05:39 +0100
changeset 140 0f79d1bea07e
parent 139 b7e78f9705e6
child 143 afb1d57ca9f7
permissions -rw-r--r--
Beef up the caution
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
     1
<?xml version="1.0" encoding="utf-8"?>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
     2
<article xmlns="http://docbook.org/ns/docbook" version="5.0" xml:lang="en"
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
     3
  xmlns:xlink="http://www.w3.org/1999/xlink">
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
     4
<info>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
     5
  <title>Sharing Mercurial repositories with mercurial-server</title>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
     6
  <author><firstname>Paul</firstname><surname>Crowley</surname></author>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
     7
  <copyright><year>2009</year><holder>Paul Crowley, LShift Ltd</holder></copyright>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
     8
</info>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
     9
<section>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    10
<title>About mercurial-server</title>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    11
<para>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    12
Home page: <link xlink:href="http://www.lshift.net/mercurial-server.html"/>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    13
</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    14
<para>
133
a99ab5be891a Let next para do the work of discussing what OS it runs on
Paul Crowley <paul@lshift.net>
parents: 132
diff changeset
    15
mercurial-server gives your developers remote read/write access to
a99ab5be891a Let next para do the work of discussing what OS it runs on
Paul Crowley <paul@lshift.net>
parents: 132
diff changeset
    16
centralized <link xlink:href="http://hg-scm.org/">Mercurial</link>
a99ab5be891a Let next para do the work of discussing what OS it runs on
Paul Crowley <paul@lshift.net>
parents: 132
diff changeset
    17
repositories using SSH public key authentication; it provides convenient
a99ab5be891a Let next para do the work of discussing what OS it runs on
Paul Crowley <paul@lshift.net>
parents: 132
diff changeset
    18
and fine-grained key management and access control.
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    19
</para>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    20
<para>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    21
Though mercurial-server is currently targeted at Debian-based systems such
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    22
as Ubuntu, other users have reported success getting it running on other
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    23
Unix-based systems such as Red Hat. Running it on a non-Unix system such as
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    24
Windows is not supported. You will need root privileges to install it.
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    25
</para>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    26
</section>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    27
<section>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    28
<title>Step by step</title>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    29
<para>
134
525976d2827c Change the way we link to SSH tutorial
Paul Crowley <paul@lshift.net>
parents: 133
diff changeset
    30
mercurial-server authenticates users not using passwords but using SSH
525976d2827c Change the way we link to SSH tutorial
Paul Crowley <paul@lshift.net>
parents: 133
diff changeset
    31
public keys; everyone who wants access to a mercurial-server repository
131
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
    32
will need such a key. In combination with <command>ssh-agent</command> (or
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    33
equivalents such as the Windows program <link
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    34
xlink:href="http://the.earth.li/~sgtatham/putty/0.60/htmldoc/Chapter9.html#pageant">Pageant</link>),
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    35
this means that users will not need to type in a password to access the
134
525976d2827c Change the way we link to SSH tutorial
Paul Crowley <paul@lshift.net>
parents: 133
diff changeset
    36
repository. If you're not familiar with SSH public keys, the <link
525976d2827c Change the way we link to SSH tutorial
Paul Crowley <paul@lshift.net>
parents: 133
diff changeset
    37
xlink:href="http://sial.org/howto/openssh/publickey-auth/">OpenSSH Public
525976d2827c Change the way we link to SSH tutorial
Paul Crowley <paul@lshift.net>
parents: 133
diff changeset
    38
Key Authentication tutorial</link> may be helpful.
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    39
</para>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    40
<section>
131
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
    41
<title>Installing mercurial-server</title>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    42
<para>
122
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    43
In what follows, we assume that your username is <systemitem
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    44
class="username">jay</systemitem>, that you usually sit at a machine called
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    45
<systemitem class="systemname">my-workstation</systemitem> and you wish to
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    46
install mercurial-server on <systemitem
131
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
    47
class="systemname">repository-host</systemitem>. We assume that you have created your SSH public key, set up your SSH agent with this key, and that this key gives you access to <systemitem
134
525976d2827c Change the way we link to SSH tutorial
Paul Crowley <paul@lshift.net>
parents: 133
diff changeset
    48
class="systemname">repository-host</systemitem>.  
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    49
</para>
131
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
    50
<para>First install mercurial-server on <systemitem
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
    51
class="systemname">repository-host</systemitem>:</para>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    52
<screen>
131
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
    53
<computeroutput>jay@my-workstation:~$ </computeroutput><userinput>scp mercurial-server_0.6.1_amd64.deb repository-host:</userinput>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    54
<computeroutput>mercurial-server_0.6.1_amd64.deb 100%
122
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    55
jay@my-workstation:~$ </computeroutput><userinput>ssh -A repository-host</userinput>
138
44ee9dc3bba9 Remove cut/paste error in commands
Paul Crowley <paul@lshift.net>
parents: 137
diff changeset
    56
<computeroutput>jay@repository-host:~$ </computeroutput><userinput>sudo dpkg -i mercurial-server_0.6.1_amd64.deb</userinput>
122
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    57
<computeroutput>[sudo] password for jay: 
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    58
Selecting previously deselected package mercurial-server.
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    59
(Reading database ... 144805 files and directories currently installed.)
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    60
Unpacking mercurial-server (from .../mercurial-server_0.6.1_amd64.deb) ...
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    61
Setting up mercurial-server (0.6.1) ...
122
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    62
jay@repository-host:~$ </computeroutput></screen>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    63
<para>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    64
mercurial-server is now installed on the repository host.  Next, we need to give you permission to access its repositories.
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    65
</para>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    66
<screen>
122
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    67
<computeroutput>jay@repository-host:~$ </computeroutput><userinput>ssh-add -L > my-key</userinput>
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    68
<computeroutput>jay@repository-host:~$ </computeroutput><userinput>sudo mkdir -p /etc/mercurial-server/keys/root/jay</userinput>
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    69
<computeroutput>jay@repository-host:~$ </computeroutput><userinput>sudo cp my-key /etc/mercurial-server/keys/root/jay/my-workstation</userinput>
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    70
<computeroutput>jay@repository-host:~$ </computeroutput><userinput>sudo -u hg /usr/share/mercurial-server/refresh-auth</userinput>
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    71
<computeroutput>jay@repository-host:~$ </computeroutput><userinput>exit</userinput>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    72
<computeroutput>Connection to shell closed.
122
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    73
jay@my-workstation:~$ </computeroutput></screen>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    74
<para>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    75
You can now create repositories on the remote machine and have complete
131
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
    76
read-write access to all of them.
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    77
</para>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    78
</section>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    79
<section>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    80
<title>Creating repositories</title>
131
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
    81
<para>
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
    82
To store a repository on the server, clone it over.
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
    83
</para>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    84
<screen>
122
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    85
<computeroutput>jay@my-workstation:~$ </computeroutput><userinput>cd my-mercurial-project</userinput>
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    86
<computeroutput>jay@my-workstation:~/my-mercurial-project$ </computeroutput><userinput>hg clone . ssh://hg@repository-host/repository/name</userinput>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    87
<computeroutput>searching for changes
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    88
remote: adding changesets
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    89
remote: adding manifests
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    90
remote: adding file changes
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    91
remote: added 119 changesets with 284 changes to 61 files
122
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    92
jay@my-workstation:~/my-mercurial-project$ </computeroutput><userinput>hg pull ssh://hg@repository-host/repository/name</userinput>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    93
<computeroutput>pulling from ssh://hg@repository-host/repository/name
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    94
searching for changes
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    95
no changes found
136
492bc9e536e1 Move the cd up one section
Paul Crowley <paul@lshift.net>
parents: 135
diff changeset
    96
<computeroutput>jay@my-workstation:~/my-mercurial-project$ </computeroutput><userinput>cd ..</userinput>
492bc9e536e1 Move the cd up one section
Paul Crowley <paul@lshift.net>
parents: 135
diff changeset
    97
jay@my-workstation:~$ </computeroutput></screen>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    98
</section>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    99
<section>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   100
<title>Adding other users</title>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   101
<para>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   102
As things stand, no-one but you has any access to any repositories you
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   103
create on this system. In order to give anyone else access, you'll need a
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   104
copy of their SSH public key; we'll assume you have that key in
131
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
   105
<filename>~/sam-key.pub</filename>.  To manage access, you make changes to the special <literal>hgadmin</literal> repository.
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   106
</para>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   107
<screen>
122
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
   108
<computeroutput>jay@my-workstation:~$ </computeroutput><userinput>hg clone ssh://hg@repository-host/hgadmin</userinput>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   109
<computeroutput>destination directory: hgadmin
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   110
no changes found
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   111
updating working directory
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   112
0 files updated, 0 files merged, 0 files removed, 0 files unresolved
122
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
   113
jay@my-workstation:~$ </computeroutput><userinput>cd hgadmin</userinput>
123
20b54500a618 Call the other user "Sam"
Paul Crowley <paul@lshift.net>
parents: 122
diff changeset
   114
<computeroutput>jay@my-workstation:~/hgadmin$ </computeroutput><userinput>mkdir -p keys/users/sam</userinput>
135
298c6ea6295c Missed something in change to sam
Paul Crowley <paul@lshift.net>
parents: 134
diff changeset
   115
<computeroutput>jay@my-workstation:~/hgadmin$ </computeroutput><userinput>cp ~/sam-key.pub keys/users/sam/their-workstation</userinput>
122
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
   116
<computeroutput>jay@my-workstation:~/hgadmin$ </computeroutput><userinput>hg add</userinput>
123
20b54500a618 Call the other user "Sam"
Paul Crowley <paul@lshift.net>
parents: 122
diff changeset
   117
<computeroutput>adding keys/users/sam/their-workstation
20b54500a618 Call the other user "Sam"
Paul Crowley <paul@lshift.net>
parents: 122
diff changeset
   118
jay@my-workstation:~/hgadmin$ </computeroutput><userinput>hg commit -m "Add Sam's key'"</userinput>
122
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
   119
<computeroutput>jay@my-workstation:~/hgadmin$ </computeroutput><userinput>hg push</userinput>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   120
<computeroutput>pushing to ssh://hg@repository-host/hgadmin
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   121
searching for changes
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   122
remote: adding changesets
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   123
remote: adding manifests
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   124
remote: adding file changes
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   125
remote: added 1 changesets with 1 changes to 1 files
122
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
   126
jay@my-workstation:~/hgadmin$ </computeroutput></screen>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   127
<para>
123
20b54500a618 Call the other user "Sam"
Paul Crowley <paul@lshift.net>
parents: 122
diff changeset
   128
Sam can now read and write to your
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   129
<literal>ssh://hg@repository-host/repository/name</literal> repository.
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   130
Most other changes to access control can be made simply by making and
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   131
pushing changes to <literal>hgadmin</literal>, and you can use Mercurial to
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   132
cooperate with other root users in the normal way.
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   133
</para>
131
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
   134
<para>
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
   135
If you prefer, you could give them access by
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
   136
logging into <systemitem class="systemname">repository-host</systemitem>,
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
   137
putting the key in the right place under <filename
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
   138
class='directory'>/etc/mercurial-server/keys</filename>, and re-running
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
   139
<userinput>sudo -u hg /usr/share/mercurial-server/refresh-auth</userinput>.
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
   140
However, using <literal>hgadmin</literal> is usually more convenient if you need to make more than a very few changes; it also makes it easier to share administration with others and provides a log of all changes.
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
   141
</para>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   142
</section>
132
a5850a63390f Move basic access control to the start of access control
Paul Crowley <paul@lshift.net>
parents: 131
diff changeset
   143
</section>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   144
<section>
132
a5850a63390f Move basic access control to the start of access control
Paul Crowley <paul@lshift.net>
parents: 131
diff changeset
   145
<title>Access control</title>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   146
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   147
Out of the box, mercurial-server supports two kinds of users: "root" users and normal users.  If you followed the steps above, you are a "root" user because your key is under <filename class='directory'>keys/root</filename>, while the other user you gave access to is a normal user since their key is under <filename class='directory'>keys/users</filename>.  Keys that are not in either of these directories will by default have no access to anything.
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   148
</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   149
<para>
132
a5850a63390f Move basic access control to the start of access control
Paul Crowley <paul@lshift.net>
parents: 131
diff changeset
   150
Root users can edit <literal>hgadmin</literal>, create new repositories and read and write to existing ones.  Normal users cannot access <literal>hgadmin</literal> or create new repositories, but they can read and write to any other repository.
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   151
</para>
132
a5850a63390f Move basic access control to the start of access control
Paul Crowley <paul@lshift.net>
parents: 131
diff changeset
   152
<section>
a5850a63390f Move basic access control to the start of access control
Paul Crowley <paul@lshift.net>
parents: 131
diff changeset
   153
<title>Using access.conf</title>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   154
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   155
mercurial-server offers much more fine-grained access control than this division into two classes of users.  Let's suppose you wish to give Pat access to the <literal>widget</literal> repository, but no other.  We first copy Pat's SSH public key into the <filename
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   156
class='directory'>keys/widget/pat</filename> directory in <literal>hgadmin</literal>.  Now mercurial-server knows about Pat's key, but will give Pat no access to anything because the key is not under either <filename
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   157
class='directory'>keys/root</filename> or <filename
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   158
class='directory'>keys/users</filename>.  To grant this key access, we must give mercurial-server a new access rule, so we create a file in <literal>hgadmin</literal> called <filename>access.conf</filename>, with the following contents:</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   159
<programlisting>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   160
    write repo=widget user=widget/**
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   161
</programlisting>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   162
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   163
Pat will have read and write access as soon as we add, commit, and push these files.
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   164
</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   165
<para>
124
6836769f5134 Forgot a filename tag
Paul Crowley <paul@lshift.net>
parents: 123
diff changeset
   166
Each line of <filename>access.conf</filename> has the following syntax:
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   167
</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   168
<programlisting>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   169
<replaceable>rule</replaceable> <replaceable>condition</replaceable> <replaceable>condition...</replaceable>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   170
</programlisting>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   171
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   172
Blank lines and lines that start with <literal>#</literal> are ignored. Rule is one of
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   173
</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   174
<itemizedlist>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   175
<listitem>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   176
<literal>init</literal>: allow reads, writes, and the creation of new repositories
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   177
</listitem>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   178
<listitem>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   179
<literal>write</literal>: allow reads and writes
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   180
</listitem>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   181
<listitem>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   182
<literal>read</literal>: allow only read operations
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   183
</listitem>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   184
<listitem>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   185
<literal>deny</literal>: deny all requests
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   186
</listitem>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   187
</itemizedlist>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   188
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   189
When considering a request, mercurial-server steps through all the rules in <filename>/etc/mercurial-server/access.conf</filename> and then all the rules in <filename>access.conf</filename> in <literal>hgadmin</literal> looking for a rule which matches on every condition.  If it does not find such a rule, it denies the request; otherwise it checks whether the rule grants sufficient privilege to allow it.
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   190
</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   191
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   192
By default, <filename>/etc/mercurial-server/access.conf</filename> has the following rules:
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   193
</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   194
<programlisting>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   195
    init user=root/**
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   196
    deny repo=hgadmin
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   197
    write user=users/**
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   198
</programlisting>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   199
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   200
These rules ensure that root users can do any operation on any repository, that no other users can access the <literal>hgadmin</literal> repository, and that those with keys in <filename class='directory'>keys/users</filename> can read or write to any repository but not create repositories.
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   201
</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   202
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   203
A condition is a globpattern matched against a relative path. The two most
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   204
important conditions are
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   205
</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   206
<itemizedlist>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   207
<listitem>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   208
<code><literal>user=</literal><replaceable>globpattern</replaceable></code>: path to the user's key
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   209
</listitem>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   210
<listitem>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   211
<code><literal>repo=</literal><replaceable>globpattern</replaceable></code>: path to the repository
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   212
</listitem>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   213
</itemizedlist>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   214
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   215
"*" only matches one directory level, where "**" matches as many as you
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   216
want. More precisely, "*" matches zero or more characters not including "/"
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   217
while "**" matches zero or more characters including "/".
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   218
</para>
132
a5850a63390f Move basic access control to the start of access control
Paul Crowley <paul@lshift.net>
parents: 131
diff changeset
   219
</section>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   220
<section>
125
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   221
<title>/etc/mercurial-server and hgadmin</title>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   222
<para>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   223
mercurial-server consults two distinct locations to collect information about what to allow: <filename
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   224
class='directory'>/etc/mercurial-server</filename> and its own <literal>hgadmin</literal> repository.  This is useful for several reasons:
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   225
</para>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   226
<itemizedlist>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   227
<listitem>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   228
Users may not need the sophistication of access control via mercurial; for these users updating <filename
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   229
class='directory'>/etc/mercurial-server</filename> may offer a simpler route.
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   230
</listitem>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   231
<listitem>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   232
<filename
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   233
class='directory'>/etc/mercurial-server</filename> is suitable for management by some other route, such as with  <link
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   234
xlink:href="http://reductivelabs.com/products/puppet">Puppet</link>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   235
</listitem>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   236
<listitem>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   237
If a change to <literal>hgadmin</literal> leaves you "locked out", <filename
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   238
class='directory'>/etc/mercurial-server</filename> allows you a way back in.
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   239
</listitem>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   240
<listitem>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   241
At install time, all users are "locked out", and so some mechanism to allow some users in is needed.
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   242
</listitem>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   243
</itemizedlist>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   244
<para>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   245
Rules in <filename>/etc/mercurial-server/access.conf</filename> take precedence over those in <literal>hgadmin</literal>, and obviously keys in <filename class='directory'>/etc/mercurial-server/keys</filename> cannot be affected by changes to <literal>hgadmin</literal>.
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   246
</para>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   247
<para>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   248
We anticipate that once mercurial-server is successfully installed and
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   249
working most users will want to use <literal>hgadmin</literal> for most
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   250
access control tasks. Once you have the right keys and
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   251
<filename>access.conf</filename> set up in <literal>hgadmin</literal>, you
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   252
can delete <filename>/etc/mercurial-server/access.conf</filename> and all
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   253
of <filename class='directory'>/etc/mercurial-server/keys</filename>,
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   254
turning control entirely over to <literal>hgadmin</literal>.
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   255
</para>
127
3262c0a53b59 Talk about remote-hgrc
Paul Crowley <paul@lshift.net>
parents: 126
diff changeset
   256
<para>
3262c0a53b59 Talk about remote-hgrc
Paul Crowley <paul@lshift.net>
parents: 126
diff changeset
   257
<filename>/etc/mercurial-server/remote-hgrc</filename> is in the
3262c0a53b59 Talk about remote-hgrc
Paul Crowley <paul@lshift.net>
parents: 126
diff changeset
   258
<systemitem>HGRCPATH</systemitem> for all remote access to mercurial-server
3262c0a53b59 Talk about remote-hgrc
Paul Crowley <paul@lshift.net>
parents: 126
diff changeset
   259
repositories. This file contains the hooks that mercurial-server uses for
3262c0a53b59 Talk about remote-hgrc
Paul Crowley <paul@lshift.net>
parents: 126
diff changeset
   260
access control and logging. You can add hooks to this file, but obviously
3262c0a53b59 Talk about remote-hgrc
Paul Crowley <paul@lshift.net>
parents: 126
diff changeset
   261
breaking the existing hooks will disable the relevant functionality and
3262c0a53b59 Talk about remote-hgrc
Paul Crowley <paul@lshift.net>
parents: 126
diff changeset
   262
isn't advisable.
3262c0a53b59 Talk about remote-hgrc
Paul Crowley <paul@lshift.net>
parents: 126
diff changeset
   263
</para>
125
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   264
</section>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   265
<section>
121
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   266
<title>File and branch conditions</title>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   267
<para>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   268
mercurial-server supports file and branch conditions, which restrict an
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   269
operation depending on what files it modifies and what branch the work is
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   270
on. </para>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   271
<caution>
128
b1610de4b6b1 Reword caution
Paul Crowley <paul@lshift.net>
parents: 127
diff changeset
   272
The way these conditions work is subtle and can be counterintuitive. Unless
b1610de4b6b1 Reword caution
Paul Crowley <paul@lshift.net>
parents: 127
diff changeset
   273
you need what they provide, ignore this section, stick to user and repo
140
0f79d1bea07e Beef up the caution
Paul Crowley <paul@lshift.net>
parents: 139
diff changeset
   274
conditions, and then things are likely to work the way you would expect. If
0f79d1bea07e Beef up the caution
Paul Crowley <paul@lshift.net>
parents: 139
diff changeset
   275
you do need what they provide, read what follows very carefully.
121
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   276
</caution>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   277
<para>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   278
File and branch conditions are added to the conditions against which a rule
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   279
matches, just like user and repo conditions; they have this form:
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   280
</para>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   281
<itemizedlist>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   282
<listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   283
<code><literal>file=</literal><replaceable>globpattern</replaceable></code>: file within the repo
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   284
</listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   285
<listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   286
<code><literal>branch=</literal><replaceable>globpattern</replaceable></code>: Mercurial branch name
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   287
</listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   288
</itemizedlist>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   289
<para>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   290
However, in order to understand what effect adding these conditions will
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   291
have, it helps to understand how and when these rules are applied.
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   292
</para>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   293
<para>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   294
The rules file is used to make three decisions:
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   295
</para>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   296
<itemizedlist>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   297
<listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   298
Whether to allow a repository to be created
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   299
</listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   300
<listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   301
Whether to allow any access to a repository
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   302
</listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   303
<listitem>
139
b7e78f9705e6 There are only three decisions, honest
Paul Crowley <paul@lshift.net>
parents: 138
diff changeset
   304
Whether to allow a changeset
121
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   305
</listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   306
</itemizedlist>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   307
<para>
121
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   308
When the first two of these decisions are being made, nothing is known
139
b7e78f9705e6 There are only three decisions, honest
Paul Crowley <paul@lshift.net>
parents: 138
diff changeset
   309
about any changsets that might be pushed, and so all file and branch
b7e78f9705e6 There are only three decisions, honest
Paul Crowley <paul@lshift.net>
parents: 138
diff changeset
   310
conditions automatically succeed for the purpose of such decisions. For the
b7e78f9705e6 There are only three decisions, honest
Paul Crowley <paul@lshift.net>
parents: 138
diff changeset
   311
third condition, every file changed in the changeset must be allowed by a
b7e78f9705e6 There are only three decisions, honest
Paul Crowley <paul@lshift.net>
parents: 138
diff changeset
   312
<literal>write</literal> or <literal>init</literal> rule for the changeset
b7e78f9705e6 There are only three decisions, honest
Paul Crowley <paul@lshift.net>
parents: 138
diff changeset
   313
to be allowed.
b7e78f9705e6 There are only three decisions, honest
Paul Crowley <paul@lshift.net>
parents: 138
diff changeset
   314
</para>
b7e78f9705e6 There are only three decisions, honest
Paul Crowley <paul@lshift.net>
parents: 138
diff changeset
   315
<para>
b7e78f9705e6 There are only three decisions, honest
Paul Crowley <paul@lshift.net>
parents: 138
diff changeset
   316
This means that doing tricky things with file conditions can have
b7e78f9705e6 There are only three decisions, honest
Paul Crowley <paul@lshift.net>
parents: 138
diff changeset
   317
counterintuitive consequences:
121
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   318
</para>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   319
<itemizedlist>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   320
<listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   321
<para>You cannot limit read access to a subset of a repository with a "read"
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   322
rule and a file condition: any user who has access to a repository can read
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   323
all of it and its full history. Such a rule can only have the effect of
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   324
masking a later "write" rule, as in this example:</para>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   325
<programlisting>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   326
   read repo=specialrepo file=dontwritethis
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   327
   write repo=specialrepo
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   328
</programlisting>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   329
<para>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   330
allows all users to read specialrepo, and to write to all files
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   331
<emphasis>except</emphasis> that any changeset which writes to
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   332
<filename>dontwritethis</filename> will be rejected.
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   333
</para>
121
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   334
</listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   335
<listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   336
For similar reasons, don't give <literal>init</literal> rules file conditions.
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   337
</listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   338
<listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   339
<para>Don't try to deny write access to a particular file on a particular
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   340
branch - a developer can write to the file on another branch and then merge
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   341
it in. Either deny all writes to the branch from that user, or allow them
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   342
to write to all the files they can write to on any branch. In other words,
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   343
something like this will have the intended effect:
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   344
</para>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   345
<programlisting>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   346
   write user=docs/* branch=docs file=docs/*
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   347
</programlisting>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   348
<para>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   349
But something like this will not have the intended effect; it will
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   350
effectively allow these users to write to any file on any branch, by
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   351
writing it to "docs" first:
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   352
</para>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   353
<programlisting>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   354
  write user=docs/* branch=docs
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   355
  write user=docs/* file=docs/*
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   356
  read user=docs/*
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   357
</programlisting>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   358
</listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   359
</itemizedlist>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   360
</section>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   361
</section>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   362
<section>
126
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   363
<title>How mercurial-server works</title>
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   364
<para>
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   365
All of the repositories controlled by mercurial-server are owned by a
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   366
single user, the <literal>hg</literal> user, which is why all URLs for
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   367
mercurial-server repositories start with <literal>ssh://hg@...</literal>.
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   368
Each SSH key that has access to the repository has an entry in
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   369
<filename>~hg/.ssh/authorized_keys</filename>; this is how the SSH daemon
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   370
knows to give that key access. When the user connects over SSH, their
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   371
commands are run in a specially crafted restricted shell; this shell knows
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   372
which key was used to connect, determines what the user is trying to do,
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   373
and checks the access rules to decide whether to allow it.  
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   374
</para>
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   375
<para>
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   376
This restricted shell also ensures that certain Mercurial extensions are
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   377
loaded when the user acts on a repository; these extensions check the
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   378
access control rules for any changeset that the user tries to commit, and
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   379
log all pushes and pulls into a per-repository access log.
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   380
</para>
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   381
<para>
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   382
<command>refresh-auth</command> recurses through the <filename
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   383
class='directory'>/etc/mercurial-server/keys</filename> and the <filename
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   384
class='directory'>keys</filename> directory in the
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   385
<literal>hgadmin</literal> repository, creating an entry in
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   386
<filename>~hg/.ssh/authorized_keys</filename> for each one. This is redone
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   387
automatically whenever a change is pushed to <literal>hgadmin</literal>.
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   388
</para>
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   389
</section>
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   390
<section>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   391
<title>Security</title>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   392
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   393
mercurial-server relies entirely on sshd to grant access to remote users.
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   394
As a result, it runs no daemons, installs no setuid programs, and no part
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   395
of it runs as root except the install process: all programs run as the user
137
5bcd5a5e4220 Tweak security para
Paul Crowley <paul@lshift.net>
parents: 136
diff changeset
   396
hg. Any attack on mercurial-server can only be started if the attacker
5bcd5a5e4220 Tweak security para
Paul Crowley <paul@lshift.net>
parents: 136
diff changeset
   397
already has a public key in <filename>~hg/.ssh/authorized_keys</filename>,
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   398
otherwise sshd will bar the way.
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   399
</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   400
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   401
No matter what command the user tries to run on the remote system via SSH,
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   402
mercurial-server is run. It parses the command line the user asked for, and
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   403
interprets and runs the corresponding hg operation itself if access is
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   404
allowed, so users can only read and add to history within repositories;
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   405
they cannot run any other hg command. In addition, every push and pull is
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   406
logged with a datestamp, changeset ID and the key that performed the
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   407
operation.
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   408
</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   409
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   410
However, while the first paragraph holds no matter what bugs
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   411
mercurial-server contains, the second depends on the relevant code being
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   412
correct; though the entire codebase is short, mercurial-server is a fairly
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   413
new program and may harbour bugs. Backups are essential!
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   414
</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   415
</section>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   416
<section>
129
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   417
<title>Legalese</title>
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   418
<para>
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   419
This program is free software; you can redistribute it and/or modify it
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   420
under the terms of the GNU General Public License as published by the Free
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   421
Software Foundation; either version 2 of the License, or (at your option)
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   422
any later version.
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   423
</para>
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   424
<para>
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   425
This program is distributed in the hope that it will be useful, but
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   426
WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   427
or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   428
more details.
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   429
</para>
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   430
<para>
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   431
You should have received a copy of the GNU General Public License along
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   432
with this program; if not, write to the Free Software Foundation, Inc., 51
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   433
Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   434
</para>
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   435
</section>
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   436
<section>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   437
<title>Thanks</title>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   438
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   439
Thanks for reading this far. If you use mercurial-server, please tell me about
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   440
it.
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   441
</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   442
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   443
Paul Crowley, <email>paul@lshift.net</email>, 2009
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   444
</para>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   445
</section>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   446
</article>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   447