doc/manual.docbook
author Paul Crowley <paul@lshift.net>
Wed, 14 Oct 2009 17:06:53 +0100
changeset 131 e8bf13d06582
parent 130 850d46ca28ca
child 132 a5850a63390f
permissions -rw-r--r--
Assume they have SSH set up; talk about hgadmin first
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
     1
<?xml version="1.0" encoding="utf-8"?>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
     2
<article xmlns="http://docbook.org/ns/docbook" version="5.0" xml:lang="en"
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
     3
  xmlns:xlink="http://www.w3.org/1999/xlink">
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
     4
<info>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
     5
  <title>Sharing Mercurial repositories with mercurial-server</title>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
     6
  <author><firstname>Paul</firstname><surname>Crowley</surname></author>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
     7
  <copyright><year>2009</year><holder>Paul Crowley, LShift Ltd</holder></copyright>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
     8
</info>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
     9
<section>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    10
<title>About mercurial-server</title>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    11
<para>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    12
Home page: <link xlink:href="http://www.lshift.net/mercurial-server.html"/>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    13
</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    14
<para>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    15
mercurial-server is software for Debian and Ubuntu systems which gives your
130
850d46ca28ca don't write about alternatives; best done elsewhere.
Paul Crowley <paul@lshift.net>
parents: 129
diff changeset
    16
developers remote read/write access to centralized <link
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    17
xlink:href="http://hg-scm.org/">Mercurial</link> repositories using SSH public
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    18
key authentication; it provides convenient and fine-grained key management
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    19
and access control.
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    20
</para>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    21
<para>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    22
Though mercurial-server is currently targeted at Debian-based systems such
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    23
as Ubuntu, other users have reported success getting it running on other
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    24
Unix-based systems such as Red Hat. Running it on a non-Unix system such as
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    25
Windows is not supported. You will need root privileges to install it.
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    26
</para>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    27
</section>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    28
<section>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    29
<title>Step by step</title>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    30
<para>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    31
mercurial-server authenticates users not using passwords but using <link
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    32
xlink:href="http://sial.org/howto/openssh/publickey-auth/">SSH public
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    33
keys</link>; everyone who wants access to a mercurial-server repository
131
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
    34
will need such a key. In combination with <command>ssh-agent</command> (or
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    35
equivalents such as the Windows program <link
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    36
xlink:href="http://the.earth.li/~sgtatham/putty/0.60/htmldoc/Chapter9.html#pageant">Pageant</link>),
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    37
this means that users will not need to type in a password to access the
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    38
repository.
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    39
</para>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    40
<section>
131
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
    41
<title>Installing mercurial-server</title>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    42
<para>
122
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    43
In what follows, we assume that your username is <systemitem
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    44
class="username">jay</systemitem>, that you usually sit at a machine called
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    45
<systemitem class="systemname">my-workstation</systemitem> and you wish to
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    46
install mercurial-server on <systemitem
131
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
    47
class="systemname">repository-host</systemitem>. We assume that you have created your SSH public key, set up your SSH agent with this key, and that this key gives you access to <systemitem
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
    48
class="systemname">repository-host</systemitem>.  If you're not familiar with SSH public keys, the <link
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
    49
xlink:href="http://sial.org/howto/openssh/publickey-auth/">OpenSSH Public
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
    50
Key Authentication tutorial</link> may be helpful.
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    51
</para>
131
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
    52
<para>First install mercurial-server on <systemitem
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
    53
class="systemname">repository-host</systemitem>:</para>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    54
<screen>
131
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
    55
<computeroutput>jay@my-workstation:~$ </computeroutput><userinput>scp mercurial-server_0.6.1_amd64.deb repository-host:</userinput>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    56
<computeroutput>mercurial-server_0.6.1_amd64.deb 100%
122
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    57
jay@my-workstation:~$ </computeroutput><userinput>ssh -A repository-host</userinput>
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    58
<computeroutput>jay@repository-host:~$ </computeroutput><userinput>sudo dpkg -i ../mercurial-server_0.6.1_amd64.deb</userinput>
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    59
<computeroutput>[sudo] password for jay: 
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    60
Selecting previously deselected package mercurial-server.
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    61
(Reading database ... 144805 files and directories currently installed.)
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    62
Unpacking mercurial-server (from .../mercurial-server_0.6.1_amd64.deb) ...
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    63
Setting up mercurial-server (0.6.1) ...
122
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    64
jay@repository-host:~$ </computeroutput></screen>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    65
<para>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    66
mercurial-server is now installed on the repository host.  Next, we need to give you permission to access its repositories.
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    67
</para>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    68
<screen>
122
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    69
<computeroutput>jay@repository-host:~$ </computeroutput><userinput>ssh-add -L > my-key</userinput>
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    70
<computeroutput>jay@repository-host:~$ </computeroutput><userinput>sudo mkdir -p /etc/mercurial-server/keys/root/jay</userinput>
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    71
<computeroutput>jay@repository-host:~$ </computeroutput><userinput>sudo cp my-key /etc/mercurial-server/keys/root/jay/my-workstation</userinput>
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    72
<computeroutput>jay@repository-host:~$ </computeroutput><userinput>sudo -u hg /usr/share/mercurial-server/refresh-auth</userinput>
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    73
<computeroutput>jay@repository-host:~$ </computeroutput><userinput>exit</userinput>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    74
<computeroutput>Connection to shell closed.
122
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    75
jay@my-workstation:~$ </computeroutput></screen>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    76
<para>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    77
You can now create repositories on the remote machine and have complete
131
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
    78
read-write access to all of them.
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    79
</para>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    80
</section>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    81
<section>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    82
<title>Creating repositories</title>
131
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
    83
<para>
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
    84
To store a repository on the server, clone it over.
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
    85
</para>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    86
<screen>
122
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    87
<computeroutput>jay@my-workstation:~$ </computeroutput><userinput>cd my-mercurial-project</userinput>
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    88
<computeroutput>jay@my-workstation:~/my-mercurial-project$ </computeroutput><userinput>hg clone . ssh://hg@repository-host/repository/name</userinput>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    89
<computeroutput>searching for changes
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    90
remote: adding changesets
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    91
remote: adding manifests
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    92
remote: adding file changes
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    93
remote: added 119 changesets with 284 changes to 61 files
122
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    94
jay@my-workstation:~/my-mercurial-project$ </computeroutput><userinput>hg pull ssh://hg@repository-host/repository/name</userinput>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    95
<computeroutput>pulling from ssh://hg@repository-host/repository/name
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    96
searching for changes
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
    97
no changes found
122
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
    98
jay@my-workstation:~/my-mercurial-project$ </computeroutput></screen>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
    99
</section>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   100
<section>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   101
<title>Adding other users</title>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   102
<para>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   103
As things stand, no-one but you has any access to any repositories you
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   104
create on this system. In order to give anyone else access, you'll need a
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   105
copy of their SSH public key; we'll assume you have that key in
131
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
   106
<filename>~/sam-key.pub</filename>.  To manage access, you make changes to the special <literal>hgadmin</literal> repository.
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   107
</para>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   108
<screen>
122
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
   109
<computeroutput>jay@my-workstation:~/my-mercurial-project$ </computeroutput><userinput>cd ..</userinput>
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
   110
<computeroutput>jay@my-workstation:~$ </computeroutput><userinput>hg clone ssh://hg@repository-host/hgadmin</userinput>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   111
<computeroutput>destination directory: hgadmin
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   112
no changes found
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   113
updating working directory
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   114
0 files updated, 0 files merged, 0 files removed, 0 files unresolved
122
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
   115
jay@my-workstation:~$ </computeroutput><userinput>cd hgadmin</userinput>
123
20b54500a618 Call the other user "Sam"
Paul Crowley <paul@lshift.net>
parents: 122
diff changeset
   116
<computeroutput>jay@my-workstation:~/hgadmin$ </computeroutput><userinput>mkdir -p keys/users/sam</userinput>
20b54500a618 Call the other user "Sam"
Paul Crowley <paul@lshift.net>
parents: 122
diff changeset
   117
<computeroutput>jay@my-workstation:~/hgadmin$ </computeroutput><userinput>cp ~/other-users-key.pub keys/users/sam/their-workstation</userinput>
122
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
   118
<computeroutput>jay@my-workstation:~/hgadmin$ </computeroutput><userinput>hg add</userinput>
123
20b54500a618 Call the other user "Sam"
Paul Crowley <paul@lshift.net>
parents: 122
diff changeset
   119
<computeroutput>adding keys/users/sam/their-workstation
20b54500a618 Call the other user "Sam"
Paul Crowley <paul@lshift.net>
parents: 122
diff changeset
   120
jay@my-workstation:~/hgadmin$ </computeroutput><userinput>hg commit -m "Add Sam's key'"</userinput>
122
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
   121
<computeroutput>jay@my-workstation:~/hgadmin$ </computeroutput><userinput>hg push</userinput>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   122
<computeroutput>pushing to ssh://hg@repository-host/hgadmin
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   123
searching for changes
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   124
remote: adding changesets
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   125
remote: adding manifests
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   126
remote: adding file changes
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   127
remote: added 1 changesets with 1 changes to 1 files
122
05b676684c7e Call the user jay rather than user, and use pat instead of other-user
Paul Crowley <paul@lshift.net>
parents: 121
diff changeset
   128
jay@my-workstation:~/hgadmin$ </computeroutput></screen>
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   129
<para>
123
20b54500a618 Call the other user "Sam"
Paul Crowley <paul@lshift.net>
parents: 122
diff changeset
   130
Sam can now read and write to your
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   131
<literal>ssh://hg@repository-host/repository/name</literal> repository.
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   132
Most other changes to access control can be made simply by making and
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   133
pushing changes to <literal>hgadmin</literal>, and you can use Mercurial to
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   134
cooperate with other root users in the normal way.
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   135
</para>
131
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
   136
<para>
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
   137
If you prefer, you could give them access by
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
   138
logging into <systemitem class="systemname">repository-host</systemitem>,
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
   139
putting the key in the right place under <filename
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
   140
class='directory'>/etc/mercurial-server/keys</filename>, and re-running
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
   141
<userinput>sudo -u hg /usr/share/mercurial-server/refresh-auth</userinput>.
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
   142
However, using <literal>hgadmin</literal> is usually more convenient if you need to make more than a very few changes; it also makes it easier to share administration with others and provides a log of all changes.
e8bf13d06582 Assume they have SSH set up; talk about hgadmin first
Paul Crowley <paul@lshift.net>
parents: 130
diff changeset
   143
</para>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   144
</section>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   145
<section>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   146
<title>Basic access control</title>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   147
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   148
Out of the box, mercurial-server supports two kinds of users: "root" users and normal users.  If you followed the steps above, you are a "root" user because your key is under <filename class='directory'>keys/root</filename>, while the other user you gave access to is a normal user since their key is under <filename class='directory'>keys/users</filename>.  Keys that are not in either of these directories will by default have no access to anything.
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   149
</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   150
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   151
Root users can edit <literal>hgadmin</literal>, create new repositories and read and write to existing ones.  Normal users cannot access <literal>hgadmin</literal> or create new repositories, but they can read and write to any other repository.  This is only the default configuration; for more advanced configuration read <xref linkend="accesscontrol"/>.
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   152
</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   153
</section>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   154
</section>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   155
<section id="accesscontrol">
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   156
<title>Access control</title>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   157
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   158
mercurial-server offers much more fine-grained access control than this division into two classes of users.  Let's suppose you wish to give Pat access to the <literal>widget</literal> repository, but no other.  We first copy Pat's SSH public key into the <filename
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   159
class='directory'>keys/widget/pat</filename> directory in <literal>hgadmin</literal>.  Now mercurial-server knows about Pat's key, but will give Pat no access to anything because the key is not under either <filename
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   160
class='directory'>keys/root</filename> or <filename
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   161
class='directory'>keys/users</filename>.  To grant this key access, we must give mercurial-server a new access rule, so we create a file in <literal>hgadmin</literal> called <filename>access.conf</filename>, with the following contents:</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   162
<programlisting>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   163
    write repo=widget user=widget/**
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   164
</programlisting>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   165
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   166
Pat will have read and write access as soon as we add, commit, and push these files.
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   167
</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   168
<para>
124
6836769f5134 Forgot a filename tag
Paul Crowley <paul@lshift.net>
parents: 123
diff changeset
   169
Each line of <filename>access.conf</filename> has the following syntax:
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   170
</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   171
<programlisting>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   172
<replaceable>rule</replaceable> <replaceable>condition</replaceable> <replaceable>condition...</replaceable>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   173
</programlisting>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   174
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   175
Blank lines and lines that start with <literal>#</literal> are ignored. Rule is one of
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   176
</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   177
<itemizedlist>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   178
<listitem>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   179
<literal>init</literal>: allow reads, writes, and the creation of new repositories
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   180
</listitem>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   181
<listitem>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   182
<literal>write</literal>: allow reads and writes
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   183
</listitem>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   184
<listitem>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   185
<literal>read</literal>: allow only read operations
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   186
</listitem>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   187
<listitem>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   188
<literal>deny</literal>: deny all requests
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   189
</listitem>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   190
</itemizedlist>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   191
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   192
When considering a request, mercurial-server steps through all the rules in <filename>/etc/mercurial-server/access.conf</filename> and then all the rules in <filename>access.conf</filename> in <literal>hgadmin</literal> looking for a rule which matches on every condition.  If it does not find such a rule, it denies the request; otherwise it checks whether the rule grants sufficient privilege to allow it.
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   193
</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   194
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   195
By default, <filename>/etc/mercurial-server/access.conf</filename> has the following rules:
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   196
</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   197
<programlisting>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   198
    init user=root/**
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   199
    deny repo=hgadmin
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   200
    write user=users/**
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   201
</programlisting>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   202
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   203
These rules ensure that root users can do any operation on any repository, that no other users can access the <literal>hgadmin</literal> repository, and that those with keys in <filename class='directory'>keys/users</filename> can read or write to any repository but not create repositories.
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   204
</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   205
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   206
A condition is a globpattern matched against a relative path. The two most
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   207
important conditions are
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   208
</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   209
<itemizedlist>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   210
<listitem>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   211
<code><literal>user=</literal><replaceable>globpattern</replaceable></code>: path to the user's key
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   212
</listitem>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   213
<listitem>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   214
<code><literal>repo=</literal><replaceable>globpattern</replaceable></code>: path to the repository
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   215
</listitem>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   216
</itemizedlist>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   217
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   218
"*" only matches one directory level, where "**" matches as many as you
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   219
want. More precisely, "*" matches zero or more characters not including "/"
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   220
while "**" matches zero or more characters including "/".
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   221
</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   222
<section>
125
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   223
<title>/etc/mercurial-server and hgadmin</title>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   224
<para>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   225
mercurial-server consults two distinct locations to collect information about what to allow: <filename
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   226
class='directory'>/etc/mercurial-server</filename> and its own <literal>hgadmin</literal> repository.  This is useful for several reasons:
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   227
</para>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   228
<itemizedlist>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   229
<listitem>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   230
Users may not need the sophistication of access control via mercurial; for these users updating <filename
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   231
class='directory'>/etc/mercurial-server</filename> may offer a simpler route.
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   232
</listitem>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   233
<listitem>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   234
<filename
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   235
class='directory'>/etc/mercurial-server</filename> is suitable for management by some other route, such as with  <link
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   236
xlink:href="http://reductivelabs.com/products/puppet">Puppet</link>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   237
</listitem>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   238
<listitem>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   239
If a change to <literal>hgadmin</literal> leaves you "locked out", <filename
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   240
class='directory'>/etc/mercurial-server</filename> allows you a way back in.
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   241
</listitem>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   242
<listitem>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   243
At install time, all users are "locked out", and so some mechanism to allow some users in is needed.
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   244
</listitem>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   245
</itemizedlist>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   246
<para>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   247
Rules in <filename>/etc/mercurial-server/access.conf</filename> take precedence over those in <literal>hgadmin</literal>, and obviously keys in <filename class='directory'>/etc/mercurial-server/keys</filename> cannot be affected by changes to <literal>hgadmin</literal>.
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   248
</para>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   249
<para>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   250
We anticipate that once mercurial-server is successfully installed and
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   251
working most users will want to use <literal>hgadmin</literal> for most
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   252
access control tasks. Once you have the right keys and
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   253
<filename>access.conf</filename> set up in <literal>hgadmin</literal>, you
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   254
can delete <filename>/etc/mercurial-server/access.conf</filename> and all
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   255
of <filename class='directory'>/etc/mercurial-server/keys</filename>,
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   256
turning control entirely over to <literal>hgadmin</literal>.
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   257
</para>
127
3262c0a53b59 Talk about remote-hgrc
Paul Crowley <paul@lshift.net>
parents: 126
diff changeset
   258
<para>
3262c0a53b59 Talk about remote-hgrc
Paul Crowley <paul@lshift.net>
parents: 126
diff changeset
   259
<filename>/etc/mercurial-server/remote-hgrc</filename> is in the
3262c0a53b59 Talk about remote-hgrc
Paul Crowley <paul@lshift.net>
parents: 126
diff changeset
   260
<systemitem>HGRCPATH</systemitem> for all remote access to mercurial-server
3262c0a53b59 Talk about remote-hgrc
Paul Crowley <paul@lshift.net>
parents: 126
diff changeset
   261
repositories. This file contains the hooks that mercurial-server uses for
3262c0a53b59 Talk about remote-hgrc
Paul Crowley <paul@lshift.net>
parents: 126
diff changeset
   262
access control and logging. You can add hooks to this file, but obviously
3262c0a53b59 Talk about remote-hgrc
Paul Crowley <paul@lshift.net>
parents: 126
diff changeset
   263
breaking the existing hooks will disable the relevant functionality and
3262c0a53b59 Talk about remote-hgrc
Paul Crowley <paul@lshift.net>
parents: 126
diff changeset
   264
isn't advisable.
3262c0a53b59 Talk about remote-hgrc
Paul Crowley <paul@lshift.net>
parents: 126
diff changeset
   265
</para>
125
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   266
</section>
fc5b8fc1040e Explain why we configure access twice
Paul Crowley <paul@lshift.net>
parents: 124
diff changeset
   267
<section>
121
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   268
<title>File and branch conditions</title>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   269
<para>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   270
mercurial-server supports file and branch conditions, which restrict an
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   271
operation depending on what files it modifies and what branch the work is
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   272
on. </para>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   273
<caution>
128
b1610de4b6b1 Reword caution
Paul Crowley <paul@lshift.net>
parents: 127
diff changeset
   274
The way these conditions work is subtle and can be counterintuitive. Unless
b1610de4b6b1 Reword caution
Paul Crowley <paul@lshift.net>
parents: 127
diff changeset
   275
you need what they provide, ignore this section, stick to user and repo
b1610de4b6b1 Reword caution
Paul Crowley <paul@lshift.net>
parents: 127
diff changeset
   276
conditions, and then things are likely to work the way you would expect.
121
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   277
</caution>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   278
<para>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   279
File and branch conditions are added to the conditions against which a rule
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   280
matches, just like user and repo conditions; they have this form:
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   281
</para>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   282
<itemizedlist>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   283
<listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   284
<code><literal>file=</literal><replaceable>globpattern</replaceable></code>: file within the repo
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   285
</listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   286
<listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   287
<code><literal>branch=</literal><replaceable>globpattern</replaceable></code>: Mercurial branch name
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   288
</listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   289
</itemizedlist>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   290
<para>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   291
However, in order to understand what effect adding these conditions will
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   292
have, it helps to understand how and when these rules are applied.
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   293
</para>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   294
<para>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   295
The rules file is used to make three decisions:
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   296
</para>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   297
<itemizedlist>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   298
<listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   299
Whether to allow a repository to be created
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   300
</listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   301
<listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   302
Whether to allow any access to a repository
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   303
</listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   304
<listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   305
Whether to allow a changeset, which is on a some branch
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   306
</listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   307
<listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   308
Whether to allow a changeset which changes a particular file
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   309
</listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   310
</itemizedlist>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   311
<para>
121
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   312
When the first two of these decisions are being made, nothing is known
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   313
about what files might be changed, and so all file and branch conditions
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   314
automatically succeed for the purpose of such decisions. This means that
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   315
doing tricky things with file conditions can have counterintuitive
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   316
consequences:
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   317
</para>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   318
<itemizedlist>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   319
<listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   320
<para>You cannot limit read access to a subset of a repository with a "read"
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   321
rule and a file condition: any user who has access to a repository can read
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   322
all of it and its full history. Such a rule can only have the effect of
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   323
masking a later "write" rule, as in this example:</para>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   324
<programlisting>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   325
   read repo=specialrepo file=dontwritethis
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   326
   write repo=specialrepo
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   327
</programlisting>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   328
<para>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   329
allows all users to read specialrepo, and to write to all files
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   330
<emphasis>except</emphasis> that any changeset which writes to
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   331
<filename>dontwritethis</filename> will be rejected.
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   332
</para>
121
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   333
</listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   334
<listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   335
For similar reasons, don't give <literal>init</literal> rules file conditions.
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   336
</listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   337
<listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   338
<para>Don't try to deny write access to a particular file on a particular
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   339
branch - a developer can write to the file on another branch and then merge
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   340
it in. Either deny all writes to the branch from that user, or allow them
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   341
to write to all the files they can write to on any branch. In other words,
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   342
something like this will have the intended effect:
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   343
</para>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   344
<programlisting>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   345
   write user=docs/* branch=docs file=docs/*
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   346
</programlisting>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   347
<para>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   348
But something like this will not have the intended effect; it will
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   349
effectively allow these users to write to any file on any branch, by
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   350
writing it to "docs" first:
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   351
</para>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   352
<programlisting>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   353
  write user=docs/* branch=docs
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   354
  write user=docs/* file=docs/*
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   355
  read user=docs/*
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   356
</programlisting>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   357
</listitem>
62185dc7d0c9 Document file and branch conditions in Docbook
Paul Crowley <paul@lshift.net>
parents: 120
diff changeset
   358
</itemizedlist>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   359
</section>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   360
</section>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   361
<section>
126
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   362
<title>How mercurial-server works</title>
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   363
<para>
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   364
All of the repositories controlled by mercurial-server are owned by a
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   365
single user, the <literal>hg</literal> user, which is why all URLs for
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   366
mercurial-server repositories start with <literal>ssh://hg@...</literal>.
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   367
Each SSH key that has access to the repository has an entry in
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   368
<filename>~hg/.ssh/authorized_keys</filename>; this is how the SSH daemon
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   369
knows to give that key access. When the user connects over SSH, their
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   370
commands are run in a specially crafted restricted shell; this shell knows
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   371
which key was used to connect, determines what the user is trying to do,
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   372
and checks the access rules to decide whether to allow it.  
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   373
</para>
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   374
<para>
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   375
This restricted shell also ensures that certain Mercurial extensions are
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   376
loaded when the user acts on a repository; these extensions check the
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   377
access control rules for any changeset that the user tries to commit, and
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   378
log all pushes and pulls into a per-repository access log.
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   379
</para>
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   380
<para>
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   381
<command>refresh-auth</command> recurses through the <filename
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   382
class='directory'>/etc/mercurial-server/keys</filename> and the <filename
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   383
class='directory'>keys</filename> directory in the
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   384
<literal>hgadmin</literal> repository, creating an entry in
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   385
<filename>~hg/.ssh/authorized_keys</filename> for each one. This is redone
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   386
automatically whenever a change is pushed to <literal>hgadmin</literal>.
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   387
</para>
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   388
</section>
fd7ebe95d8e5 Move how it works section later
Paul Crowley <paul@lshift.net>
parents: 125
diff changeset
   389
<section>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   390
<title>Security</title>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   391
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   392
mercurial-server relies entirely on sshd to grant access to remote users.
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   393
As a result, it runs no daemons, installs no setuid programs, and no part
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   394
of it runs as root except the install process: all programs run as the user
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   395
hg. And any attack on mercurial-server can only be started if the Bad Guys
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   396
already have a public key in <filename>~hg/.ssh/authorized_keys</filename>,
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   397
otherwise sshd will bar the way.
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   398
</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   399
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   400
No matter what command the user tries to run on the remote system via SSH,
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   401
mercurial-server is run. It parses the command line the user asked for, and
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   402
interprets and runs the corresponding hg operation itself if access is
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   403
allowed, so users can only read and add to history within repositories;
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   404
they cannot run any other hg command. In addition, every push and pull is
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   405
logged with a datestamp, changeset ID and the key that performed the
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   406
operation.
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   407
</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   408
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   409
However, while the first paragraph holds no matter what bugs
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   410
mercurial-server contains, the second depends on the relevant code being
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   411
correct; though the entire codebase is short, mercurial-server is a fairly
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   412
new program and may harbour bugs. Backups are essential!
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   413
</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   414
</section>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   415
<section>
129
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   416
<title>Legalese</title>
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   417
<para>
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   418
This program is free software; you can redistribute it and/or modify it
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   419
under the terms of the GNU General Public License as published by the Free
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   420
Software Foundation; either version 2 of the License, or (at your option)
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   421
any later version.
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   422
</para>
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   423
<para>
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   424
This program is distributed in the hope that it will be useful, but
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   425
WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   426
or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   427
more details.
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   428
</para>
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   429
<para>
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   430
You should have received a copy of the GNU General Public License along
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   431
with this program; if not, write to the Free Software Foundation, Inc., 51
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   432
Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   433
</para>
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   434
</section>
4d261ae3ba4f move legalese to the bottom
Paul Crowley <paul@lshift.net>
parents: 128
diff changeset
   435
<section>
120
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   436
<title>Thanks</title>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   437
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   438
Thanks for reading this far. If you use mercurial-server, please tell me about
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   439
it.
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   440
</para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   441
<para>
16056a9015f3 Huge update to docbook docs
Paul Crowley <paul@lshift.net>
parents: 119
diff changeset
   442
Paul Crowley, <email>paul@lshift.net</email>, 2009
119
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   443
</para>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   444
</section>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   445
</article>
40a287c95661 Start work on a docbook manual
Paul Crowley <paul@lshift.net>
parents:
diff changeset
   446