From: Peter Palfrader <peter@palfrader.org>
Date: Sat, 10 Mar 2012 13:50:22 +0000 (+0100)
Subject: Merge from torproject.org:
X-Git-Tag: userdir-ldap-0.3.85~71
X-Git-Url: https://git.adam-barratt.org.uk/?p=mirror%2Fuserdir-ldap.git;a=commitdiff_plain;h=acb95c57a55058d3fee491f8b5f8c55cb494392c

Merge from torproject.org:

- Allow sshRSAAuthKey for role accounts.
- Support ssh key attributes for gitolite export.
- Add ssh-gitolite support.
---

diff --git a/debian/changelog b/debian/changelog
index a370831..478d8b5 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -18,6 +18,10 @@ userdir-ldap (0.3.XXX) UNRELEASED; urgency=low
     has historically been used as the root of the user tree.
   * Allow a set of users to be ignored for picking UIDs.
   * When picking uid/gid numbers try to pick the same number for both.
+  * Merge from torproject.org:
+    - Allow sshRSAAuthKey for role accounts.
+    - Support ssh key attributes for gitolite export.
+    - Add ssh-gitolite support.
 
   [ Stephen Gran ]
   * Fix deprecation warnings for sha module by using hashlib module instead
@@ -29,7 +33,7 @@ userdir-ldap (0.3.XXX) UNRELEASED; urgency=low
   * ud-generate: generate webPasswords
   * ud-replicate: set correct permissions for web-passwords
 
- -- Stephen Gran <sgran@debian.org>  Sat, 10 Mar 2012 08:05:24 +0000
+ -- Peter Palfrader <weasel@debian.org>  Sat, 10 Mar 2012 14:49:47 +0100
 
 userdir-ldap (0.3.79) unstable; urgency=low
 
diff --git a/ud-generate b/ud-generate
index a897766..eb13678 100755
--- a/ud-generate
+++ b/ud-generate
@@ -70,6 +70,8 @@ IsDebianHost = re.compile(ConfModule.dns_hostmatch)
 isSSHFP = re.compile("^\s*IN\s+SSHFP")
 DNSZone = ".debian.net"
 Keyrings = ConfModule.sync_keyrings.split(":")
+GitoliteSSHRestrictions = getattr(ConfModule, "gitolitesshrestrictions", None)
+
 
 def safe_makedirs(dir):
    try:
@@ -338,6 +340,34 @@ def GenShadowSudo(accounts, File, untrusted):
       raise
    Done(File, F, None)
 
+# Generate the sudo passwd file
+def GenSSHGitolite(accounts, File):
+   F = None
+   try:
+      OldMask = os.umask(0022)
+      F = open(File + ".tmp", "w", 0600)
+      os.umask(OldMask)
+
+      if not GitoliteSSHRestrictions is None and GitoliteSSHRestrictions != "":
+         for a in accounts:
+            if not 'sshRSAAuthKey' in a: continue
+
+            User = a['uid']
+            prefix = GitoliteSSHRestrictions.replace('@@USER@@', User)
+            for I in a["sshRSAAuthKey"]:
+               if I.startswith('ssh-'):
+                  line = "%s %s"%(prefix, I)
+               else:
+                  line = "%s,%s"%(prefix, I)
+               line = Sanitize(line) + "\n"
+               F.write(line)
+
+   # Oops, something unspeakable happened.
+   except:
+      Die(File, F, None)
+      raise
+   Done(File, F, None)
+
 # Generate the shadow list
 def GenSSHShadow(global_dir, accounts):
    # Fetch all the users
@@ -1101,6 +1131,7 @@ def generate_all(global_dir, ldap_conn):
    GenMarkers(accounts, global_dir + "markers")
    GenSSHKnown(host_attrs, global_dir + "ssh_known_hosts")
    GenHosts(host_attrs, global_dir + "debianhosts")
+   GenSSHGitolite(accounts, global_dir + "ssh-gitolite")
 
    GenDNS(accounts, global_dir + "dns-zone")
    GenZoneRecords(host_attrs, global_dir + "dns-sshfp")
@@ -1193,6 +1224,9 @@ def generate_host(host, global_dir, accounts, ssh_files):
    if 'PRIVATE' in ExtraList:
       DoLink(global_dir, OutDir, "debian-private")
 
+   if 'GITOLITE' in ExtraList:
+      DoLink(global_dir, OutDir, "ssh-gitolite")
+
    if 'WEB-PASSWORDS' in ExtraList:
       DoLink(global_dir, OutDir, "web-passwords")
 
diff --git a/ud-replicate b/ud-replicate
index 87491a3..4f2db0e 100755
--- a/ud-replicate
+++ b/ud-replicate
@@ -3,7 +3,7 @@
 #   Copyright (c) 1999-2001  Jason Gunthorpe <jgg@debian.org>
 #   Copyright (c) 2002-2003,2006  Ryan Murray <rmurray@debian.org>
 #   Copyright (c) 2004-2005  Joey Schulze <joey@infodrom.org>
-#   Copyright (c) 2008 Peter Palfrader <peter@palfrader.org>
+#   Copyright (c) 2008,2011 Peter Palfrader <peter@palfrader.org>
 #   Copyright (c) 2008 Stephen Gran <sgran@debian.org>
 #
 #   This program is free software; you can redistribute it and/or modify
@@ -43,7 +43,7 @@ cleanup ()
   rm -f  $tempfile2
 }
 
-PATH=/sbin:/usr/sbin:/bin:/usr/bin
+PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/local/sbin:/usr/local/bin
 export PATH
 HOST=`hostname -f`
 SYNCHOST=`ud-config synchost`;
diff --git a/userdir-ldap.schema b/userdir-ldap.schema
index bb08fd7..85e1bde 100644
--- a/userdir-ldap.schema
+++ b/userdir-ldap.schema
@@ -573,5 +573,5 @@ objectclass ( 1.3.6.1.4.1.9586.100.4.3.3
 	MAY ( emailForward $ supplementaryGid $ allowedHost $ labeledURI $
 	      mailCallout $ mailGreylisting $ mailRBL $ mailRHSBL $
 	      mailWhitelist $ dnsZoneEntry $ mailContentInspectionAction $
-              bATVToken $ mailDefaultOptions
+              bATVToken $ mailDefaultOptions $ sshRSAAuthKey
 	) )