+A  Click here to enlarge/reduce to/back from full screen 
Paul Scherrer Institut PSI AIT LINUX Support

PSI Home |  LOG Home |  AIT Home |  Search |  Helpdesk |  Contact Us | 





2. Subversion and CVS at PSI

2.1. Where to keep Your Repositories

To get started you need to have read/write access to an AFS directory. Any such directory will do, but we recommend to use an AFS project directory for this purpose. Read section AFS @ PSI for more informations about AFS and project directories. In the project directory you should create a sub directory named svn to keep your Subversion repository.

2.2. Accessing the Repositories

Access to the repositories is supported via direct access and via a Subversion/CVS gateway. Direct access to the repository is possible from anywhere in the world provided that an AFS client is running on the client system. The gateway allow to access the repository using either an AFS account or an anonymous account. The Subversion/CVS gateway is hosted at savannah.psi.ch.

Currently only the svn+ssh protocol is supported for access via the gateway. The reason not to support the http protocol are technical. One problem is that the AFS authentication mechanism is not supported by the web server.

Checking out a repository with the file protocol will look like:

svn co file:///afs/psi.ch/project/linux/svn/trunk

Checking out a repository with the svn+ssh protocol will look like:

svn co svn+ssh://svn@savannah.psi.ch/afs/psi.ch/project/linux/svn/trunk

Access to CVS repositories is supported via direct access and via the gateway with the ssh protocol.

Checking out a repository with direct access will look like:

cvs -d /afs/psi.ch/project/linux/cvsroot co linux

An anonymous CVS checkout via the gateway will look like:

export CVS_RSH=ssh
cvs -d :ext:cvs@savannah.psi.ch:/afs/psi.ch/project/linux/cvsroot co linux

2.3. Authentication

2.3.1. AFS Accounts

All users having an PSI AFS account are able to access Subversion and CVS repositories, either direct or via the Subversion/CVS gateway, assuming that the AFS access control lists (ACL's) are set accordingly. The accounts on the gateway are restricted and can be used for Subversion and CVS access only. A shell login to the gateway is not possible.

Section Configuration for Direct Read/Write Access describes how to set the ACL's to grant on authenticated user read/write access to a Subversion repository.

Section Configuration for Direct Read/Write Access describes how to set the ACL's to grant on authenticated user read/write access to a CVS repository.

2.3.2. External Users

External users needing access to a repository can apply for a restricted AFS account, which allows them to use the repository in a well defined way using the same access rights mechanisms as for internal PSI users. Restricted accounts grand access to repositories, either direct or via the gateway. These account do not permit shell login to any PSI system. Thus these accounts cannot be (miss-)used for login to the Linux Login Cluster or a Linux Desktop at PSI.

In terms of AFS access lists, externel users are treated the same way as internal users.

2.3.3. Anonymous Access

Anonymous access is granted via direct access and via the gateway, provided that the AFS ACL's are set accordingly. For Subversion the anonymous account is mapped to the user svn with password svn. For CVS the anonymous account is cvs and the password is cvs

Section Configuration for Read-only Access describes how to set the ACL's for direct anonymous access to a Subversion repository.

Section Configuration for Anonymous Read-only Access via the Gateway describes how to set the ACL's for anonymous access via the gateway to a Subversion repository.

Section Configuration for Read-only Access describes how to set the ACL's for anonymous access via the gateway to a CVS repository.

2.4. AFS Groups and Access Control

Since the repositories are in AFS, you have to control access permission with AFS access list. Access list can be defined for users and groups. To keep administration simple, it is best practice to use groups, if more then one user has the permission to access the repository. Normally we have the following kinds of access:

  • Read-only access
  • Read/write access
  • Administrative access

Thus we have up to three groups and each user can clearly be assigned to one of these groups:

Read-only group

Group of users having read-only access to the repository.

If you want to grant anonymous read-only access, some kind of “anonymous” user must be member of this group.

Read/write group

Group of users having read and write access to the repository.

Administrative group

Group of users having administrative permissions and read/write access to the repository.

Before creating a new repository, you should think about users who have the permissions to administer it. Administrative tasks includes configuration of the repository and AFS administration. Configuration of the repository itself depends on the used version control system and will not be discussed here. AFS administration includes group creation, adding members to groups, removing members from groups and the definition of AFS access lists.

[Note]

The number of AFS access lists per directory is limited to 20. This value is hard-coded and cannot be changed.

Prev   Next
1. Introduction Home 3. Working with Subversion