Frantic Typing

Using git to develop against subversion repositories

2009-06-28T23:00:00.000+02:00

A lot of people have written about using git and why it is in their opinion the best thing since sliced bread or even worse than a stinking turd in your bed....

Go read those if you're interested in yet-another-opinion about sourcecode management :-)

I'm interested in developing with git against a subversion repository which holds the main body of code for whatever reason: company politics, historic reasons, need for a centralized repository, whatever.

This is in fact very simple with the git svn wrappers, it's trivial to create a git-repository which is based on a subversion repository AND stays in sync all the time as well.

Please read: http://www.viget.com/extend/effectively-using-git-with-subversion/ for a nice overview.

What is not much covered is setting up a git repository based on a non-standard subversion layout. I searched around on the net using google and couldn't find a good description.

And guess what I had :-(

I've setup a git repository for a subversion repository which had a non-standard layout for historic reasons. It was way too much trouble to reorganize the subversion repository so I decided to make the git repository match the subversion repos.

The subversion is layed out like this:


/
/trunk
/stable
/branches/virtual
/branches/redesign
/josephs_stuff
/tryout1
/tryout2

Basically the stable branch was started not inside a branches subdir as is standard but on the root of the repository. Later on someone realized that a branches subdir was a good thing to have and added it.

Ideally I'd like to have all branches that are relevant to me as a branch inside git.

The branches I'm interested in are: trunk, stable, virtual and redesign, the rest is just old cruft, left there for no specific good reasons.

I've inited the git repos with the following command:


git svn init --trunk trunk https://svn.server.not/svn/ git-repos

Afterwards I needed to add the other three branches, you need to edit you git config file for this which you can find in:


git-repos/.git/config

The relevant part of my git config looks like this:


[svn-remote "svn"]
url = https://svn.server.not/svn/
fetch = trunk:refs/remotes/trunk
fetch = stable:refs/remotes/stable
fetch = branches/virtual:refs/remotes/virtual
fetch = branches/redesign:refs/remotes/redesign

After saving my git config it's time to actually pull in the subversion content:


git svn fetch

That's it.... now you have a fully functional git repository with branches for the different "branches" in your old and crufty subversion repository.

The format appears to be:


url = $SVN_BASE_URL
fetch = $SVN_DIR:refs/remotes/$GITBRANCHNAME

I'd think twice before I'd deviate the git branch-names from the subversion branch names.

Happy hacking.

public and private ssh keys in ldap

2009-06-24T21:52:00.006+02:00

Marlon did some great work on setting up a ldap servercluster for our serverpark at hyves.

We want to use that ldap repository to stick all user-accounts in so we have a better control over who gets to access what.

In order to make that happen we need both the public AND the private key for ssh access in our ldap server.

Getting the public keys in ldap proved fairly trivial, head over to the openssh-lpk project on code.google

Applying the patches is easy if you use Gentoo:

USE="ldap" emerge openssh

will do the trick, your milage may vary on other distributions :-)

Getting the private keys in ldap is completely undocumented....

Here's how you do it:

Add the following to the schema provided by the openssh-lpk guys:


attributetype ( 1.3.6.1.4.1.24552.500.1.1.1.14 NAME 'sshPrivateKey'
  DESC 'OPTIONAL: OpenSSH Private key'
  EQUALITY octetStringMatch
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )

objectclass ( 1.3.6.1.4.1.24552.500.1.1.2.1 NAME 'ldapPrivateKey' SUP top AUXILIARY
   DESC 'OPTIONAL: OpenSSH LPK objectclass'
   MAY ( sshPrivateKey $ uid )
)

Now you need to load the public and private key into the ldap server.
The public key again is easy: It's a single string with no linebreaks in it, any tool will do.
But the private key is slightly more involved, the first couple of lines from my private key are:

-----BEGIN DSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,A683EAADB7A65E5C

o+sletw5nmOZN1Hu62HSIRMaMsqWWDSqbxrRKu5zfk/rXWKDzIU9ULSQ3giGmCRx

You can't load that with ldapmodify into your ldap server because it will mistake the content of your key for ldap attributes. I tried loading it through the webinterface (phpLDAPadmin) but that didn't work either.

The solution is specified in the RFC, you need to encode the key in base64.

base64 -w0 <> yourprivatekey_base64

After that it's trivial to load it into your ldapserver, use whatever tool you like.

Here's a sample ldif file for ldapmodify:

dn: cn=your common name,ou=your department,dc=domain,dc=tld
changetype: modify
replace: sshPrivateKey
sshPrivateKey: LS0tLS1CRUdJTiBEU0EgUFJJVkFURSBLRVktLS0tLQpQcm9jLVR5cGU6IDQsRU5DUllQVEVECkRFSy1JbmZvOiBERVMtRURFMy1DQkMs

Once you have loaded the private and public keys in ldap you need a script to install them in the homedir of your server.

We settled on a combination of autodir and puppet.

Autodir will create the homedir for the user once he logs in for the first time.

We populate the skel directory with puppet, the bash_profile file below takes care of pulling in the keys into the .ssh directory.


# /etc/skel/.bash_profile

LOGNAME=$(whoami)
NUMSESSIONS=$(who |grep ${LOGNAME} |wc -l)
HOST=$(hostname)
[[ -f ~/.firstrun ]] && source ~/.firstrun

if [[ "${FIRSTRUN}" == "YES" ]]
then
# Pick up private keys from ldap
echo "This is a firsttime run"
echo "I need to import your ssh-keys from the ldap server"
echo "Please provide the ldap password when asked"
# Find DN for user
LDAP_DN=$(ldapsearch -LLL -ZZ "(uid=$LOGNAME)" dn | cut -f2 -d:)
ldapsearch -LLL -ZZ -F~/.ssh/ -T ~/.ssh/ -D"${LDAP_DN}" -W -x -tt "(uid=${LOGNAME})" sshPublicKey sshPrivateKey
echo "Decoding your private key"
base64 -w0 -d ~/.ssh/ldapsearch-sshPrivateKey-* > ~/.ssh/id_key
echo "Adding your public key"
mv ~/.ssh/ldapsearch-sshPublicKey-* ~/.ssh/id_key.pub
echo "Cleaning up temporary files"
rm ~/.ssh/ldapsearch-*
sed -i -e 's!YES!NO!g' ~/.firstrun
echo "Your ssh keys have been setup"
fi

# only check if this is the first login
if [ "${NUMSESSIONS}" = "1" ]
then
# cleaning up possible old sessions
/usr/bin/keychain --clear -q

#keychain
echo -e "\e[32;1mAdding private keys to keychain\e[m"

for i in $(find ~/.ssh |grep id |grep -v pub)
do
  /usr/bin/keychain -q ${i}
done
fi

# load ssh agent via keychain
source ~/.keychain/$(hostname)-sh

[[ -f /etc/profile.d/bash-completion ]] && source /etc/profile.d/bash-completion

Keychain is a useful tool written by Daniel Robbins, the original Gentoo architect. It loads your keys into ssh-agent and exports the relevant variables into your shell environment, the net effect is that you have to type your passphrase once.
You can find his current homepage here

Maybe this is helpful for someone trying to do something similar, if you need more detail you can always try emailing me :-)

Ramon

P.S> No, the above script is not production ready, it lacks error checking and support for multiple keys.

Mijn huis is onbewoonbaar verklaard

2008-08-04T22:08:00.002+02:00

Vandaag is mijn huis door de inspectie voor bouw- & woningtoezicht in Amsterdam Oud-West tot onbewoonbaar verklaard.

Dat ging zo:

Zaterdag om 00:30 hoorde we een geluid alsof de bovenburen een bowlingbal hadden laten vallen.
Daar dachten we eerst niet zo veel van maar toen we de volgende zondagochtend 2 grote scheuren in een kruisvorm in het midden van het plafond maakten we ons toch een beetje zorgen. Contact met de woningbouw opgenomen en afgesproken dat als de scheur groter werd we terug moesten bellen en dat ze het dan maandag kwamen repareren. So far so good.

Om een uurtje of 8 's avonds hoorden we een tweede knal in het plafond en nu werd de scheur alarmerend snel groter. Opnieuw woningbouw de Alliantie gebeld, maar nu kregen we een of ander chagerijnig mens aan de telefoon.

Die kon niets, wist niets en we moesten maandag maar met het gewone kantoor bellen. Omdat het plafond inmiddels begon door te buigen werden we toen een beetje boos, maar ook dat mocht niet baten. Toen we naar haar naam vroegen om eventueel een klacht in te kunnen dienen hing ze stomweg de telefoon op.

Daarna wist ik het ook niet meer en heb ik de brandweer maar gebeld, dat leek me de meest voor de hand liggende alarmdienst. Die kwamen binnen 5 minuten met een hele wagen met brandweermannen. Die keken naar het plafond, riepen: "dat ziet er niet best uit, meneer" en hebben boven bij de buren op de vloer heen en weer gesprongen om de balken te testen (die waren goed).

En daarna een flink gat in ons plafond gemaakt.

Toen bleek dat alle het hele plafond met nog maar een paar schroeven vast zat en ieder moment naar beneden zouden kunnen komen.

Toen werden er snel balken en stutten geregeld en uiteindelijk werd het plafond onderstut met twee palen zodat het in ieder geval tot maandag boven bleef en wij "rustig" naar bed konden.

Dat zou al wel genoeg geweest zijn.......

Maar de volgende dag zagen tot onze grote schrik om 13:00 dat de vloer voor in de woonkamer sinds 's ochtends op eens een kuil van meer dan 5 cm vertoonde. Toen hebben we maar de belangrijkste spullen gepakt en zijn we het huis uitgelopen. Buiten heb ik toen de inspectie voor bouw & woningtoezicht gebeld. Die stuurde binnen 10 minuten een inspecteur langs voor inspectie. En die heeft uiteindelijk de hele etage onbewoonbaar verklaard.

We logeren vandaag even bij de buren die zo lief waren om dat aan te bieden, zodat we rustig alle spullen en zaken die we nodig hebben kunnen verzamelen. Morgen gaan we een hotel zoeken om de komende tijd in te wonen en opnieuw onderhandelen met de woningbouw over hoe het nu verder moet.

Vrijdag komen de andere twee kinderen terug en zijn we weer met z'n vijven.....

O en voor diegenen die zich het afvragen, dit is een nieuw gerenoveerd huis uit november 2006.

MacBook with OSX | Gentoo Linux

2008-06-06T11:50:00.005+02:00

I like OSX I've been using it privately for a long time.

Koen used to joke that I was the only sysadmin he ever saw with an Apple, which is basically why the about page on hyves lists my nickname as Big Mac :-)

The last two years I used a dell laptop as my primary workstation with gentoo installed and a VMWare Windows image for the occasional time that I couldn't do without exchange support.

My wife has since nicked my old Powerbook and I haven't seen it back, it's been converted to german as primary language (can't find anything in the menu's :-) ) and solidly in use. I've given up all hope of ever getting it back unless I buy her a new one.

Since the dell was showing signs of wear and tear I decided that my new work laptop was going to be an apple again. So on my desk is sitting this really nice and shiny new MacBook Pro dual-core 2.6Ghz machine and 4Gig of memory.

But after working in linux for so many years I'm missing some of the productivity and development tools I'm used to on linux. I really like the productivity tools I gained by moving back to OSX (have a look here: www.omnigroup.com they make great stuff) but still, it nags.

I've been using with gentoo-prefix for a while which certainly fills part of the gap, but for some stuff I really need a native linux environment. One of the things I still do for hyves is building the system OS images with catalyst, the gentoo release tool. I can't do that properly in a prefix environment (I think.... fabian will probably correct me if I'm wrong)

So I've been looking at alternatives to get a native linux environment working. I rarely need GUI access, most of that is covered by OSX + Gentoo Prefix. But I do need a native commandline linux and I hate to dual-boot just for that. I want to be able to read my mail|browse the web while doing a bunch of other stuff in linux.

There have been rumours that Xen might support OSX in the near future, but nothing has materialized so far. Apparently the problem is that OSX | Aqua is really tightly coupled with the hardware. That makes sense to do for Apple since they make both the hardware and the OS :-) But doesn't work really well in a virtualized environment.

I tried parallels but it doesn't support 64bit linux, I build 64bit serverimages so that doesn't help a lot :-(

But today I found this post: http://taylorbanks.com/blog/ubuntu-on-the-macbook-pro-physical-virtual-or-both/

which details how to install a virtual 64bit copy inside VMWare Fusion.
And the best part is.... now I get to choose whether I want to dual-boot into one of my OS's or that I run OSX + linux in a virtual machine.

Yay, here I come :-)

P.S> After a very long time away from this blog, I'll see if I can keep it more current. The idea is to write stuff every week if I manage with all the other stuff going on in my life :-)

Hit by a car door

2005-09-16T02:48:00.000+02:00

Yesterday as I was biking to my uncle's (mike) in the inner city of Amsterdam, someone was friendly enough to open his car door right in the spot I was biking at the moment.

I managed to get out with fairly little damage....

Luckily I didn't hit it right on, he sorta hit me in the knee with the door.
The street I was on (Kinkerstraat) has a kind of roofed walkway with big massive concrete pillars in between that support the upper buildings. I managed to swerve between two of them and more or less crash into a contactlens shop.

Funny thing was that I was talking to my mother on the phone while this happened, no idea what she must have heard...
I lost my bluetooth earpiece pretty soon in the proces :-)
Must be weird hearing a live-accident happing to the person you're talking to.

Anyway after a few minutes of bending my knee to check whether anything was broken and a glass of water from the contactlens shop I felt a lot better. Aside from a dull ache in my knee and some weird tingly sensations in my toes I seemed to be alright so I continued biking towards my uncle and managed to arrive.

The actual guy who opened the door without looking was extremely sorry and we exchanged addresses in case anything serious would develop from it.

Meanwhile at mike's place my knee started to hurt pretty bad (not really surprising, car doors are probably harder than my knee). Although I could stand on it and it wasn't broken it hurt so bad that I decided to call my GP.

As usual he gave me the sensible and expected advice to rest, keep cool with ice and come by tomorrow if it still hurts :-(
Good advice but I already thought of that myself....

Even though I was pretty happy that X-rays were not neccessary it still makes you feel kind of useless if you get the same advice from your GP as you thought of yourself.

I ended up taking a taxi home because I couldn't stand properly and didn't dare to ride the bike back.

So right now I just got back, knee is hurting like hell.
I'll need to call the GP first thing tomorrow for an appointment and hobble over there.

Anyway, how was your day ?

Ramon