cvscop.pl - CVS policy enforcement
0.6.2
cvscop.pl -h|--help
cvscop.pl --man
cvscop.pl [-v | --verbose] mode [--sql] [-r | --cvsroot path] [-u | --user | --cvsuser name] [--module module] [--svv ${sVv}]
cvscop is a CVS policy program, launched by the CVS administrative files (commitinfo, loginfo, taginfo, and verifymsg). It can deny CVS actions or launch external scripts based on its configured rule set.
The output of cvscop is displayed by the CVS command line program or through the various logging facilities in a GUI CVS client (like WinCVS).
The mode argument contains the name of the CVS administrative script that launched cvscop. Some modes have special arguments that are automatically appended by CVS, and cvscop expects to see them when invoked in those modes.
pod2man cvscop.pl | nroff -man | less, in case perldoc cvscop.pl isn't working.
The cvscop configuration file (usually cvscop-config.xml) is XML containing fail states or script triggers nested within pattern-match definitions.
The program reads the file as a tree, starting with the outermost tag (the root) and working its way in to the innermost tags (the leaves). If it gets to a pettern match that fails, the tags down that branch will not be followed.
See EXAMPLES below for configuration examples.
The entire file must be contained within a <cvscop> tag.
Defines the configuration section of the file. Configuration items are simple string parameters, defined with <param> tags.
The <param> tag has two parameters: name and value. All of the current configurable options revolve around SQL logging:
The <ruleset> tag encloses <match>, <deny>, <warn>, and <run> tags. A <ruleset> tag can only be enclosed within the root <cvscop> tag.
<match> tags have two parameters: field and boolean. They contain one or more regular expressions and more <match>, <deny>, <warn>, or <run> tags. The tags contained in a <match> tag will be skipped unless one or all (as configured by the boolean parameter) of its conditions are set.
Boolean match mode. Can be ``AND'' or ``OR''. ``AND'' states that all match conditions must be met to continue, while ``OR'' requires only one condition to be met. ``OR'' is the default, and does not need to be specified.
The field parameter specifies which of the following are to be matched:
Regular expressions define a text pattern (Regular expressions are beyond the scope of this document. See perlre for help). In cvscop, simplified Perl regular expressions are used. The differences between cvscop and Perl regular expressions are:
m/pattern/ is not allowed. Use /pattern/ instead.
!/myname/ will match only if 'myname'
is not present.
i, m, s, or x modifiers can be appended to the pattern.
$1 and (?{CODE}) are disabled.
The <deny> tag contains a failure message. When its parent <match> tags have passed, the text contained in the <deny> tag is displayed and cvscop exits with a failure status, which causes the CVS operation to fail. If no message is provided, a generic ``Permission Denied'' message will be shown.
<warn> is similar to <deny>, but emits a harmless warning to the CVS output. No error code is generated (yet) and cvscop continues checking its ruleset.
When a <run> tag is reached, it causes an external program or script (specified as the text inside the <run> tag) to be launched. Optionally, cvscop can check the program or script's exit status and exit with a fail status if appropriate.
Standard XML comments can be placed anywhere in the configuration file.
Cvscop's exit status is used by CVS to determine whether an action will be allowed. Exit status will be 0 if no fail condition has been met, or 1 if a <deny> tag has been reached. Cvscop can also be made to inherit the exit status from an external script or program launched by a <run> tag.
cvs add. Upon commit all of the files listed in commitinfo will be refreshed.
Simple examples of commitinfo, loginfo, taginfo, and verifymsg with the recommended options
# commitinfo
#
CVSROOT /bin/true
DEFAULT /path/to/CVSROOT/cvscop.pl commitinfo --cvsroot ${CVSROOT} --cvsuser ${USER}
# loginfo
#
CVSROOT /bin/true
DEFAULT /path/to/CVSROOT/cvscop.pl loginfo --cvsroot ${CVSROOT} --cvsuser ${USER} --svv %{sVv}
# taginfo
#
CVSROOT /bin/true
DEFAULT /path/to/CVSROOT/cvscop.pl taginfo --cvsroot ${CVSROOT} --cvsuser ${USER}
# verifymsg
#
CVSROOT /bin/true
DEFAULT /path/to/CVSROOT/cvscop.pl verifymsg --cvsroot=${CVSROOT} --cvsuser=${USER}
A simple cvscop-config.xml that fails everything (not recommended)
<cvscop>
<ruleset>
<deny />
</ruleset>
</cvscop>
The same, with SQL logging enabled
<cvscop>
<config>
<param name="sql" value="on" />
<param name="db" value="my_db_name" />
<param name="dbuser" value="my_db_login" />
<param name="dbpasswd" value="my_db_password" />
<param name="dbhost" value="my_db_host" />
<param name="dbport" value="8888" />
</config>
<ruleset>
<deny />
</ruleset>
</cvscop>
Limit commits to three users (larry, moe, and curly)
<cvscop>
<ruleset>
<match field="mode">
/^commitinfo$/
<match field="cvsuser" bool="and">
!/^larry$/
!/^moe$/
!/^curly$/
<deny>
Only larry, moe, or curly may commit!
</deny>
</match>
</match>
</ruleset>
</cvscop>
...or for a more complex example, we have three engineers (Larry, Shemp, and Curly) with private directories. Commit access to these directories is limited to the individual engineers and to their manager (Moe):
<cvscop>
<ruleset>
<match field="mode">
/^commitinfo$/
<match field="path">
/^private\/larry/
<match field="cvsuser" bool="and">
!/^larry$/
!/^moe$/
<deny>
Commit to Larry's directory (private/larry) is denied!
</deny>
</match>
</match>
<match field="path">
/^private\/shemp/
<match field="cvsuser" bool="and">
!/^shemp$/
!/^moe$/
<deny>
Commit to Shemp's directory (private/shemp) is denied!
</deny>
</match>
</match>
<match field="path">
/^private\/curly/
<match field="cvsuser" bool="and">
!/^curly$/
!/^moe$/
<deny>
Commit to Curly's directory (private/curly) is denied!
</deny>
</match>
</match>
</match>
</ruleset>
</cvscop>
Launch an external script for each file. Note the $module, $path, and $_ variables in the command arguments.
<cvscop>
<ruleset>
<match field="mode">
/^loginfo$/
<run each="ary_files">
/home/curlyjoe/bin/myscript.sh $module/$path/$_
</run>
</match>
</ruleset>
</cvscop>
XML::Parser
DBI
DBD::mysql
http://cvscop.sourceforge.net/
perlre
cvs(1)