Skip to content

GitLab

  • Menu
Projects Groups Snippets
    • Loading...
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in
  • G gitlabhq1
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 21
    • Issues 21
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 12
    • Merge requests 12
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Monitor
    • Monitor
    • Incidents
  • Packages & Registries
    • Packages & Registries
    • Package Registry
    • Infrastructure Registry
  • Analytics
    • Analytics
    • CI/CD
    • Repository
    • Value stream
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • gpt
  • large_projects
  • gitlabhq1
  • Issues
  • #486

Closed
Open
Created Feb 29, 2012 by Administrator@rootOwner

Do not allow the key used to access the gitolite-admin repo to ever be used as a deployment key

Created by: owindsor

First up - Thanks for the awesome project - I came from gitorious and so far we are really enjoying things.

Here is the problem, As silly as this sounds, here is the way it happened

On my host, I have a gitlab repo that contains some internal only changes that I want in the repo, but also want to be able to update the running host with.

Anyways, rather than allow apache the ability to read/write to the gitlab repo, I put his key (which is also able to write the gitolite-admin repo) in as a deploy user. I could then check out locally and update my running system with the code stored in gitlab ie;

git pull git@localhost:gitlabhq.git

This results in gitlab no longer being able to make changes to the gitolite-admin repo via what I assume is a key match of R that overrides the core RW.

Please let me know if this is not clear

Cheers

Assignee
Assign to
Time tracking