Subversion

= Intro =

OSGeo maintains a set of subversion services, currently hosted on the primary Peer1 server at the virtual host http://svn.osgeo.org/. Subversion access is authenticated based on OSGeo Userids and each project has a committer list also maintained in LDAP. Excellent general information on subversion is available from the Subversion Book.

= Current Repositories =


 * http://svn.osgeo.org/fdo - FDO (also a bunch of old repositories exist for FDO)
 * http://svn.osgeo.org/gdal - GDAL
 * http://svn.osgeo.org/grass - GRASS GIS
 * http://svn.osgeo.org/mapbender - Mapbender
 * http://svn.osgeo.org/mapguide - MapGuide
 * http://svn.osgeo.org/moss4g - MOSS4g
 * http://svn.osgeo.org/osgeo - OSGeo
 * http://svn.osgeo.org/ossim - OSSIM
 * http://svn.osgeo.org/geos - GEOS
 * http://svn.osgeo.org/mapserver - MapServer
 * http://svn.osgeo.org/qgis - QGIS
 * http://svn.osgeo.org/fusion - Fusion
 * http://svn.osgeo.org/osgeo4w - OSGeo4W

= Administration =

Howard Butler (hobu), and Shawn Barnes (sbarnes) are the primary contacts for Subversion administration issues. Requests can be submitted via the SAC Trac.

Add/Remove Committer
Any member of a subversion committer group and add and remove members to the commiter group at an url of the following form, with the project name substituted for gdal. OSGeo Userids has details on finding or creating OSGeo userids.

https://www.osgeo.org/cgi-bin/auth/ldap_group.py?group=gdal

Creating a repository
By root on main server: $ sudo mkdir /var/www/svn/repos/ $ sudo svnadmin /var/www/svn/repos/ $ sudo chown -R apache:apache /var/www/svn/repos/

Loading a repository from a dumpfile
By root on main server: $ sudo svnadmin load /var/www/svn/repos/ < /path/to/dumpfile $ sudo chown -R apache:apache /var/www/svn/repos/

Dumping a repository
By root on main server: $ sudo svnadmin dump /var/www/svn/repos/ > dumpfile

Recovering / unlocking repository
priviledged access is needed (may need to stop/start apache to drop requests to repository before recover)
 * subversion may lock if user ctl-c during checkout or checkout is interupted with an apache restart
 * Need policy on who to contact and who can run 'svnadmin recover' as

Subversion was upgraded to version 1.4.3 (30 Jan. 2007) to reduce the repository locking problem if ctl-c used to end a checkout.

If the repository locks the following command should be used to recover the repository:

$ sudo svnadmin --wait recover /var/www/svn/repos/ $ sudo chown -R apache:apache /var/www/svn/repos/

In most cases this will work in the odd case that you are waiting a very long time for the command to run then apache may have to be restarted to drop anything accessing the repository and preventing the repository from being recovered

$ sudo /sbin/service httpd restart $ sudo svnadmin --wait recover /var/www/svn/repos/ $ sudo chown -R apache:apache /var/www/svn/repos/

= Authz Rules =

By default we use one LDAP "group" for an entire subversion repository. Everyone in that group has commit priveledges on the whole repository. However, some project desire to have subgroups. For instance a core commiter group with update on the trunk source tree, and a broader contributor group that has commit access in a subarea, such as /sandbox. We accomplish this using an "authz" file to hold the rules for the respository, and multiple LDAP groups.

A project wishing this will need to prepare an authz template file looking something like:

[groups] committers = @@gdal@@ sandbox = @@gdal_sandbox@@

[/] @committers = rw
 * = r

[/sandbox] @committers = rw @sandbox = rw
 * = r

This file should be submitted to SAC via a Trac ticket for placement on the server, and for creation of any corresponding LDAP groups. Thereafter any successful update via https://www.osgeo.org/cgi-bin/auth/ldap_group.py?group=project will result in the authz being generated from the corresponding authz.tmpl.

Administration Notes
The authz.tmpl files need to be named exactly authz.tmpl and place in the corresponding project repository directory, /var/www/svn/repos/gdal for instance. Make sure the file is owned by apache.apache.

The corresponding /etc/httpd/conf.d/subversion/project.conf file should look something like the following. Note the removal of  stuff, and reference to any specific ldap group as    well as the AuthzSVNAccessFile.

 DAV svn SVNPath /var/www/svn/repos/gdal AuthzSVNAccessFile /var/www/svn/repos/gdal/authz AuthType Basic AuthName "GDAL Subversion Repository" AuthLDAPURL ldap://66.223.95.242:389/ou=people,dc=osgeo,dc=org?uid?sub?(objectClass=*) Satisfy Any Require valid-user 

The LDAP groups should be created as groupOfNames nodes below the ou=svn element using PHPLDAPAdmin. Make sure the membership is pre-initialized with an administrator for the project so they can do future updates themselves. Try to keep the names of the groups clearly related to the base project. eg. gdal, gdal_sandbox, gdal_documentors.