TAGPROTECT(8)

NAME
pre-commit - subversion plus tag protection

SYNOPSIS
pre-commit [OPTIONS]

DESCRIPTION
THIS SCRIPT IS A hook FOR Subversion AND IS NOT MEANT TO BE RUN FROM THE COMMAND LINE UNDER NORMAL USAGE.

It would be run from the command line for configuration testing and configuration debugging.

tagprotect provides immutability (write once) protection for the /tags directory of a subversion repository. This is the default protected directory and everything is configurable.

Subversion requires that this software be invoked with the name pre-commit but the associated PERL code is named tagprotect.pl.

Installation of this subversion hook is trivial, simply put all the files distributed into the directory named hooks found under the directory where you have built the subversion repository. Make sure pre-commit is executable by the owner of the apache httpd process, or if you are not using mod_dav_svn, the the owner of the svnserve process

The subversion administrator - or anyone with write permission on the subversion installation directory - can change the configuration. Below is a complete configuration set with default values.

Debug value and where subversion looks for programs it needs:
    DEBUG = 0
    SVNPATH = "/usr/bin/svn"
    SVNLOOK = "/usr/bin/svnlook"

The remaining configuration variables comprise an N-Tuple and this set can be repeated as many times as wanted.
    PROTECTED_PARENT = "/tags" # a literal path
    PROTECTED_PRJDIRS = "/tags/*" # literal, glob, or blank
    PRJDIR_CREATORS = "*" # or comma list, or blank
    ARCHIVE_DIRECTORY = "Archive" # directory name

Do not configure directories with trailing slash characters, if you do they will simply be discarded anyway but to avoid confusion don't add them.

The configuration of the protected project directories variable, PROTECTED_PRJDIRS, must start with the exact same path as its associated protected parent configuration, namely PROTECTED_PARENT. This is for security. Also for security any instances of /../ (or the like) found in the PROTECTED_PRJDIRS variable will be discarded.

Each PROTECTED_PARENT value must be unique and two(2) or more of them cannot be subdirectories of each other. For example:
    PROTECTED_PARENT = "/tags"
    PROTECTED_PARENT = "/tags/foobar" will not be allowed.

OPTIONS

-h, --help
    Show usage information and exit.

--debug[=n] or -d[n]
    Increment or set the debug value.

If given this command line option should be first, otherwise you might get debug output at all, depending upon other command line options. Note how the DEBUG=N setting works:
PRODUCTION (pre-commit is running under subversion)
Debug is 0
This is normal, you will never see standard error messages at the client application unless they are attempts to modify protected directories (or some other real error).
Debug not 0
Subversion will NEVER commit! Anything written to standard error (debug or real) will be seen by the client application.
Command Line Interface
Debug is 0
Typically you will get no output.
Debug not 0
Messages will be sent to standard error. Usually, when running from the command line debugging is set to a non-zero value, try --debug=1 to start.

--parse[=<file>] or -p[<file>]
    Parse the configuration file, default is tagprotect.conf, then exit. Errors found in the configuration will be printed to standard error. If there are no errors you will get no output unless debug is greater than zero(0). Typically used for testing/debugging an alternate configuration file before moving it into production. NOTE: in production the configuration file cannot be changed, you can only do this on the command line.

--generate or -g
    Generate a default configuration file, with comments, and write it to standard output.

--build or -b
    Build (i.e. generate) a "precompiled" file from the configuration file, with comments, and write it to standard output. This speeds up reading the configuration but is only needed by sites with a large large number of configurations - say 20 or more, your mileage may vary - and only if the server is old and slow. If a precompiled configuration exists pre-commit will read it and ignore the configuration file.

--revert or -r
    Opposite of, --build, write to standard output a configuration file from a previously built "precompiled" configuration file.

--version
    Show the version number and exit

CAVEATS
Debugging (see above) while in PRODUCTION is not really practical because all commits, regardless if they are protected or not, will be prevented. This is a subversion feature and you can't get around that. Still, debugging in PRODUCTION works. So you can do it but "good" commits will also be prevented. You can't "fix" this feature of subversion, and it is actually a "good thing", IMHO. If you can take PRODUCTION commits down for a bit and run your test cases you won't break anything. Later the commits that failed can be committed again. Commits, that are not protected, will be allowed as soon as you set debugging back to zero.

If, for whatever reason, you rename/move/remove the configuration file out of the hooks directory all commits will simply be allowed. THIS MEANS THAT WITHOUT THE configuration file IT IS AS IF YOU NEVER INSTALLED THE SOFTWARE TO BEGIN WITH. If this "feature" of tagprotect is not to your liking and you want the additional security then reset this variable, at the top of the PERL library file:
my $ALLOW_NO_CONFIG_FILE = 1;
and tagprotect will error out if the configuration file is missing, unreadable, etc. In the future this might be the default behavior, depending on who complains about what!

SEE ALSO
svn(1), svnlook(1),
"Version Control with Subversion" at http://svnbook.red-bean.com/

DOWNLOAD
GitHub:
svn co https://github.com/ossCare/svnPlus
or
git https://github.com/ossCare/svnPlus.git

SourceForge:
git clone git://git.code.sf.net/p/svnplus/code svnplus-code

AUTHOR
pre-commit was written by Joseph C. Pietras - joseph.pietras@gmail.com