{"id":18083093,"url":"https://github.com/progval/restrictive-git-proxy","last_synced_at":"2025-06-25T04:35:57.546Z","repository":{"id":66986983,"uuid":"537914806","full_name":"progval/restrictive-git-proxy","owner":"progval","description":"A Git SSH proxy that allows each client to access a different set of repositories","archived":false,"fork":false,"pushed_at":"2022-09-19T17:43:09.000Z","size":20,"stargazers_count":3,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-02-12T05:38:59.610Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"agpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/progval.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-09-17T19:47:45.000Z","updated_at":"2023-02-23T16:35:06.000Z","dependencies_parsed_at":null,"dependency_job_id":"af40b7ca-213b-40c2-a34c-e8d507d16268","html_url":"https://github.com/progval/restrictive-git-proxy","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/progval%2Frestrictive-git-proxy","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/progval%2Frestrictive-git-proxy/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/progval%2Frestrictive-git-proxy/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/progval%2Frestrictive-git-proxy/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/progval","download_url":"https://codeload.github.com/progval/restrictive-git-proxy/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247411238,"owners_count":20934654,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-31T14:06:54.022Z","updated_at":"2025-04-05T23:14:49.240Z","avatar_url":"https://github.com/progval.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# restrictive-git-proxy\n\nA Git SSH proxy that allows each clients access to a different set of repositories\n\n\n## Motivation\n\nTo contain the effects of malicious code in one of my projects (or my project's dependencies), I compartmentalize my projects, using some sort of isolation technology, like:\n\n* separate UNIX users\n* containers\n* jails\n* virtual machines\n* separate physical computers\n\nThis works well to prevent one malicious project ('s dependency) from touching other data on my computers.\n\nEach of these project environments has its own SSH key, which can push only to the project's forge.\n\nHowever, most of these projects are on GitHub, which means each of these projects' environment can push to all my projects on GitHub.\n\nGitHub provides a way to allow repository-specific keys, which they call [deploy keys](https://docs.github.com/en/developers/overview/managing-deploy-keys).\nBut this is quite limited: the same key cannot be allowed to access more than one repository. (This has been a known problem for [a while](https://stackoverflow.com/q/40515569/539465).)\n\nSo, when I want one of my SSH keys to access a larger subset of my repositories, I use this `restrictive-git-proxy`\n\n\n## Principle of operation\n\n`restrictive-git-proxy` runs on a proxy machine. Git clients connect to it via SSH, and it connects to a Git server (eg. GitHub).\n\n`restrictive-git-proxy` has its own SSH key which is configured as an account key on the Git server; but it identifies client keys, and only grants them access to the Git server when they match the configuration.\n\n\n```\n+---------------------+\n|  dev-chess@machine1 | --.\n+---------------------+    \\\n                            \\\n+---------------------+      °-\u003e +-----------------------+          +--------+\n|   dev-go@machine1   | -------\u003e | restrictive-git-proxy | -------\u003e | GitHub |\n+---------------------+      .-\u003e +-----------------------+          +--------+\n                            /\n+---------------------+    /\n| dev-hearts@machine2 | --°\n+---------------------+\n```\n\n\n## Configuration\n\nFor each client machine, add this line to [`.ssh/authorized_keys`](https://manpages.debian.org/bullseye/openssh-server/authorized_keys.5.en.html#AUTHORIZED_KEYS_FILE_FORMAT):\n\n```\ncommand=\"/path/to/restrictive-git-proxy/server.py /path/to/my/config.json \u003cclient-name\u003e\",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty,no-user-rc,restrict \u003cpublic key\u003e\n```\n\nAnd make sure you replace:\n\n* the two paths with the right values\n* `\u003cclient-name\u003e` with a unique name for the client\n* `\u003cpublic-key\u003e` with the client's public SSH key (usually starting with `ssh-ed25519` or `ssh-rsa`)\n\nThe `config.json` file should be a JSON dictionary, with `\u003cclient-name\u003e` as key and a list of allowed remotes as values. For example, assuming clients named `dev-chess@machine1` and `dev-go@machine1`:\n\n```json\n{\n    \"dev-chess@machine1\": [\n        \"git@github.com:myself/chess-website\",\n        \"git@github.com:myself/chess-ai\"\n    ],\n    \"dev-go@machine1\": [\n        \"git@github.com:myself/go-website\",\n        \"git@github.com:myself/go-ai\"\n    ]\n}\n```\n\nWildcards (`*` and `?`) are also allowed in values. (If you want full-blown regular expressions, replace `fnmatch.fnmatchcase` with `re.match` in the code, but beware of the extra complexity.)\n\nIn order to avoid abuse:\n\n* the wildcards cannot match the `:` character between hostname and path\n* matching is case-sensitive\n* you should avoid using wildcards before the `:` character (but it is allowed)\n* if the configuration allows wildcard, you should make sure the remote prevents path traversal (ie. rejects `../` in paths and leading `/`)\n\nThen the Git client must be configured to use this remote: `git-proxy@localhost:git@github.com:myself/chess-website` instead of `git@github.com:myself/chess-website` (assuming `restrictive-git-proxy` is running as a local user named `git-proxy`).\n\nFinally, the SSH executable is assumed to be `/usr/bin/ssh`. Edit it in the code if this is not true for you.\n\n## Disclaimer\n\nThis program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY. See the LICENSE for more details.\n\nIn particular, its safety and security were not audited by a professional.\n\n\u003c!-- warning copied from https://github.com/diafygi/acme-tiny/#readme --\u003e\n**PLEASE READ THE SOURCE CODE AFTER DOWNLOADING! YOU MUST TRUST IT WITH YOUR PRIVATE ACCOUNT KEY!**\n\n\n## Contributing\n\nThe code of `server.py` is kept simple so users can easily check it themselves, even with no advanced understanding of Python.\nTherefore, major new features may be rejected (open a ticket so we can discuss it, though).\n\nIf you can think of exploit scenarios not covered by `test_server.py`, please add them or submit a ticket; even if they don't work (against the current implementation). Thanks!\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fprogval%2Frestrictive-git-proxy","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fprogval%2Frestrictive-git-proxy","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fprogval%2Frestrictive-git-proxy/lists"}