Expand description
choir-ssh: the forced command behind choir’s git-over-SSH account
(D31). See choir_node::ssh for the design and the
authorized_keys line that installs it.
choir-ssh --root <repo-root> --user <choir-user> [--acl-file <path>]
[--handoff <path>] [--git-binary <path>]Every flag comes from the forced command the operator wrote, never
from the client: sshd runs that command and puts whatever the client
asked for in SSH_ORIGINAL_COMMAND, which is the only input this
program takes from the far end. --handoff names the file the daemon
wrote at startup (choir-node --ssh-handoff); without it this account
serves fetches and refuses pushes, because an unsequenced push is
worse than no push.
--git-binary exists because sshd runs the forced command through a
non-interactive login shell, whose PATH frequently lacks the git the
operator means: /opt/homebrew/bin/git is not on the default macOS
non-interactive path. Naming the binary is one line in
authorized_keys and removes the whole class of “works in my shell”.
Constants§
- REFUSED 🔒
- Exit code for every refusal. git surfaces the message on stderr to whoever ran the command, so the reason reaches a person.