@pingou I don't know when we want to make this change, but I'm getting frustrated by gitolite becoming randomly broken on top of the poor performance.

Issues like #3971 are now commonplace for me on both Mageia and openSUSE, especially since openSUSE Leap 15.1 and newer are afflicted with the problem.

I'm obviously okay with us fixing #3971 for 5.9, but for 6.0, we should just change the default.

Thanks for this. As someone impacted by the bug mentioned in #3971, I think this makes sense. Unfortunately, though, this patch won't work out of the box as is. As you know, I spent several hours trying to get the pagure git auth working (with your help as well; thank you for that), so I thought it'd be a good idea to comment here and explain what you need to do in order to get things up and running.

• You will need to set AuthorizedKeysCommand and AuthorizedKeysCommandUser on /etc/sshd/sshd_config. Currently the documentation doesn't mention anything about it. There is a Fedora configuration example here:

https://infrastructure.fedoraproject.org/cgit/ansible.git/tree/roles/basessh/templates/sshd_config#n46

• You will need to set SSH_KEYS_USERNAME_EXPECT on pagure.cfg.

• You will also need to set SSH_COMMAND_NON_REPO_SPANNER to:

SSH_COMMAND_NON_REPOSPANNER = ([
    "/usr/bin/%(cmd)s",
    "/srv/git/repositories/%(reponame)s",
], {"GL_USER": "%(username)s"})

There is also a Fedora example here:

https://infrastructure.fedoraproject.org/cgit/ansible.git/tree/roles/pagure/frontend/templates/pagure.cfg#n345

This should be better documented in the docs; the default is to always use gitolite3, which obviously doesn't work, and there's no mention in the docs about using this /usr/bin/%(cmd)s.

Anyway, with these modifications I was finally able to clone a repository using the pagure git auth backend.

This is probably not ready to go because we need documentation and a way to avoid changes to sshd_config(5) to make things work by default...

apart from the sshd_config thing, you need

HTTP_REPO_ACCESS_GITOLITE = None for http repo access too.

WTF?

01:28:13  Failed tests:
01:28:13  FAILED test: py-test_pagure_flask_api_fork