hanyixuanten/php-git-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

2 Releases 2 Tags

RSS Feed
  • v2.0 a41884f7b8
    Compare

    v2.0 Stable

    hanyixuanten released this 2026-08-14 19:31:41 +08:00 | 2 commits to main since this release

    Full Changelog: https://github.com/hanyixuanten/php-git-server/compare/v1.0...v2.0

    v2.0

    中文

    新增

    • 新增 MySQL 账号注册、登录和管理员配置。
    • 新增哈希存储、可撤销的 Git Access Token；Git 操作通过 HTTP Basic 认证。
    • 新增仓库所有权、公开/私有可见性以及仅所有者可推送的权限模型。
    • 新增管理页面，可管理用户、密码、Token、仓库所有权和可见性。
    • 新增 Web 安装页面，用于初始化数据库、管理员账号和配置文件。
    • 新增中英文界面及浏览器语言检测。
    • 新增托管仓库创建、所有者删除和数据库元数据管理。
    • 新增无依赖的 Git 协议回归测试套件，覆盖 clone、fetch、push、分支、标签和异常对象。

    变更

    • Smart HTTP 现在完全由纯 PHP 实现，不再依赖 Git 可执行文件或 proc_open。
    • 改进 upload-pack 协商，支持 multi_ack_detailed、no-done、thin-pack 和 include-tag。
    • 首次推送非 main 分支时，可自动更新未出生仓库的默认 HEAD。
    • 托管仓库统一存储在项目的 repos 目录中。
    • 更新首页、安装页和管理页 UI，并扩充部署与运维文档。

    修复

    • 加强 commit、tree 和 annotated tag 的格式、连接性与对象类型验证。
    • 修复 receive-pack 部分 ref 更新失败时的回滚行为。
    • 修复 Git 协议处理失败时仍报告成功的问题。
    • 修复默认分支在 main 与 master 之间不一致的问题。
    • 修复仓库目录权限和路由处理问题。

    安全

    • 私有仓库的 Smart HTTP 与 Dumb HTTP 读取均要求有效 Access Token。
    • 推送同时验证 Access Token 身份和仓库所有权。
    • Token 明文仅显示一次，数据库只保存 SHA-256 摘要。
    • 私有仓库响应使用禁止共享缓存的安全缓存策略。
    • 管理、认证和仓库修改操作加入 Session 与 CSRF 防护。

    破坏性变更

    • 删除 Git 可执行文件后端；SHA-256 仓库、浅克隆、过滤克隆、Git hooks、签名推送证书和仅 Git protocol v2 提供的功能不受支持。
    • 旧版 require_auth / REMOTE_USER 权限模型不再控制访问；推送需要应用账号、Access Token 和明确的仓库所有者。
    • 启用账号认证需要 MySQL 5.7+ 或 MariaDB 10.2+ 以及 PHP pdo_mysql。
    • 托管仓库路径不再可配置，固定为项目下的 repos 目录。

    完整变更：v1.0...v2.0

    English

    Added

    • Added MySQL-backed account registration, login, and administrator configuration.
    • Added hashed, revocable Git access tokens with HTTP Basic authentication.
    • Added repository ownership, public/private visibility, and owner-only pushes.
    • Added an administration page for managing users, passwords, tokens, ownership, and visibility.
    • Added a web installer for initializing the database, administrator account, and configuration.
    • Added English and Chinese interfaces with browser language detection.
    • Added managed-repository creation, owner deletion, and database-backed metadata.
    • Added a dependency-free Git protocol regression suite covering clone, fetch, push, branches, tags, and malformed objects.

    Changed

    • Smart HTTP is now implemented entirely in PHP and no longer depends on the Git executable or proc_open.
    • Improved upload-pack negotiation with multi_ack_detailed, no-done, thin-pack, and include-tag.
    • The default HEAD of an unborn repository can now follow the first pushed branch when it is not main.
    • Managed repositories are now stored in the project's repos directory.
    • Updated the home, installation, and administration interfaces and expanded deployment documentation.

    Fixed

    • Strengthened commit, tree, and annotated-tag format, connectivity, and object-type validation.
    • Fixed rollback when part of a receive-pack ref update fails.
    • Fixed Git protocol failures being reported as successful operations.
    • Fixed inconsistent main and master default-branch handling.
    • Fixed repository-directory permissions and routing behavior.

    Security

    • Private Smart HTTP and Dumb HTTP reads now require a valid access token.
    • Pushes verify both the access-token identity and repository ownership.
    • Token plaintext is displayed only once; only its SHA-256 digest is stored.
    • Private repository responses use cache controls that prevent shared caching.
    • Added session and CSRF protections to administration, authentication, and repository mutations.

    Breaking Changes

    • Removed the Git executable backend; SHA-256 repositories, shallow or filtered clones, Git hooks, signed push certificates, and protocol-v2-only features are unsupported.
    • The former require_auth / REMOTE_USER authorization model no longer controls access; pushes require an application account, access token, and explicit repository owner.
    • Enabling account authentication requires MySQL 5.7+ or MariaDB 10.2+ and PHP pdo_mysql.
    • The managed-repository path is no longer configurable and is fixed to the project's repos directory.

    Full Changelog: v1.0...v2.0

    Downloads