Running git-svn and svn smoothly with kerberos on Mac OS X

Sep 28 ’09

I've been trying to learn git, and I thought that I would start by using git-svn to wrap up my upstream subversion repositories and lean the beauty of easy branching.

As I learned, however, getting git-svn to work with kerberos tickets on your system is a pain.

With the built-in OS X subversion binaries, you get a very strange error:

PROPFIND request failed on '/my_repo/my_project': PROPFIND of '/my_repo/my_project':
207 Multi-Status (https://svn.domain.com) at /usr/local/libexec/git-core/git-svn line 1699

Wow. That's unhelpful. It turns out that git uses the perl svn modules in order to talk to subversion, and that they are lacking a kerberos binding on Mac OS X. Or something like that. My unix-fu wasn't up to the task of figuring this problem out; I got help from my local unix guru. The solution was remarkably simple, however.

Let's fix it!

Move the git binary

Let's move our git binary. This assumes you've got yours in the default install location from the git OS X installer.

cd /usr/local/git/bin
sudo mv git git_old

Create a wrapper script

In the same directory you were in:

touch git

Put the following in to the new file named git that you just created:

#!/bin/sh
KRB5CCNAME='foo_bar' git_old $@

This very simple script wraps the git binary, and does one thing: sets the KRB5CCNAME environment variable, which tells OS X's kerberos implementation to use the name 'foo_bar' when looking for kerberos tickets.

Unless that's your kerberos principal, when running git any kerberos tickets you have on your system will be ignored — it will be as if you don't have any.

Make your wrapper executable

Final step: make the new git script executable.

sudo chmod uga+x git

Resolved

Now, from anywhere on your system, you'll be able to use git svn (but not git-svn) successfully, without needing to clobber your kerberos tickets first.

Same problem with straight svn?

If you're having the same problem — the PROPFIND 207 Multi-Status error, just using plain svn, then there is a fix for you that is much easier.

It turns out that it's a problem with the *nix neon library, which svn uses for doing DAV. If you install the latest subversion binary for OS X, it comes with an updated version of neon, and fixes the problem. You can use straight-up svn with your kerberos tickets intact.

Smooth as silk

Now, my day is much simpler. I use Versions as my subversion client, and every time I wanted to do a git operation, or deploy an app with Capistrano, I had to kdestroy, do my thing, then kinit before Versions noticed the kerberos tickets were gone. If it ever noticed, it would ask for my password like 18 times. It was truly annoying.

Now, with both svn and git svn working with kerberos, I type my password in a whole lot less, and have one less thing to worry about.