ci.1

早期freebsd实现

specifies two suffixes:
.B ,v
and the empty suffix.
If two or more suffixes are specified,
they are tried in order when looking for an \*r file;
the first one that works is used for that file.
If no \*r file is found but an \*r file can be created,
the suffixes are tried in order
to determine the new \*r file's name.
The default for
.IR suffixes
is installation-dependent; normally it is
.B ,v/
for hosts like Unix that permit commas in file names,
and is empty (i.e. just the empty suffix) for other hosts.
.SH "FILE NAMING"
Pairs of \*r files and working files may be specified in three ways
(see also the
example section).
.PP
1) Both the \*r file and the working file are given.  The \*r pathname is of
the form
.IB path1 / workfileX
and the working pathname is of the form
.IB path2 / workfile
where
.IB path1 /
and
.IB path2 /
are (possibly different or empty) paths,
.I workfile
is a filename, and
.I X
is an \*r suffix.
If
.I X
is empty,
.IB path1 /
must be
.B RCS/
or must end in
.BR /RCS/ .
.PP
2) Only the \*r file is given.  Then the working file is created in the current
directory and its name is derived from the name of the \*r file
by removing
.IB path1 /
and the suffix
.IR X .
.PP
3) Only the working file is given.
Then
.B ci
considers each \*r suffix
.I X
in turn, looking for an \*r file of the form
.IB path2 /RCS/ workfileX
or (if the former is not found and
.I X
is nonempty)
.IB path2 / workfileX.
.PP
If the \*r file is specified without a path in 1) and 2),
.B ci
looks for the \*r file first in the directory
.B ./RCS
and then in the current
directory.
.PP
.B ci
reports an error if an attempt to open an \*r file fails for an unusual reason,
even if the \*r file's pathname is just one of several possibilities.
For example, to suppress use of \*r commands in a directory
.IR d ,
create a regular file named
.IB d /RCS
so that casual attempts to use \*r commands in
.I d
fail because
.IB d /RCS
is not a directory.
.SH EXAMPLES
Suppose
.B ,v
is an \*r suffix and the current directory contains a subdirectory
.B RCS
with an \*r file
.BR io.c,v .
Then each of the following commands check in a copy of
.B io.c
into
.B RCS/io.c,v
as the latest revision, removing
.BR io.c .
.LP
.RS
.nf
.ft 3
ci  io.c;    ci  RCS/io.c,v;   ci  io.c,v;
ci  io.c  RCS/io.c,v;    ci  io.c  io.c,v;
ci  RCS/io.c,v  io.c;    ci  io.c,v  io.c;
.ft
.fi
.RE
.PP
Suppose instead that the empty suffix
is an \*r suffix and the current directory contains a subdirectory
.B RCS
with an \*r file
.BR io.c .
The each of the following commands checks in a new revision.
.LP
.RS
.nf
.ft 3
ci  io.c;    ci  RCS/io.c;
ci  io.c  RCS/io.c;
ci  RCS/io.c  io.c;
.ft
.fi
.RE
.SH "FILE MODES"
An \*r file created by
.B ci
inherits the read and execute permissions
from the working file.  If the \*r file exists already,
.B ci
preserves its read and execute permissions.
.B ci
always turns off all write permissions of \*r files.
.SH FILES
Several temporary files may be created in the directory containing
the working file, and also in the temporary directory (see
.B \s-1TMPDIR\s0
under
.BR \s-1ENVIRONMENT\s0 ).
A semaphore file or files are created in the directory containing the \*r file.
With a nonempty suffix, the semaphore names begin with
the first character of the suffix; therefore, do not specify a suffix
whose first character could be that of a working filename.
With an empty suffix, the semaphore names end with
.B _
so working filenames should not end in
.BR _ .
.PP
.B ci
never changes an \*r or working file.
Normally,
.B ci
unlinks the file and creates a new one;
but instead of breaking a chain of one or more symbolic links to an \*r file,
it unlinks the destination file instead.
Therefore,
.B ci
breaks any hard or symbolic links to any working file it changes;
and hard links to \*r files are ineffective,
but symbolic links to \*r files are preserved.
.PP
The effective user must be able to
search and write the directory containing the \*r file.
Normally, the real user must be able to
read the \*r and working files
and to search and write the directory containing the working file;
however, some older hosts
cannot easily switch between real and effective users,
so on these hosts the effective user is used for all accesses.
The effective user is the same as the real user
unless your copies of
.B ci
and
.B co
have setuid privileges.
As described in the next section,
these privileges yield extra security if
the effective user owns all \*r files and directories,
and if only the effective user can write \*r directories.
.PP
Users can control access to \*r files by setting the permissions
of the directory containing the files; only users with write access
to the directory can use \*r commands to change its \*r files.
For example, in hosts that allow a user to belong to several groups,
one can make a group's \*r directories writable to that group only.
This approach suffices for informal projects,
but it means that any group member can arbitrarily change the group's \*r files,
and can even remove them entirely.
Hence more formal projects sometimes distinguish between an \*r administrator,
who can change the \*r files at will, and other project members,
who can check in new revisions but cannot otherwise change the \*r files.
.SH "SETUID USE"
To prevent anybody but their \*r administrator from deleting revisions,
a set of users can employ setuid privileges as follows.
.nr n \w'\(bu '+1n-1/1n
.IP \(bu \nn
Check that the host supports \*r setuid use.
Consult a trustworthy expert if there are any doubts.
It is best if the
.B seteuid()
system call works as described in Posix 1003.1a Draft 5,
because \*r can switch back and forth easily
between real and effective users, even if the real user is
.BR root .
If not, the second best is if the
.B setuid()
system call supports saved setuid
(the {\s-1_POSIX_SAVED_IDS\s0} behavior of Posix 1003.1-1990);
this fails only if the real user is
.BR root .
If \*r detects any failure in setuid, it quits immediately.
.IP \(bu \nn
Choose a user
.I A
to serve as \*r administrator for the set of users.
Only
.I A
will be able to invoke the
.B rcs
command on the users' \*r files.
.I A
should not be
.B root
or any other user with special powers.
Mutually suspicious sets of users should use different administrators.
.IP \(bu \nn
Choose a path name
.I B
that will be a directory of files to be executed by the users.
.IP \(bu \nn
Have
.I A
set up
.I B
to contain copies of
.B ci
and
.B co
that are setuid to
.I A
by copying the commands from their standard installation directory
.I D
as follows:
.LP
.RS
.nf
.ne 3
\f3mkdir\fP  \f2B\fP
\f3cp\fP  \f2D\fP\^\f3/c[io]\fP  \f2B\fP
\f3chmod  go\-w,u+s\fP  \f2B\fP\f3/c[io]\fP
.fi
.RE
.IP \(bu \nn
Have each user prepend
.I B
to their path as follows:
.LP
.RS
.nf
.ne 2
\f3PATH=\fP\f2B\fP\f3:$PATH;  export  PATH\fP  # ordinary shell
\f3set  path=(\fP\f2B\fP  \f3$path)\fP  # C shell
.fi
.RE
.IP \(bu \nn
Have
.I A
create each \*r directory
.I R
with write access only to
.I A
as follows:
.LP
.RS
.nf
.ne 2
\f3mkdir\fP  \f2R\fP
\f3chmod  go\-w\fP  \f2R\fP
.fi
.RE
.IP \(bu \nn
If you want to let only certain users read the \*r files,
put the users into a group
.IR G ,
and have
.I A
further protect the \*r directory as follows:
.LP
.RS
.nf
.ne 2
\f3chgrp\fP  \f2G  R\fP
\f3chmod  g\-w,o\-rwx\fP  \f2R\fP
.fi
.RE
.IP \(bu \nn
Have
.I A
copy old \*r files (if any) into
.IR R ,
to ensure that
.I A
owns them.
.IP \(bu \nn
An \*r file's access list limits who can check in and lock revisions.
The default access list is empty,
which grants checkin access to anyone who can read the \*r file.
If you want limit checkin access,
have
.I A
invoke
.B "rcs\ \-a"
on the file; see
.BR rcs (1).
In particular,
.BI "rcs\ \-e\ \-a" A
limits access to just
.IR A .
.IP \(bu \nn
Have
.I A
initialize any new \*r files with
.B "rcs\ \-i"
before initial checkin, adding the
.B \-a
option if you want to limit checkin access.
.IP \(bu \nn
Give setuid privileges only to
.BR ci ,
.BR co ,
and
.BR rcsclean ;
do not give them to
.B rcs
or to any other command.
.IP \(bu \nn
Do not use other setuid commands to invoke \*r commands;
setuid is trickier than you think!
.SH ENVIRONMENT
.TP
.B \s-1RCSINIT\s0
options prepended to the argument list, separated by spaces.
A backslash escapes spaces within an option.
The
.B \s-1RCSINIT\s0
options are prepended to the argument lists of most \*r commands.
Useful
.B \s-1RCSINIT\s0
options include
.BR \-q ,
.BR \-V ,
and
.BR \-x .
.TP
.B \s-1TMPDIR\s0
Name of the temporary directory.
If not set, the environment variables
.B \s-1TMP\s0
and
.B \s-1TEMP\s0
are inspected instead and the first value found is taken;
if none of them are set,
a host-dependent default is used, typically
.BR /tmp .
.SH DIAGNOSTICS
For each revision,
.B ci
prints the \*r file, the working file, and the number
of both the deposited and the preceding revision.
The exit status is zero if and only if all operations were successful.
.SH IDENTIFICATION
Author: Walter F. Tichy.
.br
Revision Number: \*(Rv; Release Date: \*(Dt.
.br
Copyright \(co 1982, 1988, 1989 by Walter F. Tichy.
.br
Copyright \(co 1990, 1991 by Paul Eggert.
.SH "SEE ALSO"
co(1), ident(1), make(1), rcs(1), rcsclean(1), rcsdiff(1),
rcsintro(1), rcsmerge(1), rlog(1), rcsfile(5)
.br
Walter F. Tichy,
\*r\*-A System for Version Control,
.I "Software\*-Practice & Experience"
.BR 15 ,
7 (July 1985), 637-654.
.br