fix(hlcc): use native shared repository permissions

server-tools/lake-lamp-authz/README.md

@@ -124,11 +124,10 @@ node server-tools/lake-lamp-authz/authorize-repo-push.js \
 - 当裸仓库归属代码频道服务账户时，在系统 Git 配置中把该精确路径登记为
   `safe.directory`，不得使用通配符。
 
-光湖代码频道本身保留 `UMask=0077`，以免放宽数据库和其他状态目录。仅在
-`guanghu-ice-heart.git/hooks/post-receive.d/guanghu-ice-heart-share` 安装仓库随附的
-`hooks/guanghu-ice-heart-post-receive`，让成功的公共 Git 推送完成后校正
-`objects` 与 `refs` 的共享组权限。不要为了共享一个裸仓库而修改整个代码频道服务的
-UMask。
+光湖代码频道本身保留 `UMask=0077`，以免放宽数据库和其他状态目录。对需要由直达
+接收器共同读写的精确裸仓库设置 Git 原生 `core.sharedRepository=group`，让新建的
+`objects` 与 `refs` 从写入时就继承专用共享组权限。不要安装推送后递归 `chmod` 的
+钩子，也不要为了共享一个裸仓库而修改整个代码频道服务的 UMask。
 
 部署后用当前主分支生成无变化验收 bundle，经 `receiveBundle` 完整执行一次；验收前后
 主分支 SHA 必须一致，并且代码频道账户与授权服务账户执行 `git fsck` 均通过。

server-tools/lake-lamp-authz/hooks/guanghu-ice-heart-post-receive

@@ -1,39 +0,0 @@
-#!/bin/sh
-set -eu
-
-# The code-channel service runs with UMask=0077. Keep that isolation for its
-# database and other state, but make Git objects and refs readable/writable by
-# the repository's dedicated shared group after an accepted public push.
-cat >/dev/null
-repo_dir=$(git rev-parse --absolute-git-dir)
-expected_repo=/var/lib/guanghu/personas/guanghu/hlcc-v16.0.1/data/repositories/bingshuo/guanghu-ice-heart.git
-[ "$repo_dir" = "$expected_repo" ] || exit 0
-cd "$repo_dir"
-owner_uid=$(id -u)
-
-share_tree() {
-  # RestrictSUIDSGID forbids chmod calls that preserve a setgid directory.
-  # Existing shared directories are already traversable, so touch only new
-  # private directories and use a numeric mode that drops the special bit.
-  find "$1" -user "$owner_uid" -type d ! -perm -g=x -exec chmod 0770 {} +
-  find "$1" -user "$owner_uid" -type f ! -perm -g=r -exec chmod g+r {} +
-}
-
-share_tree "$repo_dir/objects"
-share_tree "$repo_dir/refs"
-
-# receive-pack may keep new objects in a quarantine directory until hooks have
-# completed. Normalize that directory before Git moves the objects into place.
-if [ -n "${GIT_OBJECT_DIRECTORY:-}" ] && [ -d "$GIT_OBJECT_DIRECTORY" ]; then
-  case "$GIT_OBJECT_DIRECTORY/" in
-    "$repo_dir/"*) share_tree "$GIT_OBJECT_DIRECTORY" ;;
-  esac
-fi
-
-for shared_file in HEAD packed-refs; do
-  if [ -f "$repo_dir/$shared_file" ]; then
-    find "$repo_dir/$shared_file" -user "$owner_uid" -exec chmod g+rw {} +
-  fi
-done
-
-printf '%s\n' "post_receive_permissions_reconciled" >"$repo_dir/hooks/post-receive-share.last"