{"thread":{"id":"16765","subject":"Can I forbid somebody to pull some branch or tag from my repo with git protocol?","startedAt":"2008-12-17T09:03:07Z","lastAt":"2008-12-17T19:36:26Z","messageCount":10,"participants":["Emily Ren","Junio C Hamano","Sverre Rabbelier","Johannes Schindelin"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"98115","messageId":"856bfe0e0812170103w1007cf4fs1e83e506c6dd909@mail.gmail.com","threadId":"16765","inReplyTo":null,"subject":"Can I forbid somebody to pull some branch or tag from my repo with git protocol?","fromName":"Emily Ren","fromEmail":"lingyan.ren@gmail.com","sentAt":"2008-12-17T09:03:07Z","receivedAt":"2008-12-17T09:03:07Z","isPatch":false,"sender":{"key":"lingyan.ren@gmail.com","avatar":null},"body":"Hi,\nI created a repository, and I don't want somebody to pull some branch\nor tag from my repository with git protocol. How can I do ?\n\nThanks,\nEmily\n"},{"id":"98117","messageId":"7v1vw7p3r8.fsf@gitster.siamese.dyndns.org","threadId":"16765","inReplyTo":"856bfe0e0812170103w1007cf4fs1e83e506c6dd909@mail.gmail.com","subject":"Re: Can I forbid somebody to pull some branch or tag from my repo with git protocol?","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2008-12-17T09:09:15Z","receivedAt":"2008-12-17T09:09:15Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"\"Emily Ren\" writes:\n\n> I created a repository, and I don't want somebody to pull some branch\n> or tag from my repository with git protocol. How can I do ?\n\nBy not putting that tag or branch in that repository (note that you can\nhave a repository only to publish which is different from your main\nworking repository).\n.\n"},{"id":"98118","messageId":"856bfe0e0812170115p73d72495ve81046127e68c281@mail.gmail.com","threadId":"16765","inReplyTo":"7v1vw7p3r8.fsf@gitster.siamese.dyndns.org","subject":"Re: Can I forbid somebody to pull some branch or tag from my repo with git protocol?","fromName":"Emily Ren","fromEmail":"lingyan.ren@gmail.com","sentAt":"2008-12-17T09:15:12Z","receivedAt":"2008-12-17T09:15:12Z","isPatch":false,"sender":{"key":"lingyan.ren@gmail.com","avatar":null},"body":"I want some group can pull these branches or tags from my repo, while\nother's can't, Need I maintain two repositories ?\n\nOn Wed, Dec 17, 2008 at 5:09 PM, Junio C Hamano wrote:\n> \"Emily Ren\" writes:\n>\n>> I created a repository, and I don't want somebody to pull some branch\n>> or tag from my repository with git protocol. How can I do ?\n>\n> By not putting that tag or branch in that repository (note that you can\n> have a repository only to publish which is different from your main\n> working repository).\n> .\n>\n"},{"id":"98127","messageId":"bd6139dc0812170353y5d78f03ao1c0619c9bd68f309@mail.gmail.com","threadId":"16765","inReplyTo":"856bfe0e0812170115p73d72495ve81046127e68c281@mail.gmail.com","subject":"Re: Can I forbid somebody to pull some branch or tag from my repo with git protocol?","fromName":"Sverre Rabbelier","fromEmail":"srabbelier@gmail.com","sentAt":"2008-12-17T11:53:13Z","receivedAt":"2008-12-17T11:53:13Z","isPatch":false,"sender":{"key":"srabbelier@gmail.com","avatar":"https://avatars.githubusercontent.com/u/3098?v=4"},"body":"On Wed, Dec 17, 2008 at 10:15, Emily Ren wrote:\n> I want some group can pull these branches or tags from my repo, while\n> other's can't, Need I maintain two repositories ?\n\nI think gitosis should be able to do that? Otherwise you could look\ninto hosting sites like github or gitorious, I think they have at\nleast some form of access control, yes?\n\n-- \nCheers,\n\nSverre Rabbelier\n"},{"id":"98130","messageId":"alpine.DEB.1.00.0812171312330.28560@intel-tinevez-2-302","threadId":"16765","inReplyTo":"856bfe0e0812170103w1007cf4fs1e83e506c6dd909@mail.gmail.com","subject":"Re: Can I forbid somebody to pull some branch or tag from my repo with git protocol?","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2008-12-17T12:12:41Z","receivedAt":"2008-12-17T12:12:41Z","isPatch":false,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi,\n\nOn Wed, 17 Dec 2008, Emily Ren wrote:\n\n> I created a repository, and I don't want somebody to pull some branch or \n> tag from my repository with git protocol. How can I do ?\n\nYes, it is easy: do not push it into that repository.\n\nIf you already did, delete it in that repository.\n\nCiao,\nDscho\n"},{"id":"98137","messageId":"alpine.DEB.1.00.0812171322330.28560@intel-tinevez-2-302","threadId":"16765","inReplyTo":"856bfe0e0812170115p73d72495ve81046127e68c281@mail.gmail.com","subject":"Re: Can I forbid somebody to pull some branch or tag from my repo with git protocol?","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2008-12-17T12:25:59Z","receivedAt":"2008-12-17T12:25:59Z","isPatch":false,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi,\n\nOn Wed, 17 Dec 2008, Emily Ren wrote:\n\n> I want some group can pull these branches or tags from my repo, while\n> other's can't, Need I maintain two repositories ?\n\nEither that (that would be the easy method, and also the proper one, since \npeople would not even know what you hide), but you could patch \nupload-pack so that it runs a hook with the rev-list arguments in \ndo_rev_list() in upload-pack.c, and die() if the hook returns non-zero.\n\nCiao,\nDscho\n"},{"id":"98139","messageId":"856bfe0e0812170435t32fce496q41f825c01ee7045c@mail.gmail.com","threadId":"16765","inReplyTo":"bd6139dc0812170353y5d78f03ao1c0619c9bd68f309@mail.gmail.com","subject":"Re: Can I forbid somebody to pull some branch or tag from my repo with git protocol?","fromName":"Emily Ren","fromEmail":"lingyan.ren@gmail.com","sentAt":"2008-12-17T12:35:45Z","receivedAt":"2008-12-17T12:35:45Z","isPatch":false,"sender":{"key":"lingyan.ren@gmail.com","avatar":null},"body":"Sverre,\nThank you for your information !\nAs far as I know, gitosis can control someone readonly/writable to\nsome repo, it has no access control on branch/tag level. Am I right ?\n\nI'll look at github and gitorious, are they free software ?\n\nThanks,\nEmily\n\n\nOn Wed, Dec 17, 2008 at 7:53 PM, Sverre Rabbelier wrote:\n> On Wed, Dec 17, 2008 at 10:15, Emily Ren wrote:\n>> I want some group can pull these branches or tags from my repo, while\n>> other's can't, Need I maintain two repositories ?\n>\n> I think gitosis should be able to do that? Otherwise you could look\n> into hosting sites like github or gitorious, I think they have at\n> least some form of access control, yes?\n>\n> --\n> Cheers,\n>\n> Sverre Rabbelier\n>\n"},{"id":"98140","messageId":"bd6139dc0812170447h7546cbf0v3151166668ad1248@mail.gmail.com","threadId":"16765","inReplyTo":"856bfe0e0812170435t32fce496q41f825c01ee7045c@mail.gmail.com","subject":"Re: Can I forbid somebody to pull some branch or tag from my repo with git protocol?","fromName":"Sverre Rabbelier","fromEmail":"srabbelier@gmail.com","sentAt":"2008-12-17T12:47:19Z","receivedAt":"2008-12-17T12:47:19Z","isPatch":false,"sender":{"key":"srabbelier@gmail.com","avatar":"https://avatars.githubusercontent.com/u/3098?v=4"},"body":"[It is common not to top-post on this list :)]\n\nOn Wed, Dec 17, 2008 at 13:35, Emily Ren wrote:\n> As far as I know, gitosis can control someone readonly/writable to\n> some repo, it has no access control on branch/tag level. Am I right ?\n\nAh, sorry, I meant to control access to different repo's for different groups.\n\n> I'll look at github and gitorious, are they free software ?\n\nIIRC gitorious is open source, but I just checked and I don't see any\naccess control there; which leaves github, which is not free software\nI'm afraid.\n\nI think, as Johannes said, keeping two seperate repo's and using some\nform of access control on those would be best.\n\n-- \nCheers,\n\nSverre Rabbelier\n"},{"id":"98141","messageId":"856bfe0e0812170537n78abbd57pfe33b3829941ebb9@mail.gmail.com","threadId":"16765","inReplyTo":"bd6139dc0812170447h7546cbf0v3151166668ad1248@mail.gmail.com","subject":"Re: Can I forbid somebody to pull some branch or tag from my repo with git protocol?","fromName":"Emily Ren","fromEmail":"lingyan.ren@gmail.com","sentAt":"2008-12-17T13:37:36Z","receivedAt":"2008-12-17T13:37:36Z","isPatch":false,"sender":{"key":"lingyan.ren@gmail.com","avatar":null},"body":"Sverre, Johannes,\n\nThank you very much for sharing your good idea ! Yes, maintaining two\nseparate rep maybe best.\n\nJohannes,\nDoes your second suggestion mean that I need to write a script and use\ngit hook to enable it ?\n\nThanks,\nEmily\n\n\nOn Wed, Dec 17, 2008 at 8:47 PM, Sverre Rabbelier wrote:\n> [It is common not to top-post on this list :)]\n>\n> On Wed, Dec 17, 2008 at 13:35, Emily Ren wrote:\n>> As far as I know, gitosis can control someone readonly/writable to\n>> some repo, it has no access control on branch/tag level. Am I right ?\n>\n> Ah, sorry, I meant to control access to different repo's for different groups.\n>\n>> I'll look at github and gitorious, are they free software ?\n>\n> IIRC gitorious is open source, but I just checked and I don't see any\n> access control there; which leaves github, which is not free software\n> I'm afraid.\n>\n> I think, as Johannes said, keeping two seperate repo's and using some\n> form of access control on those would be best.\n>\n> --\n> Cheers,\n>\n> Sverre Rabbelier\n>\n"},{"id":"98166","messageId":"7vd4fqoapx.fsf@gitster.siamese.dyndns.org","threadId":"16765","inReplyTo":"alpine.DEB.1.00.0812171322330.28560@intel-tinevez-2-302","subject":"Re: Can I forbid somebody to pull some branch or tag from my repo with git protocol?","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2008-12-17T19:36:26Z","receivedAt":"2008-12-17T19:36:26Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Johannes Schindelin writes:\n\n> On Wed, 17 Dec 2008, Emily Ren wrote:\n>\n>> I want some group can pull these branches or tags from my repo, while\n>> other's can't, Need I maintain two repositories ?\n>\n> Either that (that would be the easy method, and also the proper one, since \n> people would not even know what you hide), but you could patch \n> upload-pack so that it runs a hook with the rev-list arguments in \n> do_rev_list() in upload-pack.c, and die() if the hook returns non-zero.\n\nI do not think that would work very well as you expect. Two branches can\nbe pointing at the same commit, and Emily may want to hide one but not the\nother. The time you obtain from \"want\" is too late.\n\nIf you were to extend upload-pack, the place to narrow would be the\ninitial \"here are the refs and the objects they point at\" announcement\nthat is done at the very beginning. You would do something like the\npseudo patch attached at the end.\n\nread_set_of_exposed_refs_from_hook() should return, depending on who the\nuser is (which is obviously not available if this connection is over the\nanonymous git-daemon service, but local and usual ssh connection you could\ndo whoami, and on gitosis there would be some environment variable to\ndistinguish who you are that you can use), the set of refs that the user\nis allowed to see.\n\ndiff --git i/upload-pack.c w/upload-pack.c\nindex e5adbc0..129aa1e 100644\n--- i/upload-pack.c\n+++ w/upload-pack.c\n@@ -10,6 +10,10 @@\n #include \"revision.h\"\n #include \"list-objects.h\"\n #include \"run-command.h\"\n+#include \"string-list.h\"\n+\n+static int use_ref_limiting;\n+static struct string_list exposed_refs;\n \n static const char upload_pack_usage[] = \"git-upload-pack [--strict] [--timeout=nn] \";\n \n@@ -574,8 +578,14 @@ static int send_ref(const char *refname, const unsigned char *sha1, int flag, vo\n \tstatic const char *capabilities = \"multi_ack thin-pack side-band\"\n \t\t\" side-band-64k ofs-delta shallow no-progress\"\n \t\t\" include-tag\";\n-\tstruct object *o = parse_object(sha1);\n+\tstruct object *o;\n+\n+\tif (use_ref_limiting && !string_list_has_string(&exposed_refs, refname)) {\n+\t\t/* The downloader is not allowed to know the presense of this ref */\n+\t\treturn 0;\n+\t}\n \n+\to = parse_object(sha1);\n \tif (!o)\n \t\tdie(\"git upload-pack: cannot find object %s:\", sha1_to_hex(sha1));\n \n@@ -600,6 +610,12 @@ static int send_ref(const char *refname, const unsigned char *sha1, int flag, vo\n static void upload_pack(void)\n {\n \treset_timeout();\n+\n+\tif (\"limit exposed refs\" hook is available) {\n+\t\tuse_ref_limiting = 1;\n+\t\tread_set_of_exposed_refs_from_hook(&exposed_refs);\n+\t}\n+\n \thead_ref(send_ref, NULL);\n \tfor_each_ref(send_ref, NULL);\n \tpacket_flush(1);\n"}]}