{"thread":{"id":"21279","subject":"denying branch creation in a shared repository","startedAt":"2009-10-19T08:32:24Z","lastAt":"2009-10-20T11:24:48Z","messageCount":12,"participants":["Mohit Aron","Sitaram Chamarty","Björn Steinbrink","Johannes Schindelin","Howard Miller","Thomas Rast"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"125358","messageId":"ee22b09e0910190132u20931fb4i6a98fb87582a9e56@mail.gmail.com","threadId":"21279","inReplyTo":null,"subject":"denying branch creation in a shared repository","fromName":"Mohit Aron","fromEmail":"mohit.aron@gmail.com","sentAt":"2009-10-19T08:32:24Z","receivedAt":"2009-10-19T08:32:24Z","isPatch":false,"sender":{"key":"mohit.aron@gmail.com","avatar":null},"body":"Hello,\n\nI'm setting up a shared repository and I'd like to prevent users from\ncreating branches in it (they can of course create local branches in\ntheir own clone of this repository). How can I accomplish this ? I\nlooked at 'git help config' and it seems I need something similar to\nthe parameter receive.denyDeletes - this prevents deletion of\nbranches.\n\n\n- Mohit\n"},{"id":"125359","messageId":"2e24e5b90910190143j5579d9dfle15df8625eb20a00@mail.gmail.com","threadId":"21279","inReplyTo":"ee22b09e0910190132u20931fb4i6a98fb87582a9e56@mail.gmail.com","subject":"Re: denying branch creation in a shared repository","fromName":"Sitaram Chamarty","fromEmail":"sitaramc@gmail.com","sentAt":"2009-10-19T08:43:21Z","receivedAt":"2009-10-19T08:43:21Z","isPatch":false,"sender":{"key":"sitaramc@gmail.com","avatar":"https://avatars.githubusercontent.com/u/43316?v=4"},"body":"On Mon, Oct 19, 2009 at 2:02 PM, Mohit Aron wrote:\n> Hello,\n>\n> I'm setting up a shared repository and I'd like to prevent users from\n> creating branches in it (they can of course create local branches in\n> their own clone of this repository). How can I accomplish this ? I\n> looked at 'git help config' and it seems I need something similar to\n> the parameter receive.denyDeletes - this prevents deletion of\n> branches.\n\nThat was the main reason I wrote gitolite\n(http://github.com/sitaramc/gitolite), though now it does a heck of a\nlot more than just that.\n\nScroll down a bit on that page for the README.\n\nPeople have said pretty nice things about it on #git, and (subject to\nbeing in India time zone and the day job and all) I make sure I help\nout as much as I can. Email or #git, both are fine.\n\nBeing somewhat familiar with ssh and authkeys is good. Otherwise,\n*please* be sure to read\nhttp://sitaramc.github.com/0-installing/9-gitolite-basics.html for\nbackground\n"},{"id":"125362","messageId":"20091019085116.GB2796@atjola.homenet","threadId":"21279","inReplyTo":"ee22b09e0910190132u20931fb4i6a98fb87582a9e56@mail.gmail.com","subject":"Re: denying branch creation in a shared repository","fromName":"Björn Steinbrink","fromEmail":"b.steinbrink@gmx.de","sentAt":"2009-10-19T08:51:16Z","receivedAt":"2009-10-19T08:51:16Z","isPatch":false,"sender":{"key":"b.steinbrink@gmx.de","avatar":"https://avatars.githubusercontent.com/u/230962?v=4"},"body":"On 2009.10.19 01:32:24 -0700, Mohit Aron wrote:\n> I'm setting up a shared repository and I'd like to prevent users from\n> creating branches in it (they can of course create local branches in\n> their own clone of this repository). How can I accomplish this ? I\n> looked at 'git help config' and it seems I need something similar to\n> the parameter receive.denyDeletes - this prevents deletion of\n> branches.\n\nYou could write a pre-receive or update hook (depending on whether you\nwant the whole push to fail, or just the branch head creation, see\ngithooks(5)).\n\nIf a ref is created, the old value is 40 0 (just zeros, forty of them).\nAnd if the refname starts with refs/heads/, then a branch head is being\ncreated. And in that case, you could refuse the push.\n\nBjörn\n"},{"id":"125366","messageId":"alpine.DEB.1.00.0910191155310.4985@pacific.mpi-cbg.de","threadId":"21279","inReplyTo":"ee22b09e0910190132u20931fb4i6a98fb87582a9e56@mail.gmail.com","subject":"Re: denying branch creation in a shared repository","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2009-10-19T09:57:58Z","receivedAt":"2009-10-19T09:57:58Z","isPatch":false,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi,\n\nOn Mon, 19 Oct 2009, Mohit Aron wrote:\n\n> I'm setting up a shared repository and I'd like to prevent users from \n> creating branches in it (they can of course create local branches in \n> their own clone of this repository). How can I accomplish this ? I \n> looked at 'git help config' and it seems I need something similar to the \n> parameter receive.denyDeletes - this prevents deletion of branches.\n\nThe easiest way to accomplish things is to look who had the same problem \nand solved it:\n\nhttp://repo.or.cz/w/repo.git?a=blob;f=update-hook;h=98b419ecad61f6c80f;hb=6f92e96db0d605bed50db99029172607af301792#l16\n\nHth,\nDscho\n"},{"id":"125369","messageId":"26ae428a0910190308t3233debdjfc0c8beedb9c0ac6@mail.gmail.com","threadId":"21279","inReplyTo":"alpine.DEB.1.00.0910191155310.4985@pacific.mpi-cbg.de","subject":"Re: denying branch creation in a shared repository","fromName":"Howard Miller","fromEmail":"howard@e-learndesign.co.uk","sentAt":"2009-10-19T10:08:27Z","receivedAt":"2009-10-19T10:08:27Z","isPatch":false,"sender":{"key":"howard@e-learndesign.co.uk","avatar":"https://gravatar.com/avatar/ddb66c6a4a077e52b823ac5b04f33ab927cb90e2ab1eafedaeba07b1920bb99e?d=mp&s=160"},"body":"Hi,\n\nI'm quite interested in this too but I can't see what that patch does\nat all. I'm unsure what the 'mob' account is but a search suggests\nit's something to do with anonymous access, which doesn't seem to make\nany sense.\n\nCan you explain?\n\nThanks!\n\n2009/10/19 Johannes Schindelin :\n> Hi,\n>\n> On Mon, 19 Oct 2009, Mohit Aron wrote:\n>\n>> I'm setting up a shared repository and I'd like to prevent users from\n>> creating branches in it (they can of course create local branches in\n>> their own clone of this repository). How can I accomplish this ? I\n>> looked at 'git help config' and it seems I need something similar to the\n>> parameter receive.denyDeletes - this prevents deletion of branches.\n>\n> The easiest way to accomplish things is to look who had the same problem\n> and solved it:\n>\n> http://repo.or.cz/w/repo.git?a=blob;f=update-hook;h=98b419ecad61f6c80f;hb=6f92e96db0d605bed50db99029172607af301792#l16\n>\n> Hth,\n> Dscho\n>\n> --\n> To unsubscribe from this list: send the line \"unsubscribe git\" in\n> the body of a message to majordomo@vger.kernel.org\n> More majordomo info at  http://vger.kernel.org/majordomo-info.html\n>\n"},{"id":"125373","messageId":"alpine.DEB.1.00.0910191353080.4985@pacific.mpi-cbg.de","threadId":"21279","inReplyTo":"26ae428a0910190308t3233debdjfc0c8beedb9c0ac6@mail.gmail.com","subject":"Re: denying branch creation in a shared repository","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2009-10-19T12:00:17Z","receivedAt":"2009-10-19T12:00:17Z","isPatch":false,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi,\n\nfirst, if you want to be taken seriously, you might want to avoid to \ntop-post.\n\nSecond, do diligent research (e.g. on the 'mob' user).\n\nOn Mon, 19 Oct 2009, Howard Miller wrote:\n\n> I'm quite interested in this too but I can't see what that patch does at \n> all. I'm unsure what the 'mob' account is but a search suggests it's \n> something to do with anonymous access, which doesn't seem to make any \n> sense.\n\nIf this trivial script (_not_ a patch! This should be obvious at first \nsight) does not make any sense to you, I fear you will not be able to use \nhooks to do what you want to do.\n\n> Can you explain?\n\nYes.\n\nThe 'mob' user (who is password-less) can push to the 'mob' branch _iff_ \nthat exists. IOW a user of repo.or.cz can decide to let random people to \npush commits by creating the 'mob' branch and adding the 'mob' user to the \npushers.\n\nThe first part of the hook (as you can see from the pretty helpful error \nmessages it outputs) is about denying to push to anything but the mob \nbranch.\n\nThe second part is much more interesting in the context of this thread \n(and I would expect anyone capable of reading shell scripts to see that \nreadily), because it denies the 'mob' user to _create_ the 'mob' branch. \nSee line 16ff.\n\nSo the point is: the update hook gets a \"$2\" = 0000... in case a branch is \nabout to be created, and the hook can prevent that by exiting with a \nnon-zero exit code.\n\nHth,\nDscho\n"},{"id":"125374","messageId":"26ae428a0910190519mbe9ddaava3c15de94a0cd14f@mail.gmail.com","threadId":"21279","inReplyTo":"alpine.DEB.1.00.0910191353080.4985@pacific.mpi-cbg.de","subject":"Re: denying branch creation in a shared repository","fromName":"Howard Miller","fromEmail":"howard@e-learndesign.co.uk","sentAt":"2009-10-19T12:19:05Z","receivedAt":"2009-10-19T12:19:05Z","isPatch":false,"sender":{"key":"howard@e-learndesign.co.uk","avatar":"https://gravatar.com/avatar/ddb66c6a4a077e52b823ac5b04f33ab927cb90e2ab1eafedaeba07b1920bb99e?d=mp&s=160"},"body":"Mmm....\n\nThanks for the helpful reply Johannes. Perhaps you should do diligent\nresearch into mail software that folds quoted text for you. There's a\ncompany called Google you might have heard of. Just a thought.\n\nOn the other hand if you can't be bothered making a helpful reply\nrather than a rude one perhaps simply not writing anything at all\nwould, at the very least, leave us absolutely no worse off. Just the\nopinion of someone not to be taken seriously.... of course!\n\nHoward\n\n2009/10/19 Johannes Schindelin :\n> Hi,\n>\n> first, if you want to be taken seriously, you might want to avoid to\n> top-post.\n>\n> Second, do diligent research (e.g. on the 'mob' user).\n>\n> On Mon, 19 Oct 2009, Howard Miller wrote:\n>\n>> I'm quite interested in this too but I can't see what that patch does at\n>> all. I'm unsure what the 'mob' account is but a search suggests it's\n>> something to do with anonymous access, which doesn't seem to make any\n>> sense.\n>\n> If this trivial script (_not_ a patch! This should be obvious at first\n> sight) does not make any sense to you, I fear you will not be able to use\n> hooks to do what you want to do.\n>\n>> Can you explain?\n>\n> Yes.\n>\n> The 'mob' user (who is password-less) can push to the 'mob' branch _iff_\n> that exists.  IOW a user of repo.or.cz can decide to let random people to\n> push commits by creating the 'mob' branch and adding the 'mob' user to the\n> pushers.\n>\n> The first part of the hook (as you can see from the pretty helpful error\n> messages it outputs) is about denying to push to anything but the mob\n> branch.\n>\n> The second part is much more interesting in the context of this thread\n> (and I would expect anyone capable of reading shell scripts to see that\n> readily), because it denies the 'mob' user to _create_ the 'mob' branch.\n> See line 16ff.\n>\n> So the point is: the update hook gets a \"$2\" = 0000... in case a branch is\n> about to be created, and the hook can prevent that by exiting with a\n> non-zero exit code.\n>\n> Hth,\n> Dscho\n>\n>\n"},{"id":"125375","messageId":"26ae428a0910190520t64411515je6f5c4551963d6bb@mail.gmail.com","threadId":"21279","inReplyTo":"26ae428a0910190519mbe9ddaava3c15de94a0cd14f@mail.gmail.com","subject":"Re: denying branch creation in a shared repository","fromName":"Howard Miller","fromEmail":"howard@e-learndesign.co.uk","sentAt":"2009-10-19T12:20:47Z","receivedAt":"2009-10-19T12:20:47Z","isPatch":false,"sender":{"key":"howard@e-learndesign.co.uk","avatar":"https://gravatar.com/avatar/ddb66c6a4a077e52b823ac5b04f33ab927cb90e2ab1eafedaeba07b1920bb99e?d=mp&s=160"},"body":"And... I instantly have to apologise.. With wonderful irony,\nGooglemail folded the helpful bit of your reply leaving just the\n(apparently) unhelpful bit.\n\n(Crawls under nearest rock).\n\n2009/10/19 Howard Miller :\n> Mmm....\n>\n> Thanks for the helpful reply Johannes. Perhaps you should do diligent\n> research into mail software that folds quoted text for you. There's a\n> company called Google you might have heard of. Just a thought.\n>\n> On the other hand if you can't be bothered making a helpful reply\n> rather than a rude one perhaps simply not writing anything at all\n> would, at the very least, leave us absolutely no worse off. Just the\n> opinion of someone not to be taken seriously.... of course!\n>\n> Howard\n>\n> 2009/10/19 Johannes Schindelin :\n>> Hi,\n>>\n>> first, if you want to be taken seriously, you might want to avoid to\n>> top-post.\n>>\n>> Second, do diligent research (e.g. on the 'mob' user).\n>>\n>> On Mon, 19 Oct 2009, Howard Miller wrote:\n>>\n>>> I'm quite interested in this too but I can't see what that patch does at\n>>> all. I'm unsure what the 'mob' account is but a search suggests it's\n>>> something to do with anonymous access, which doesn't seem to make any\n>>> sense.\n>>\n>> If this trivial script (_not_ a patch! This should be obvious at first\n>> sight) does not make any sense to you, I fear you will not be able to use\n>> hooks to do what you want to do.\n>>\n>>> Can you explain?\n>>\n>> Yes.\n>>\n>> The 'mob' user (who is password-less) can push to the 'mob' branch _iff_\n>> that exists.  IOW a user of repo.or.cz can decide to let random people to\n>> push commits by creating the 'mob' branch and adding the 'mob' user to the\n>> pushers.\n>>\n>> The first part of the hook (as you can see from the pretty helpful error\n>> messages it outputs) is about denying to push to anything but the mob\n>> branch.\n>>\n>> The second part is much more interesting in the context of this thread\n>> (and I would expect anyone capable of reading shell scripts to see that\n>> readily), because it denies the 'mob' user to _create_ the 'mob' branch.\n>> See line 16ff.\n>>\n>> So the point is: the update hook gets a \"$2\" = 0000... in case a branch is\n>> about to be created, and the hook can prevent that by exiting with a\n>> non-zero exit code.\n>>\n>> Hth,\n>> Dscho\n>>\n>>\n>\n"},{"id":"125378","messageId":"200910191459.40332.trast@student.ethz.ch","threadId":"21279","inReplyTo":"26ae428a0910190519mbe9ddaava3c15de94a0cd14f@mail.gmail.com","subject":"Re: denying branch creation in a shared repository","fromName":"Thomas Rast","fromEmail":"trast@student.ethz.ch","sentAt":"2009-10-19T12:59:38Z","receivedAt":"2009-10-19T12:59:38Z","isPatch":false,"sender":{"key":"tr@thomasrast.ch","avatar":"https://avatars.githubusercontent.com/u/153510?v=4"},"body":"Howard Miller wrote:\n> 2009/10/19 Johannes Schindelin :\n> >\n> > first, if you want to be taken seriously, you might want to avoid to\n ^^^^^^^^^\n> > top-post.\n> \n> Thanks for the helpful reply Johannes. Perhaps you should do diligent\n> research into mail software that folds quoted text for you. There's a\n> company called Google you might have heard of. Just a thought.\n\nIt really is about the \"seriously\". If you don't, you'll get your\nmail outright ignored.\n\nMany of us get lots[1] of mail per day, and have no time nor will to\nscroll around in the message reading long (untrimmed) quoted parts\nthat are out of order, let alone click around in the corresponding\nthread to remember the context. If you want your mail to be read, you\nshould take some time to make it *easy* to read on its own.\n\n\n[1] I'm luckily not one of them, but I hear high-profile project\nmaintainers get hundreds.\n\n-- \nThomas Rast\ntrast@{inf,student}.ethz.ch\n"},{"id":"125379","messageId":"26ae428a0910190612y314c435gf0fd55b87e130489@mail.gmail.com","threadId":"21279","inReplyTo":"200910191459.40332.trast@student.ethz.ch","subject":"Re: denying branch creation in a shared repository","fromName":"Howard Miller","fromEmail":"howard@e-learndesign.co.uk","sentAt":"2009-10-19T13:12:59Z","receivedAt":"2009-10-19T13:12:59Z","isPatch":false,"sender":{"key":"howard@e-learndesign.co.uk","avatar":"https://gravatar.com/avatar/ddb66c6a4a077e52b823ac5b04f33ab927cb90e2ab1eafedaeba07b1920bb99e?d=mp&s=160"},"body":">\n> Many of us get lots[1] of mail per day, and have no time nor will to\n> scroll around in the message reading long (untrimmed) quoted parts\n> that are out of order, let alone click around in the corresponding\n> thread to remember the context.  If you want your mail to be read, you\n> should take some time to make it *easy* to read on its own.\n>\n\nI forgot and I apologise unreservedly. I am in a similar position on\nother projects although we use web forums which makes it easier. I\ncertainly don't want to get into that argument though. I struggle a\ngreat deal to be nice to people who haven't made any kind of effort to\neven ask a sensible question so I do understand. The challenge is to\nthink someone is stupid yet to manage a polite, constructive and\nnon-arrogant reply (or just say nothing if you can't). At least web\nforums have emoticons - a smiley fixes everything!!\n\nGentlemen... keep up the good work. Even an idiot like me thinks that\ngit is a fantastic project. It has saved me hours of pain and effort.\n"},{"id":"125398","messageId":"ee22b09e0910190943x51d48c09sdc50d941d643358d@mail.gmail.com","threadId":"21279","inReplyTo":"2e24e5b90910190143j5579d9dfle15df8625eb20a00@mail.gmail.com","subject":"Re: denying branch creation in a shared repository","fromName":"Mohit Aron","fromEmail":"mohit.aron@gmail.com","sentAt":"2009-10-19T16:43:56Z","receivedAt":"2009-10-19T16:43:56Z","isPatch":false,"sender":{"key":"mohit.aron@gmail.com","avatar":null},"body":">\n> That was the main reason I wrote gitolite\n> (http://github.com/sitaramc/gitolite), though now it does a heck of a\n> lot more than just that.\n>\n\nThat's great. You might want to consider making it a deb package\nthat's available from one of the Ubuntu/Debian repositories. An apt\nsearch on Ubuntu 9.10 doesn't reveal it. I usually shy away from\ninstalling software on my machines that is not automatically managed.\n\n\n- Mohit\n"},{"id":"125466","messageId":"2e24e5b90910200424m340c52d8rabc0b61a7bf55c45@mail.gmail.com","threadId":"21279","inReplyTo":"ee22b09e0910190943x51d48c09sdc50d941d643358d@mail.gmail.com","subject":"Re: denying branch creation in a shared repository","fromName":"Sitaram Chamarty","fromEmail":"sitaramc@gmail.com","sentAt":"2009-10-20T11:24:48Z","receivedAt":"2009-10-20T11:24:48Z","isPatch":false,"sender":{"key":"sitaramc@gmail.com","avatar":"https://avatars.githubusercontent.com/u/43316?v=4"},"body":"On Mon, Oct 19, 2009 at 10:13 PM, Mohit Aron wrote:\n>>\n>> That was the main reason I wrote gitolite\n>> (http://github.com/sitaramc/gitolite), though now it does a heck of a\n>> lot more than just that.\n>>\n>\n> That's great. You might want to consider making it a deb package\n> that's available from one of the Ubuntu/Debian repositories. An apt\n> search on Ubuntu 9.10 doesn't reveal it. I usually shy away from\n> installing software on my machines that is not automatically managed.\n\nThere are a couple of answers to this:\n\n(1) I'm not really a debian guy, and definitely not ubuntu. My distro\nof choice for nearly 10 years has been Mandriva :-)\n\n(2) gitolite's second reason for existence [after the one in this\nthread] is the need to install something on machines where you do\n*not* have root, can't create another user, etc etc. There was a\nSolaris 9 on which I couldn't install python-setuptools, and so no\ngitosis :-(\n\nRegardless of all that, someone is working on it...\nhttp://bugs.debian.org/cgi-bin/bugreport.cgi?bug=550817\n\nI respect your inclination to shy away; I do the same for pretty much\neverything except git itself and one or two others.\n\nBut if you don't mind looking through the documentation (browse it\ndirectly on github; it'll render the markdown properly, though the\nplain text is quite readable too), you may be able to better decide if\nyou want to use it despite this limitation.\n\nRegards,\n\nSita\n"}]}