Re: thoughts on a possible "pre-upload" hook

From: Sitaram Chamarty <sitaramc@gmail.com>
Date: Sep 25, 2009, 11:54 UTC
Message-ID: <2e24e5b90909250454s7ed35b9ch10b954b0b1a40cfe@mail.gmail.com>
In-Reply-To: <20090922161725.GS14660@spearce.org>

sorry I couldn't reply till now...

On Tue, Sep 22, 2009 at 9:47 PM, Shawn O. Pearce <spearce@spearce.org> wrote:

Show 15 quoted lines

> Matthieu Moy <Matthieu.Moy@grenoble-inp.fr> wrote:
>> >>>>>> "Sitaram" == Sitaram Chamarty <sitaramc@gmail.com> writes:
>> > Sitaram> As git is used more and more in corporate-type environments, at some
>> > Sitaram> point it becomes convenient to have *branches* (or more accurately,
>> > Sitaram> refs) that are not readable.
>>
>> But that alone would make it rather painfull for the user : "git
>> clone" would fail if any branch in the repository is not readable, for
>> example.
>
> No, what Sitaram is asking for is to have upload-pack not advertise
> the hidden branches.  By not advertising them, the client cannot
> send a "want" request for them, and they won't appear in the list
> that clone believes exists when it creates the new local repository.
> Thus, clone would succeed.

yes that would be precisely what I meant. The hook would (somehow) be able to influence which, among the available ones, get advertised.

Show 9 quoted lines

>> Also, don't forget that branches are just references, which means that
>> if you prevent reference A from being uploaded, then another reference
>> B may point to the same commits as A, and then you can bypass the
>> safety hook on A by using B.
>
> Yes.  But this is no different than having two different git
> repositories, A.git and B.git.  Pushing commits from A.git into B.git
> allows someone to bypass A.git's filesystem read access control by
> instead reading those commits from B.git.

yes indeed -- if someone were to foolishly merge a "secret" branch into a "normal" branch, so that it is now reachable from a "normal" branch, that's his problem -- that cannot be within the scope of this check.

It's the user's job to make sure that *only* his "secret" branch can reach the secret stuff, other branches cannot reach it, and all git has to do is ensure that no one can "want" that branch if they're not supposed to see it.

-- 
Sitaram