From: Martin L Resnick <mresnick@bbn.com>
Date: Mon, 16 May 2011 15:36:08 GMT
Subject: Re: ACLs for GIT
Message-ID: <4DD14468.1000401@bbn.com>
In-Reply-To: <4DD143CA.3000700@cisco.com>

Wonderful. Thanks a lot.

That's a great idea to use submodules WITH encrypting the source.

I like it! I'm going to propose we use it.

Thanks for the suggestion.

On 05/16/2011 11:33 AM, Phil Hord wrote:
> On 05/16/2011 09:22 AM, Martin L Resnick wrote:
>> Thanks Mangus.
>>
>> You pointed out some hurdles I'll have to think about
>> (blocked files not matching the SHA and so can't be committed).
>>
>> As to why I want to do this consider NSA non-export rules.
>> Our application would be built with NSA encryption
>> but we have foreign nationals working on the code
>> and so they are not permitted to see that part.
>> The makefiles look to see if the NSA encryption code file
>> is there and link it in. If not a stub is used.
>
> We use submodules for this same need here.  If the submodule is loaded,
> the code is used from that.  If not, pre-built binaries are used
> instead.  These could be stubs.
>
> When we share code with outside partners, we give them access only to
> the modules they need.
>
> We further guard the code in the submodule by PGP-encrypting the source
> files and storing them in the repository (as binaries).  This practice
> lets us be more free with the repository and not worry so much that it
> may be cloned well out of our control.  Storing code as shrouded
> binaries negates much of git's power, but only for this one submodule.
> Our other submodules are still quite git-friendly.
>
> Phil
>
>