git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: ACLs for GIT

From
Sitaram Chamarty <sitaramc@gmail.com>
Date
May 17, 2011, 01:32 UTC
Message-ID
<BANLkTikwEivOiQVV-B=g3pP_StXAa8CVwg@mail.gmail.com>
In-Reply-To
<4DD12517.1000308@bbn.com>
On Mon, May 16, 2011 at 6:52 PM, Martin L Resnick <mresnick@bbn.com> wrote:
> Thanks for the reply.
>
> But gitolite would only work to deny reads on a repository or ref basis
> not a pathname level.

I notice the original question has been answered, so this email is just for the record.

Gitolite does not do any access control on *read* access (fetch, clone). It can only do that on *write*s (push).

Gerrit does that because they've reimplemented git itself and have coded that into their git engine somehow. I believe they had to implement a callback from jgit to gerrit for the fetch, and deal with evil clients that might try to read an object by pushing a supposed change on top of a SHA that they know but don't actually have. (Or something like that; I'm not real clear on this...).

regards
sitaram
PS: Gitolite does have unreleased code to do this but it's a hack with
several limitations.  Gitolite makes a temp "clone -l", deletes all
refs from it that the user has no access to, then redirects the
git-upload-pack to that repo instead ;-)
Previous: Martin L ResnickNext: Shawn Pearce
Message 10 of 15 in “ACLs for GIT”
  1. Martin L ResnickMay 15, 2011
  2. Magnus BäckMay 15, 2011
  3. Martin L ResnickMay 16, 2011
  4. Richard PetersonMay 16, 2011
  5. Phil HordMay 16, 2011
  6. Martin L ResnickMay 16, 2011
  7. Jakub NarebskiMay 16, 2011
  8. R. Tyler CroyMay 15, 2011
  9. Martin L ResnickMay 16, 2011
  10. Sitaram ChamartyMay 17, 2011
  11. Shawn PearceMay 17, 2011
  12. Sitaram ChamartyMay 17, 2011
  13. Shawn PearceMay 17, 2011
  14. Sitaram ChamartyMay 17, 2011
  15. Marc WeberMay 15, 2011

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.