Re: Repository Security

From: Johannes Schindelin <johannes.schindelin@gmx.de>
Date: Jan 23, 2007, 14:29 UTC
Message-ID: <Pine.LNX.4.63.0701231525250.22628@wbgn013.biozentrum.uni-wuerzburg.de>
In-Reply-To: <200701230823.17938.andre@masella.no-ip.org>

Hi,

On Tue, 23 Jan 2007, Andre Masella wrote:

Show 8 quoted lines

> > > As I understand it, none of the repository backends allow any per-user
> > > per-branch access control.
> > The idea in git (unless you really want to get the same setup as in CVS,
> > which would be rather sad) is that every developer has at least one
> > repository. Write-access: only one developer.
> 
> Believe me: I was ready to throw a party when I got to shutdown CVS last 
> week.

Congratulations!

Show 5 quoted lines

> Say I have two utterly separate repositories with two integrators. I 
> want to put them on a web server (and so same DAV share). There is 
> little to stop the integrator of one project (by intention or accident) 
> from modifying the other repository. It can be done, but doing it 
> requires one section of the httpd.conf per repository.

I thought you can do all the fancy WebDAV stuff with .htaccess?

Show 7 quoted lines

> > I already hear the complaint: "But you need a central repository!". If 
> > you _have_ to have a central repository, designate the integrator's 
> > repository central.
> 
> Okay, say one regular developer wants share his changes with another 
> developer. He either has to mail patches, create an SSH account, or set 
> up one of git-daemon or WebDAV.

Most likely just start git-daemon. It's read-only (in the future, you might be able to enable anonymous push, but not right now), so you don't have to worry.

> And most of those require knowing the workstation name which is 
> inconvienient.

Umm. Oh. Okay. Didn't expect _that_ to be inconvenient.

> I would rather have each user able to push to a branch with their name 
> on it on a central server.

Really, the easiest is to setup a central server with SSH, where every user has an individual account. Administrating, say, a Linux box with literally thousands of users is a charm.

Ciao, Dscho