From: Derrick Stolee Date: Wed, 05 Dec 2018 20:43:47 GMT Subject: Re: git, monorepos, and access control Message-ID: In-Reply-To: <878t13zp8y.fsf@evledraar.gmail.com> On 12/5/2018 3:34 PM, Ævar Arnfjörð Bjarmason wrote: > On Wed, Dec 05 2018, Coiner, John wrote: > >> I'm an engineer with AMD. I'm looking at whether we could switch our >> internal version control to a monorepo, possibly one based on git and >> VFSForGit. >> >> Has anyone looked at adding access control to git, at a per-directory >> granularity? Is this a feature that the git community would possibly >> welcome? > All of what you've described is possible to implement in git, but as far > as I know there's no existing implementation of it. > > Microsoft's GVFS probably comes closest, and they're actively > upstreaming bits of that, but as far as I know that doesn't in any way > try to solve this "users XYZ can't even list such-and-such a tree" > problem. (Avar has a lot of good ideas in his message, so I'm just going to add on a few here.) This directory-level security is not a goal for VFS for Git, and I don't see itbecoming a priority as it breaks a number of design decisions we made in our object storage and communication models. The best I can think about when considering Git as an approach would be to use submodules for your security-related content, and then have server- side security for access to those repos. Of course, submodules are not supported in VFS for Git, either. The Gerrit service has _branch_ level security, which is related to the reachability questions that a directory security would need. However, the problem is quite different. Gerrit does have a lot of experience in dealing with submodules, though, so that's probably a good place to start. Thanks, -Stolee