Re: Can I prevent someone clone my git repository?
- From
Johannes Schindelin <johannes.schindelin@gmx.de>
- Date
- Jan 8, 2009, 15:49 UTC
- Message-ID
- <alpine.DEB.1.00.0901081648550.30769@pacific.mpi-cbg.de>
- In-Reply-To
- <20090108152934.GA16840@spearce.org>
Hi,
On Thu, 8 Jan 2009, Shawn O. Pearce wrote:
Show 33 quoted lines
> Johannes Schindelin <Johannes.Schindelin@gmx.de> wrote: > > On Thu, 8 Jan 2009, Miklos Vajna wrote: > > > > > On Thu, Jan 08, 2009 at 12:27:59PM +0100, Johannes Schindelin <Johannes.Schindelin@gmx.de> wrote: > > > > > like git://your-host/repository.git > > > > > > > > If the people are on different IPs, a hook can restrict who may clone, > > > > since commit v1.6.1-rc1~109. > > > > > > Hmm, but I think there is no hook called "pre-send" or so that could > > > return status code 1 to prevent receiving, so that commit on its own > > > does not does what Emily needs here. > > > > Oops. I assumed there is a pre-upload hook, but apparently I was wrong. > > > > Would be easy to introduce that hook, though... > > Well, sure, but Emily is asking about "no clone". > > Does that mean that users can ask for incremental updates, but not > initial clones where there is nothing in common? > > If so then any sort of hook needs an input parameter and needs > to be called after the commit negotation is complete, so the hook > can be told "the other side has some stuff" or "the other side has > nothing at all". > > FWIW I was just yesterday talking to a co-worker about adding this > sort of behavior to Gerrit2. Cloning the Linux kernel over its > internal sshd is quite a bit slower than doing it over native git, > so we were talking about blocking initial clones. Everything in > a Gerrit server should be opensource and available over git://, > so its just a limit to save server resources.
If you want it, here is an initial patch without tests. Indeed, it has not been tested at all.
-- snipsnap -- [PATCH] Add a pre-upload hook to git-upload-pack
Signed-off-by: Johannes Schindelin <Johannes.Schindelin@gmx.de>
---
upload-pack.c | 24 ++++++++++++++++++++++++ 1 files changed, 24 insertions(+), 0 deletions(-)
diff --git a/upload-pack.c b/upload-pack.c index e5adbc0..bca0428 100644 --- a/upload-pack.c +++ b/upload-pack.c @@ -140,6 +140,27 @@ static int do_rev_list(int fd, void *create_full_pack) return 0; } +static int pre_upload_hook(int is_clone) +{ + struct child_process proc; + const char *name = git_path("hooks/pre-upload"); + const char *argv[3]; + int i = 0; + + if (access(name, X_OK) < 0) + return 0; + + memset(&proc, 0, sizeof(proc)); + argv[i++] = name; + if (is_clone) + argv[i++] = "clone"; + argv[i++] = NULL; + proc.argv = argv; + proc.no_stdin = 1; + proc.stdout_to_stderr = 1; + return run_command(&proc); +} + static void create_pack_file(void) { struct async rev_list; @@ -153,6 +174,9 @@ static void create_pack_file(void) const char *argv[10]; int arg = 0; + if (pre_upload_hook(create_full_pack)) + die("upload denied by pre-upload hook"); + rev_list.proc = do_rev_list; /* .data is just a boolean: any non-NULL value will do */ rev_list.data = create_full_pack ? &rev_list : NULL;