limiting ref visibility to specific users

limiting ref visibility to specific users

[Enrico Weigelt]

Hi folks,


I'd like to control which refs are visible to certain users
(when coming via ssh). Is there already some generic way to
do that (eg. passing some filter rule by a calling wrapper ?)


cu
-- 
----------------------------------------------------------------------
 Enrico Weigelt, metux IT service -- http://www.metux.de/

 phone:  +49 36207 519931  email: weigelt@metux.de
 mobile: +49 151 27565287  icq:   210169427         skype: nekrad666
----------------------------------------------------------------------
 Embedded-Linux / Portierung / Opensource-QM / Verteilte Systeme
----------------------------------------------------------------------

Re: limiting ref visibility to specific users

[Sverre Rabbelier]

Heya,

On Tue, Aug 17, 2010 at 10:09, Enrico Weigelt <weigelt@metux.de> wrote:
> I'd like to control which refs are visible to certain users
> (when coming via ssh). Is there already some generic way to
> do that (eg. passing some filter rule by a calling wrapper ?)

Shawn, weren't you looking into something similar for Gerrit? Although
I think what you were investigating would allow the user to get the
rest of the refs somehow?

-- 
Cheers,

Sverre Rabbelier

Re: limiting ref visibility to specific users

[Shawn Pearce]

On Tue, Aug 17, 2010 at 8:48 AM, Sverre Rabbelier <srabbelier@gmail.com> wrote:
> On Tue, Aug 17, 2010 at 10:09, Enrico Weigelt <weigelt@metux.de> wrote:
>> I'd like to control which refs are visible to certain users
>> (when coming via ssh). Is there already some generic way to
>> do that (eg. passing some filter rule by a calling wrapper ?)
>
> Shawn, weren't you looking into something similar for Gerrit? Although
> I think what you were investigating would allow the user to get the
> rest of the refs somehow?

Yup.  We implemented this in JGit by allowing the application to
provide an implementation of a RefFilter interface, only the refs that
the filter approves are shown to the remote client.  During
receive-pack (server side of push) the RefFilter also is used to
restrict what objects the client may mention as a delta base, or as an
object in the graph (e.g. commit parent, commit root tree, or tree
entry member).

There is no equivalent in C Git.  You have to use either Gerrit Code
Review, or build your own server on top of JGit to take advantage of
that feature.

-- 
Shawn.