1

I am using gitolite for git repository restrict the access.

Any one can tell how to configure restrict the branches and how to restrict read permission for particular Dir/file?

Martijn Pieters
  • 1,048,767
  • 296
  • 4,058
  • 3,343
vinayak
  • 51
  • 1
  • 1
  • 3
  • 1
    That may be possible in the web interface, but git itself does not support this. People clone the whole repo and get everything. You'd have to create a "censored" second repository that contains only what should be visible. – Thilo Nov 18 '16 at 05:17

1 Answers1

2

As mentioned in the Gitolite overview

read access controlled at the repo level,

You either access (clone) the full repo or you don't at all.

A sensitive file should typically not be in a repo (or be in a private repo), and generated through a smudge filter content driver. That 'smudge' script can (on git checkout) check if you are an authorized user and, if yes, fetch the file (from a trusted private source, not from a git repo) and generate on checkout your restricted file.

Write access restriction, on the other hand, has always been possible, as I mentioned 6 years ago.
With VREFS, you can enforce all kinds of policies (like git commit messages, or based on roles.

And yes, you can restrict pushes based on file/DIR.

You can even use LDAP groups to restrict gitolite access

For restricting read access based on dir/file or branches/tags except gitolite...

  • first even gitolite does not do that
  • this is not how a Git repo works: you would have to impose restrictions on the listener (https or ssh) level, that is at the level where git upload-pack (done on the server side during a client git fetch) is requesting packs: it is called by ssh, or by the https smart protocol.
    That would involve packs inspection (with git verify-pack), which would slow down considerably clone/fetch operation and has not been done to my knowledge.

Hence my original suggestion to not put any restricted/sensitive file ni a git repo.

Community
  • 1
  • 1
VonC
  • 1,262,500
  • 529
  • 4,410
  • 5,250
  • Thanks for your advice @Vonc. Any other option for restrict read write access based on dir/file or branches/tags except gitolite? – vinayak Nov 18 '16 at 06:51
  • @vinay I have edited the answer to address your question (as well as to point out to existing *wirte* restriction) – VonC Nov 18 '16 at 07:19