I have a number of repositories that I want to share across a number
of users on the same UNIX system.
For various auditing reasons the repositories need to be tightly
controlled. That is the following cannot be permitted:
* delete or overwrite a loose object;
* delete or overwrite a pack file;
* delete or overwrite a ref, except see below;
* change the config;
* change the description;
* change HEAD;
The only changes that are permissible can be made through
git-receive-pack, which limits the user to only the following:
* upload (possibly new) objects;
* create/update/force-update a ref;
* delete a ref;
And the latter two are controlled by a very strict update hook.
The update hook checks the ref name and real user id against
an ACL file (info/allowed-users) and checks to see if the user
can perform the requested operation against that ref, with four
operations being recognized:
* A == the ref is being created;
* U == the ref is being fast-forwarded;
* R == the ref is being rewound/reset;
* D == the ref is being deleted;
The update hook also requires that all lines returned by:
git-rev-list --pretty=raw $3 --not --all | egrep ^committer
correspond to a name/email address combination registered in another
table for the real user id (info/allowed-committers). Which means
we can actually trust the committer field of all commits which
are referenced by refs, as the UNIX system authenticated them.
The tagger field is also checked for every tag, but its slightly
more involved than the simple line above as it peels back the tag
layers as needed. :)
So the update hook is update-hook-example.txt, but suffering from
extreme paranoia and has been put on steriods. I'm considering
sending it in for Documentation/howto, or contrib.
Which brings me to the following problem:
I can't create the repository with --shared, as the UNIX users
all have normal shell access to the system. (/bin/rm would work
wonders to let a user violate a numb...
