gitolite:只允许更改选定的文件

Question

如何配置 git 和 gitolite 以允许特定用户仅更改特定目录内的文件？

例如原始主分支中的文件:

/dir1/
/dir2/file1
/dir2/file2
/dir3/file1

用户 kathrine，只允许更改 /dir2/file1 和 /dir2/file2

$kathrine: git clone git@example.com:test.git

结果:

/dir2/file1
/dir2/file2

gitolite.conf 中是否有任何 per-dir 指令，或者我应该为该用户配置 git 新分支吗？

我只是不想让图形设计师访问源代码文件。

Answer 1

2010:对于 Gitolite 2(对于 gitolite 3 可能已经改变)

否(意味着需要创建具有正确内容的专用分支)。

作为author of gitolite himself put it :

I am the author of a project called gitolite that does an excellent job of branch-level access control for multiple git repositories on a central server. My target "market" is precisely corporate users of git.

So far, I have not seen a situation where read-access needs to be restricted to ortions of a repo (git can't do that anyway).

[嗯sparse checkout可能会有帮助，但无论如何都不容易)

Write-access does often need to be restricted, and gitolite can let you restrict:

• both by branch name (e.g. only the QA lead can push a commit series into the "QA-done" branch)
• or by filename (e.g., only the team lead can make changes to the Makefile and files in src/very-important-and-critical-module).

---

请参阅“security, access control, and auditing”部分，这是一个写入 访问的示例:

conf/example.conf file有所有详细的语法:

repo foo
        RW+ = lead_dev # rule 1
        RW = dev1 dev2 dev3 dev4 # rule 2

        RW NAME/ = lead_dev # rule 3
        RW NAME/doc/ = dev1 dev2 # rule 4
        RW NAME/src/ = dev1 dev2 dev3 dev4 # rule 5

each file touched by the commits being pushed is checked against those rules.

• lead_dev can push changes to any files,
• dev1/2 can push changes to files in "doc/" and "src/" (but not the top level README),
• and dev3/4 can only push changes to files in "src/".

---

话虽如此，正如 OP 所说，棘手的问题仍然存在:

how do I create new branch witch some selected files only, and delete the previous commits, so the graphic designer could not access them, and see only the selected ones after the clone?

一般原则:

在那些文件不存在的历史点创建“graph_designer”分支。

从那里，有两个选择:

• 要么重组您当前的提交(git rebase --interactive)，以便第一个只有 dir2 文件的提交(然后提交影响任何其他目录)
• 或者，如果第一个选择代表太多工作(或者不可能，因为这些提交已经在其他存储库中被推送和 pull )，只需复制并在该新分支中添加相关文件。
  这意味着，这些文件没有过去的历史记录，但他们可能从一开始就不需要这些历史记录。

“graph_designer”将是唯一允许克隆的分支，并且不会包含任何未经授权文件的历史记录。