Advices to imlement update hook

Advices to imlement update hook

[Francis Moreau]

Hi !

I'd like to restrict access to one of my repos: the project tracked by
it has several directories: a/ b/ c/ and I'd like to allow only
modifications happen in b/ directory.

I'm planning to use git hooks, not sure which one I should use: if the
check should happen at the commit or push time or both.

For now I'm going to use the update hook, so it will happen when pushing.

Now the question is: what is the best way to do this ?

I'm planning to use something equivalent to "git-diff-tree oldref
newref | { grep -v b || exit 1; }" but doesn't look like the best git
way.

BTW, from the git-diff-tree manpage:

	<path>...
	    If provided, the results are limited to a subset of
	    files matching one of these prefix strings. i.e., file
	    matches /^<pattern1>|<pattern2>|.../ Note that this
	    parameter does not provide any wildcard or regexp
	    features.

What does it mean exactly ? what does 'pattern' word mean if wildcard
or regexp is not supported ?
I also tried:

   git diff-tree <oldref> <newref> -- ^b || exit 1

but it doesn't work.

Could anybody give me some advices ?

Thanks
-- 
Francis

Re: Advices to imlement update hook

[Johannes Sixt]

Am 2/9/2011 17:27, schrieb Francis Moreau:
> Hi !
> 
> I'd like to restrict access to one of my repos: the project tracked by
> it has several directories: a/ b/ c/ and I'd like to allow only
> modifications happen in b/ directory.
> 
> I'm planning to use git hooks, not sure which one I should use: if the
> check should happen at the commit or push time or both.
> 
> For now I'm going to use the update hook, so it will happen when pushing.
> 
> Now the question is: what is the best way to do this ?
> 
> I'm planning to use something equivalent to "git-diff-tree oldref
> newref | { grep -v b || exit 1; }" but doesn't look like the best git
> way.
> 
> BTW, from the git-diff-tree manpage:
> 
> 	<path>...
> 	    If provided, the results are limited to a subset of
> 	    files matching one of these prefix strings. i.e., file
> 	    matches /^<pattern1>|<pattern2>|.../ Note that this
> 	    parameter does not provide any wildcard or regexp
> 	    features.
> 
> What does it mean exactly ? what does 'pattern' word mean if wildcard
> or regexp is not supported ?
> I also tried:
> 
>    git diff-tree <oldref> <newref> -- ^b || exit 1
> 
> but it doesn't work.

  git diff-tree --quiet <oldref> <newref> -- b

Re: Advices to imlement update hook

[Johannes Sixt]

[Sorry, sent too early - fat fingers :-(]

Am 2/9/2011 17:38, schrieb Johannes Sixt:
> Am 2/9/2011 17:27, schrieb Francis Moreau:
>> Hi !
>>
>> I'd like to restrict access to one of my repos: the project tracked by
>> it has several directories: a/ b/ c/ and I'd like to allow only
>> modifications happen in b/ directory.
>>
>> I'm planning to use git hooks, not sure which one I should use: if the
>> check should happen at the commit or push time or both.
...
>> I also tried:
>>
>>    git diff-tree <oldref> <newref> -- ^b || exit 1
>>
>> but it doesn't work.
> 
>   git diff-tree --quiet <oldref> <newref> -- b

should do it; it sets the exit code.

But don't you also want to inspect all commits between oldref and newref?
Someone could have modified the directory, and then reverted the
modification in a later commit. If these commits arrive in a single push,
the above code wouldn't notice this.

-- Hannes

Re: Advices to imlement update hook

[Francis Moreau]

On Wed, Feb 9, 2011 at 5:42 PM, Johannes Sixt <j.sixt@viscovery.net> wrote:
> [Sorry, sent too early - fat fingers :-(]
>
> Am 2/9/2011 17:38, schrieb Johannes Sixt:
>> Am 2/9/2011 17:27, schrieb Francis Moreau:
>>> Hi !
>>>
>>> I'd like to restrict access to one of my repos: the project tracked by
>>> it has several directories: a/ b/ c/ and I'd like to allow only
>>> modifications happen in b/ directory.
>>>
>>> I'm planning to use git hooks, not sure which one I should use: if the
>>> check should happen at the commit or push time or both.
> ...
>>> I also tried:
>>>
>>>    git diff-tree <oldref> <newref> -- ^b || exit 1
>>>
>>> but it doesn't work.
>>
>>   git diff-tree --quiet <oldref> <newref> -- b
>
> should do it; it sets the exit code.

but does that work if a commit modify b/ and another directory ?

> But don't you also want to inspect all commits between oldref and newref?

Yes I want to inspect all commits in the range.

> Someone could have modified the directory, and then reverted the
> modification in a later commit. If these commits arrive in a single push,
> the above code wouldn't notice this.

I agree but I thought that git diff-tree would list all changes made
between the 2 refs.

Thanks
-- 
Francis

Re: Advices to imlement update hook

[Jeff King]

On Wed, Feb 09, 2011 at 05:51:24PM +0100, Francis Moreau wrote:

> >>>    git diff-tree <oldref> <newref> -- ^b || exit 1
> >>>
> >>> but it doesn't work.
> >>
> >>   git diff-tree --quiet <oldref> <newref> -- b
> >
> > should do it; it sets the exit code.
> 
> but does that work if a commit modify b/ and another directory ?

No, it just looks for commits that modified b. There is currently no way
to specify a path to say "commit that did not modify b". You need to
check the output of:

  git rev-list | git diff-tree --stdin -m --name-only

which should list all paths modified by all commits. And then you can
either blacklist or whitelist as appropriate (note that the names can be
quoted; you might want to look at the "-z" option and do your
list-checking in perl).

> > But don't you also want to inspect all commits between oldref and newref?
> 
> Yes I want to inspect all commits in the range.

see above.

> > Someone could have modified the directory, and then reverted the
> > modification in a later commit. If these commits arrive in a single push,
> > the above code wouldn't notice this.
> 
> I agree but I thought that git diff-tree would list all changes made
> between the 2 refs.

Between the two endpoints. It won't even look at the commits in the
middle, so as long as a later middle commit reverts the change of an
earlier middle commit, the endpoints won't be affected.

-Peff

Re: Advices to imlement update hook

[Francis Moreau]

Hello,

On Wed, Feb 9, 2011 at 6:05 PM, Jeff King <peff@peff.net> wrote:
> On Wed, Feb 09, 2011 at 05:51:24PM +0100, Francis Moreau wrote:
>
>> >>>    git diff-tree <oldref> <newref> -- ^b || exit 1
>> >>>
>> >>> but it doesn't work.
>> >>
>> >>   git diff-tree --quiet <oldref> <newref> -- b
>> >
>> > should do it; it sets the exit code.
>>
>> but does that work if a commit modify b/ and another directory ?
>
> No, it just looks for commits that modified b. There is currently no way
> to specify a path to say "commit that did not modify b". You need to
> check the output of:
>
>  git rev-list | git diff-tree --stdin -m --name-only
>
> which should list all paths modified by all commits. And then you can
> either blacklist or whitelist as appropriate (note that the names can be
> quoted; you might want to look at the "-z" option and do your
> list-checking in perl).
>
>> > But don't you also want to inspect all commits between oldref and newref?
>>
>> Yes I want to inspect all commits in the range.
>
> see above.
>
>> > Someone could have modified the directory, and then reverted the
>> > modification in a later commit. If these commits arrive in a single push,
>> > the above code wouldn't notice this.
>>
>> I agree but I thought that git diff-tree would list all changes made
>> between the 2 refs.
>
> Between the two endpoints. It won't even look at the commits in the
> middle, so as long as a later middle commit reverts the change of an
> earlier middle commit, the endpoints won't be affected.

Oh, I see. I undestand why the git-rev-list is needed now.

Thanks for your help !
-- 
Francis