Mercurial Acl Extension deny pull of some files

Question

I'm new mercurial user. I setup the acl extension adding this into my hgrc file:

[hooks]
pretxnchangegroup.acl = python:hgext.acl.hook

[acl]
sources = serve pull push

[acl.deny]
** = mercurial

So with this code above I deny access to all files to user "mercurial". I successfully tested the acl extension and it works perfectly when I try to push to my central repository on which I put the code above. As expected I receive message that the access for the user "mercurial" is denied.

Now the problem is when I'm start pulling from central repository I don't have any restriction so I can pull anything without any restriction. What I want is to deny pull access for some files like I can do when I tried push comand. Is there any way I can do this?

Answer 1

Mercurial, unlike Subversion, doesn't allow controls on individual files, and for good reason. The DVCS model puts the entire repo on every developer's machine, so even if you restrict files on push and pull, the user could still just hg cat the file to get its contents.

Instead of trying to do this on the client side, I would instead break your repos based on who needs what and set permissions to individual repos. See my answer on the Kiln stack exchange Should I use more than one repository?. You can set permissions via http(s) or SSH, or if you happen to be using Kiln, through our permissions interface.

Answer 2

I have a solution:

convert your repo to git:

https://git.wiki.kernel.org/index.php/Interfaces,_frontends,_and_tools#Mercurial

Answer 3

As came out in the comments with tghw, it sounds like what you really want is partial cloning by filepath, so that a person can clone or pull down only certain files or directories, but that's not possible in Mercurial (or git). That's the case because every revision is identified by a unique hash that includes, among other things, the hash of all the file changes. If you don't have all the files, you don't have all the changes, and you can't verify the hash.

If you really need to hide read access for some files from some people you'll need to split them up into separate repositories.