Gustavo Leite de Mendonça Chaves > Git-Hooks-0.046 > Git::Hooks::CheckAcls



Annotate this POD



Open  1
View/Report Bugs
Module Version: 0.046   Source   Latest Release: Git-Hooks-0.047


Git::Hooks::CheckAcls - Git::Hooks plugin for branch/tag access control.


version 0.046


This Git::Hooks plugin hooks itself to the hooks below to guarantee that only allowed users can push commits and tags to specific branches.

To enable it you should add it to the githooks.plugin configuration option:

    git config --add githooks.plugin CheckAcls


Git::Hooks::CheckAcls - Git::Hooks plugin for branch/tag access control.


The plugin is configured by the following git options.

githooks.checkacls.userenv STRING

This variable is deprecated. Please, use the githooks.userenv variable, which is defined in the Git::Hooks module. Please, see its documentation to understand it.

githooks.checkacls.admin USERSPEC

This variable is deprecated. Please, use the githooks.admin variable, which is defined in the Git::Hooks module. Please, see its documentation to understand it.

githooks.checkacls.acl ACL

The authorization specification for a repository is defined by the set of ACLs defined by this option. Each ACL specify 'who' has 'what' kind of access to which refs, by means of a string with three components separated by spaces:

    who what refs

By default, nobody has access to anything, except the above-specified admins. During an update, all the ACLs are processed in the order defined by the git config --list command. The first ACL matching the authenticated username and the affected reference name (usually a branch) defines what operations are allowed. If no ACL matches username and reference name, then the operation is denied.

The 'who' component specifies to which users this ACL gives access. It can be specified in the same three ways as was explained to the CheckAcls.admin option above.

The 'what' component specifies what kind of access to allow. It's specified as a string of one or more of the following opcodes:

You may specify that the user has no access whatsoever to the references by using a single hyphen (-) as the what component.

The 'refs' component specifies which refs this ACL applies to. It can be specified in one of these formats:

The ACL specification can embed strings in the format {VAR}. These strings are substituted by the corresponding environment's variable VAR value. This interpolation occurs before the components are split and processed.

This is useful, for instance, if you want developers to be restricted in what they can do to official branches but to have complete control with their own branch namespace.

    git config CheckAcls.acl '^. CRUD ^refs/heads/{USER}/'
    git config CheckAcls.acl '^. U    ^refs/heads'

In this example, every user (^.) has complete control (CRUD) to the branches below "refs/heads/{USER}". Supposing the environment variable USER contains the user's login name during a "pre-receive" hook. For all other branches (^refs/heads) the users have only update (U) rights.


This module exports two routines that can be used directly without using all of Git::Hooks infrastructure.

check_affected_refs GIT

This is the routine used to implement the update and the pre-receive hooks. It needs a Git::More object.


This script is heavily inspired (and, in some places, derived) from the update-paranoid example hook which comes with the Git distribution.


Gustavo L. de M. Chaves <>


This software is copyright (c) 2013 by CPqD <>.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.

syntax highlighting: