Question

So I’ve been working on a rather large project and using PlasticSCM as by VCS. I use it with a DVCS model, but so far it’s pretty much just been me sync’ing between my office machine and home.

Now we’re getting other people involved in the project, and what I would like to do is restrict the other developers to specific branches so that only I can merge branches into /main.

So I went to my local repository, and I made the permissions changes (that part’s pretty straight forward). But now how does that work with the other developers? When they sync up, are the permissions replicated on their local repositories? If they attempted to merge into /main on their local repository, does it allow that, and then they get an error when they attempt to push the changes to my repository?

This is my first foray into DVCS so I’m not quite sure how this kind of thing works.

Answer 1

Classic DVCS (Mercurial, Git) don’t include ACL, meaning a clone wouldn’t keep any ACL restriction.
This is usually maintain through hook on the original repo (meaning you might be able to modify the wrong branch on a cloned repo, but you wouldn’t be able to push back to the original repo).

As the security page mentions, this isn’t the case for PlasticSCM, and a clone should retain the ACL (caveat below) set on an object, which will inherit said ACL through two realms: the file system hierarchy (directory, subdirectories, files) and the repository object hierarchy:

The caveat in a DVCS settings is that there must be a mechanism in place to translate users and groups from one site to another.

The Plastic replication system supports three different translation modes:

• Copy mode: it is the default behaviour. The security IDs are just copied between repositories on replication. It is only valid when the servers hosting the different repositories involved work in the same authentication mode.
• Name mode: translation between security identifiers is done based on name. In the sample at Figure above suppose user daniel has to be translated by name from repA to repB. At repB the Plastic server will try to locate a user with name daniel and will introduce its LDAP SID into the table if required.
• Translation table: it also performs a translation based on name, but driven by a table. The table, specified by the user, tells the destination server how to match names: it tells how a source user or group name has to be converted into a destination name. Figure below explains how a translation table is built and how it can translate between different authentication modes.

Note: a translation table is just a plain text file with two names per line separated by a semi-colon “;”. The first name indicates the user or group to be translated (source) and the one on the right the destination one.