[PATCH] allow negative lookaround in refexes

[Irfan Adilovic]

This simply adds '!' to REPOPATT_PATT and enables refexes like this:

RW+ refs/heads/(?!(master$|dev-\d)) = @devs
---
src/lib/Gitolite/Rc.pm | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/lib/Gitolite/Rc.pm b/src/lib/Gitolite/Rc.pm
index a1e9271..700ece9 100644
--- a/src/lib/Gitolite/Rc.pm
+++ b/src/lib/Gitolite/Rc.pm
@@ -49,7 +49,7 @@ $rc{LOG_TEMPLATE} = "$ENV{HOME}/.gitolite/logs/gitolite-%y-%m.log";
$REMOTE_COMMAND_PATT = qr(^[-0-9a-zA-Z._\@/+ :,\%=]*$);
$REF_OR_FILENAME_PATT = qr(^[0-9a-zA-Z][-0-9a-zA-Z._\@/+ :,]*$);
$REPONAME_PATT = qr(^\@?[0-9a-zA-Z][-0-9a-zA-Z._\@/+]*$);
-$REPOPATT_PATT = qr(^\@?[[0-9a-zA-Z][-0-9a-zA-Z._\@/+\\^$|()[\]*?{},]*$);
+$REPOPATT_PATT = qr(^\@?[[0-9a-zA-Z][-0-9a-zA-Z._\@/+\\^$|()[\]*?!{},]*$);
$USERNAME_PATT = qr(^\@?[0-9a-zA-Z][-0-9a-zA-Z._\@+]*$);

$UNSAFE_PATT = qr([`~#\$\&()|;<>]);
--
2.51.0

[Sitaram Chamarty]

On Thu, Sep 24, 2026 at 05:35:11PM +0200, Irfan Adilovic wrote:
> This simply adds '!' to REPOPATT_PATT and enables refexes like this:
>
> RW+ refs/heads/(?!(master$|dev-\d)) = @devs

I'm reluctant to take this change. It's core code, and the
regexes have been carefully vetted.

More importantly, this:

# the order is important; deny rules first
- refs/heads/master = @devs
- refs/heads/dev-\d = @devs
RW+ refs/heads/ = @devs

would be much clearer and achieve the same purpose, not sure if
you've tried it. You'll thank me if you ever have to pass on
routine admin duties to someone who's not as familiar with
regexes as you and I are :-)

Sorry!

Sitaram

> ---
> src/lib/Gitolite/Rc.pm | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/src/lib/Gitolite/Rc.pm b/src/lib/Gitolite/Rc.pm
> index a1e9271..700ece9 100644
> --- a/src/lib/Gitolite/Rc.pm
> +++ b/src/lib/Gitolite/Rc.pm
> @@ -49,7 +49,7 @@ $rc{LOG_TEMPLATE} = "$ENV{HOME}/.gitolite/logs/gitolite-%y-%m.log";
> $REMOTE_COMMAND_PATT = qr(^[-0-9a-zA-Z._\@/+ :,\%=]*$);
> $REF_OR_FILENAME_PATT = qr(^[0-9a-zA-Z][-0-9a-zA-Z._\@/+ :,]*$);
> $REPONAME_PATT = qr(^\@?[0-9a-zA-Z][-0-9a-zA-Z._\@/+]*$);
> -$REPOPATT_PATT = qr(^\@?[[0-9a-zA-Z][-0-9a-zA-Z._\@/+\\^$|()[\]*?{},]*$);
> +$REPOPATT_PATT = qr(^\@?[[0-9a-zA-Z][-0-9a-zA-Z._\@/+\\^$|()[\]*?!{},]*$);
> $USERNAME_PATT = qr(^\@?[0-9a-zA-Z][-0-9a-zA-Z._\@+]*$);
>
> $UNSAFE_PATT = qr([`~#\$\&()|;<>]);
> --
> 2.51.0
>

> --
> You received this message because you are subscribed to the Google Groups "gitolite" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to gitolite+u...@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/gitolite/20260924153511.2339-1-irfanadilovic%40gmail.com.

[Irfan Adilovic]

On Thu, 24 Sept 2026 at 17:47, Sitaram Chamarty <sita...@gmail.com> wrote:
>
> On Thu, Sep 24, 2026 at 05:35:11PM +0200, Irfan Adilovic wrote:
> > This simply adds '!' to REPOPATT_PATT and enables refexes like this:
> >
> > RW+ refs/heads/(?!(master$|dev-\d)) = @devs
>
> I'm reluctant to take this change. It's core code, and the
> regexes have been carefully vetted.

I don't intend to start arguing here :-) but I'll mention this: The
only place `!` is treated specially in the entire perlre is in
negative lookaround assertions: (?!...) and (?<!...). (I.o.w. there's
not much vetting to do for it)

> More importantly, this:
>
> # the order is important; deny rules first
> - refs/heads/master = @devs
> - refs/heads/dev-\d = @devs
> RW+ refs/heads/ = @devs
>
> would be much clearer and achieve the same purpose, not sure if
> you've tried it. You'll thank me if you ever have to pass on
> routine admin duties to someone who's not as familiar with
> regexes as you and I are :-)

I understand, I prefer to have flexibility -- you prefer to enforce
readability -- that's fine, we can leave it at that.

Side note for anyone else who comes across this: `RW refs/heads/ =
@devs` is mandatory before the `-` lines if only destructive
operations are to be denied on those branches (this is what I wanted).

Irfan

[Sitaram Chamarty]

On Thu, Sep 24, 2026 at 06:19:22PM +0200, Irfan Adilovic wrote:

> I understand, I prefer to have flexibility -- you prefer to enforce
> readability -- that's fine, we can leave it at that.

Reaadability was not the main point, that was just me trying to
be nice about rejecting the patch with a bit of humour.

The main point is not to make unnecessary changed, when there
are already documented ways to achieve the same thing.

> Side note for anyone else who comes across this: `RW refs/heads/ =
> @devs` is mandatory before the `-` lines if only destructive
> operations are to be denied on those branches (this is what I wanted).

You would have needed that even in your version, so I didn't
mention it.