Remotes can now be made read-only, by setting remote.<name>.annex-readonly

Assistant/Sync.hs

@@ -123,7 +123,8 @@ reconnectRemotes notifypushes rs = void $ do
 pushToRemotes :: Bool -> [Remote] -> Assistant [Remote]
 pushToRemotes notifypushes remotes = do
 	now <- liftIO getCurrentTime
-	syncAction remotes (pushToRemotes' now notifypushes)
+	let remotes' = filter (not . remoteAnnexReadOnly . Remote.gitconfig) remotes
+	syncAction remotes' (pushToRemotes' now notifypushes)
 pushToRemotes' :: UTCTime -> Bool -> [Remote] -> Assistant [Remote]
 pushToRemotes' now notifypushes remotes = do
 	(g, branch, u) <- liftAnnex $ do

Command/Sync.hs

@@ -203,7 +203,9 @@ pushRemote :: Remote -> Maybe Git.Ref -> CommandStart
 pushRemote _remote Nothing = stop
 pushRemote remote (Just branch) = go =<< needpush
   where
-	needpush = anyM (newer remote) [syncBranch branch, Annex.Branch.name]
+	needpush
+		| remoteAnnexReadOnly (Types.Remote.gitconfig remote) = return False
+		| otherwise = anyM (newer remote) [syncBranch branch, Annex.Branch.name]
 	go False = stop
 	go True = do
 		showStart "push" (Remote.name remote)

Remote/Helper/ReadOnly.hs

@@ -0,0 +1,29 @@
+{- Adds readonly support to remotes.
+ -
+ - Copyright 2013 Joey Hess <joey@kitenet.net>
+ -
+ - Licensed under the GNU GPL version 3 or higher.
+ -}
+
+module Remote.Helper.ReadOnly (adjustReadOnly) where
+
+import Common.Annex
+import Types.Remote
+
+{- Adds support for read-only remotes, by replacing the
+ - methods that write to a remote with dummies that fail.
+ -
+ - Note that disabling git pushes to remotes is not handled here.
+ -}
+adjustReadOnly :: Remote -> Remote
+adjustReadOnly r
+	| remoteAnnexReadOnly (gitconfig r) = r
+		{ storeKey = \_ _ _ -> failbool
+		, removeKey = \_ -> failbool
+		, repairRepo = Nothing
+		}
+	| otherwise = r
+  where
+	failbool = do
+		warning "this remote is readonly"
+		return False

Remote/List.hs

@@ -18,6 +18,7 @@ import Types.Remote
 import Types.GitConfig
 import Annex.UUID
 import Remote.Helper.Hooks
+import Remote.Helper.ReadOnly
 import qualified Git
 import qualified Git.Config
 
@@ -89,7 +90,7 @@ remoteGen m t r = do
 	let gc = extractRemoteGitConfig g (Git.repoDescribe r)
 	let c = fromMaybe M.empty $ M.lookup u m
 	mrmt <- generate t r u c gc
-	return $ addHooks <$> mrmt
+	return $ adjustReadOnly . addHooks <$> mrmt
 
 {- Updates a local git Remote, re-reading its git config. -}
 updateRemote :: Remote -> Annex (Maybe Remote)

Types/GitConfig.hs

@@ -97,6 +97,7 @@ data RemoteGitConfig = RemoteGitConfig
 	, remoteAnnexCostCommand :: Maybe String
 	, remoteAnnexIgnore :: Bool
 	, remoteAnnexSync :: Bool
+	, remoteAnnexReadOnly :: Bool
 	, remoteAnnexTrustLevel :: Maybe String
 	, remoteAnnexStartCommand :: Maybe String
 	, remoteAnnexStopCommand :: Maybe String
@@ -124,6 +125,7 @@ extractRemoteGitConfig r remotename = RemoteGitConfig
 	, remoteAnnexCostCommand = notempty $ getmaybe "cost-command"
 	, remoteAnnexIgnore = getbool "ignore" False
 	, remoteAnnexSync = getbool "sync" True
+	, remoteAnnexReadOnly = getbool "readonly" False
 	, remoteAnnexTrustLevel = notempty $ getmaybe "trustlevel"
 	, remoteAnnexStartCommand = notempty $ getmaybe "start-command"
 	, remoteAnnexStopCommand = notempty $ getmaybe "stop-command"

debian/changelog

@@ -9,6 +9,7 @@ git-annex (5.20131231) UNRELEASED; urgency=medium
   * Avoid looping if long-running git cat-file or git hash-object crashes
     and keeps crashing when restarted.
   * Assistant: Remove stale MERGE_HEAD files in lockfile cleanup.
+  * Remotes can now be made read-only, by setting remote.<name>.annex-readonly
 
  -- Joey Hess <joeyh@debian.org>  Tue, 31 Dec 2013 13:41:18 -0400
 

doc/git-annex.mdwn

@@ -1275,6 +1275,12 @@ Here are all the supported configuration settings.
   If set to `false`, prevents git-annex sync (and the git-annex assistant)
   from syncing with this remote.
 
+* `remote.<name>.annex-readonly`
+
+  If set to `true`, prevents git-annex from making changes to a remote.
+  This both prevents git-annex sync from pushing changes, and prevents
+  storing or removing files from read-only remote.
+
 * `remote.<name>.annexUrl`
 
   Can be used to specify a different url than the regular `remote.<name>.url`