BlackGit addresses the pain of huge mono-repos (especially with many binaries) and the need for per-file permissions by splitting functionality into a client and an optional proxy server. The client, git-black, is a thin Python wrapper around stock git that initializes repositories as partial clones (blob:none) and uses a restrictive sparse-checkout so the worktree contains only files a user explicitly "follows." Users can add/remove "cared" files, fetch commits with minimal tree filters, lock files locally, and use a small agent for natural-language control. The approach avoids LFS and avoids downloading full blob history, materializing blobs on demand.
The server is a smart-HTTP proxy/cache (Netty + JGit) that enforces path-level blob authorization via a blackw-authz file in SVN authz format: commits and trees remain visible but blobs outside a user’s granted path prefixes are refused on the wire. Authentication uses HTTP Basic (username decoded for decisions while the raw header is forwarded upstream), writes require explicit w grants, and server-side file locks block pushes that touch locked files. The server can lazily backfill single blob SHAs from the upstream origin. Client installs via pip, server via Docker or jar; Git 2.54+ is required and the client works against any smart-HTTP remote.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.