Read-only Git Repositories

Hi,

I use Keybase's encrypted repositories to manage dotfile configurations.

I would like a way to provide read-only access to some repositories on a per-machine basis because presently it seems any machine can push to the repo, meaning that if my most insecure machine gets compromised then it compromises every machine that uses the same dotfiles, if I pull from origin before noticing some changes were not mine.

As much overhead as it would be to maintain it, I would also just settle for per-user permissions in team repositories. IMO that is broken right now, team permissions are a must and it seems any team member can push to master.

Start by reviewing how Keybase encrypted repositories currently authorize pulls and pushes, then compare the per-machine read-only and per-user team permission requirements in the issue. Done would mean a defined, implemented permission model that prevents unauthorized pushes while preserving permitted repository access.

Written by the indexing model from the issue text.