Version Control for untrusted team

I've been tasked with the redesign of a rather complex system. In a couple weeks we should start hiring new developers, but it turns out my boss is worried about them stealing the source code and selling it to his competitors. At the same time, my request for the implementation of a DVCS has been approved (we are moving away from the shared folder, yay!), so I'm wondering how can I reconcile differences between both concepts, by allowing developers to upload code to the main branch while keeping them away from the core functionality.

Is there any straightforward way of doing this? GIT seems to have something similar with the filter-branch command, but I was really looking forward to use Bazaar... F开发者_JS百科rom what I've gathered, the best way seems to be creating branches for each part of the system. Can anyone suggest a better way?

---

If you need filter-branch equivalent you can use filter command from bzr-fastimport plugin. But this will break compatibility between your old history and new one, so this is not the best approach maybe.

---

You can do this via branching in mercurial (and git). There are front facing products on top of these DVCS's that make this permissioning easy (see Kiln, BitBucket, private GitHub repos)

But robert's comment about your problems are true... I'm worried about all the problems you are going to have if you don't trust devs that are committing source code to your repos. How will they even compile their dev environment if they can't get your code?

---

The better solution (IMHO) would be to expose the relevant binaries and create a consistent framework or API for extending the functionality of those binaries. The most you would have to expose to your untrusted sources would be the API layer which maintains hooks into the real code.

I actually think this is a really good question. Lots of people use contractors from outside their territory or country and its not unheard of for a contractor to steal code and go as far as to release a new (or counterfeit) product directly utilizing this code! VCS are meant to SHARE code though, so you need to think of other ways to restrict access.

Best of luck!