title: Gitolite permissions on branches
body: <p>I'm really at a loss here. I've read through quite a few examples, and tried all of them. The most basic ones work fine, but anytime I try to move to something a bit more complicated everything falls apart (even when I'm directly copying the example). Also, for the record I am on gitolite version 3 as shown by the server spam:</p>
  
  <pre><code>    this is gitolite@ubuntuserver running gitolite3 v3.1-2-g3eefc06 on git 1.7.9.5         
  </code></pre>
  
  <p>All this said what I am TRYING to accomplish is (I THINK) relatively simple. I have a group of junior developers [@scrubs], and I only want them to create and commit to new branches, and be able to read/pull master. That way I can review their code before it gets merged in. </p>
  
  <p>I have a group of senior developers [@vets] that I want to have free reign.</p>
  
  <p>My config file is as follows:</p>
  
  <pre><code>     @scrubs         = al ted matthew
       @vets           = kevin will guy
  
       @offlimitbranches = master$
  
       repo    gitolite-admin
               RW+     =   @vets matthew
  
       repo    dawebsite
               RW+                     =   @vets
               -   @offlimitbranches   =   @scrubs
               RW+                     =   @scrubs
               R   @offlimitbranches   =   @scrubs
               R                       =   daemon
               option deny-rules = 1
  
       dawebsite "Owner"               = "This is THE site"
  </code></pre>
  
  <p>I noticed nothing worked at all for denying till I added :</p>
  
  <pre><code>    option deny-rules = 1
  </code></pre>
  
  <p>of which I think I found in maybe one out of 20 examples (a touch of a rant forgive the frustration.</p>
  
  <p>With this current set up vets can do anything as expected.</p>
  
  <p>scrubs can neither pull or push to master (and I think that's because it grabs the first rule it can possible match?) Scrubs also can not pull or push to any non master branch, nor push newly created branches. Each attempt returns the same message "FATAL: [R/W] any dawebsite matthew DENIED by refs/heads/master$"</p>
  
  <p>I've tried using master, master$, @offlimitbranches and even refs/heads/master to no avail for the branch ref.</p>
  
  <p>If anyone can help shed some light on this for me I'd be quite appreciative. </p>
  
  <p>Update**</p>
  
  <p>Playing around with things I've noticed that if i remove matthew from the scrubs group and try to manipulate him directly with </p>
  
  <pre><code>    -       master$         =   matthew
      RW+                     =   matthew
  </code></pre>
  
  <p>if he moves to a new branch and tried the following: (thanks VonC for the heads up on the logs)</p>
  
  <pre><code>git pull origin newBranch
  git push origin newBranch
  </code></pre>
  
  <p>each returns an error</p>
  
  <p>PULL:</p>
  
  <pre><code>ARGV=matthew    SOC=git-upload-pack 'dawebsite.git'     FROM=172.24.1.198
  access(dawebsite, matthew, R, 'any'),-&gt; R any dawebsite matthew DENIED by refs/heads/master$
  trigger,Writable,access_1,ACCESS_1,dawebsite,matthew,R,any,R any dawebsite,matthew DENIED by refs/heads/master$
  R any dawebsite matthew DENIED by refs/heads/master$&lt;&lt;newline&gt;&gt;(or you mis-spelled the reponame)
  </code></pre>
  
  <p>PUSH:</p>
  
  <pre><code>ARGV=matthew    SOC=git-receive-pack 'dawebsite.git'    FROM=172.24.1.198
  access(dawebsite, matthew, W, 'any'),-&gt; W any medehrdev matthew DENIED by refs/heads/master$
  trigger,Writable,access_1,ACCESS_1,dawebsite,matthew,W,any,W any dawebsite matthew DENIED by refs/heads/master$
  W any dawebsite matthew DENIED by refs/heads/master$&lt;&lt;newline&gt;&gt;(or you mis-spelled the reponame)
  </code></pre>
  
  <p>It seems all my branches match against the ref master$ is that because they are all spawned off of master?</p>