Mercurial deny clone/pull?

I'm currently developing a Python Fabric script that contains some sensitive information. I would like to put this in a repository for a certain few users to access.

I've put this in my hgrc file:

[web]
allowpull = false
allow_read = user1, user2
allow_push开发者_如何学编程 = user1

My problem is that I only want user1 to be able to clone and pull? Just to test I added the allowpull command which seems to be ignored?

---

Well, basically with read access, it is hard to deny clone and pull. If you want this granularity, try the ACL extension.

---

If you are restricting access to https, then you could try using RhodeCode. See https://bitbucket.org/marcinkuzminski/rhodecode/.