History-less repository?

[Kurt Granroth]

The development group I'm with is going to switch our repos from CVS to
*something* in the coming months.  The obvious successor is Subversion
(with Perforce as the dark horse) but I'm pushing hard for Mercurial.
It's been an uphill battle since a previous test run with darcs was a
complete failure... enough of one that the consensus of most of the
office is that "all DVCS == immature and hard to use".  "Geek toys" but
not suitable for normal (non-geeky Windows) developers.

I've made significant headway in changing those opinions but am now
stuck on an issue that caught me off guard.  That is, having the entire
history of the repository everywhere makes it "easier" to
catastrophically steal company IP (stolen laptops and the like).  With
CVS or Subversion, you "only" get the current snapshot of code and need
access to the central server plus the right authentication to get
history and branches and the like.  With Hg, it's all there.

I'm not convinced that that's as big of a deal as it's made out to be...
 but that remains as a legitimate worry so I *have* to address it.

What I want, then, is the ability to create an Hg repo that has no prior
history.  It must be able to merge back into the mainline, though.

Here's one thought I had:

1. Rsync over the source files at the beginning of a project release cycle
2. Create a brand new repo from just the source files
3. Code to your heart's content... the only history is the current patches
4. When it's time to merge with the mainline, use something like Tailor

Would that work?  Has anybody done anything like this?  And if so, is
there a better way?

Kurt

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 257 bytes
Desc: OpenPGP digital signature
URL: <http://lists.mercurial-scm.org/pipermail/mercurial/attachments/20080918/2d4ee9c5/attachment-0001.asc>