tree 89db22d1f3515887b006949b92fff50bf107c5e0
parent 3150aec5f6a081ddade7874becf1d7e526c48ddd
author Ankur <ataly@google.com> 1423770731 -0800
committer Ankur <ataly@google.com> 1423770736 -0800

"core": Get rid of prefix-matching on BlessingPatterns

Martin Abadi (@abadi) recently made a very convincing argument
that default prefix matching on BlessingPatterns leads
to surprising (and undesirable) properties on semantics of
'Deny' clauses and groups in ACLS.

The argument can be found here:
https://docs.google.com/a/google.com/document/d/1pvENXMkfKHMok1GNU8dy6jPPACzsJ9EjVyG642Pk1CI/edit

This CL gets rid of prefix-matching on BlessingPatterns
and fixes all relevant tests in the core repo. Fixes for other repos
will follow soon.

After this CL, a pattern "a/b/c" wil only be matched by
"a/b/c", "a/b/c/x", "a/b/c/y", "a/b/c/x/y", etc., and a
pattern "a/b/c/$" will only be matched by "a/b/c".

Change-Id: I8bbfe77479283a1b8cf6fd2cd8391e6aa8e2c2c9