{"thread":{"id":"47449","subject":"Git Hooks","startedAt":"2017-12-15T19:12:48Z","lastAt":"2017-12-19T13:55:39Z","messageCount":5,"participants":["Satyakiran Duggina","Bryan Turner","Jeff King","Ævar Arnfjörð Bjarmason"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"334902","messageId":"CAMZug24WGWS3TaNPOVWPufGZ+67EbLggr4W3pxJtis9X375mag@mail.gmail.com","threadId":"47449","inReplyTo":null,"subject":"Git Hooks","fromName":"Satyakiran Duggina","fromEmail":"satya0521@gmail.com","sentAt":"2017-12-15T19:12:42Z","receivedAt":"2017-12-15T19:12:48Z","isPatch":false,"sender":{"key":"satya0521@gmail.com","avatar":null},"body":"I see that `git init` creates a .git directory and hooks are to be\nplaced in that directory and these hooks are not tracked by version\ncontrol. To achieve tracked hooks, either each developer has to copy\nthe hooks or use tools like overcommit, pre-commit, husky etc.\n\nI'm wondering why hooks are not made external like .gitignore. I guess\nit would be better to have two git configuration directories in a\nrepo, one hosting all the metadata managed by git and the other with\nuser configured data (hooks, ignore/exclude, repo config etc).\n\nKindly let me know why the current design choice is made and if the\nproposed change would introduce unseen issues.\n\n\nThanks,\nSatya\n"},{"id":"334904","messageId":"CAGyf7-F8cCprvK-e2S0kO0Wo+6n4m_gigpSQjCjSj-dhozMsMw@mail.gmail.com","threadId":"47449","inReplyTo":"CAMZug24WGWS3TaNPOVWPufGZ+67EbLggr4W3pxJtis9X375mag@mail.gmail.com","subject":"Re: Git Hooks","fromName":"Bryan Turner","fromEmail":"bturner@atlassian.com","sentAt":"2017-12-15T19:23:16Z","receivedAt":"2017-12-15T19:23:24Z","isPatch":false,"sender":{"key":"bturner@atlassian.com","avatar":"https://gravatar.com/avatar/16bcf3167981c1ef7c804e502642366d888a35b0d0b0a4ca01fdc442aa1acb1e?d=mp&s=160"},"body":"On Fri, Dec 15, 2017 at 11:12 AM, Satyakiran Duggina\n wrote:\n> I see that `git init` creates a .git directory and hooks are to be\n> placed in that directory and these hooks are not tracked by version\n> control. To achieve tracked hooks, either each developer has to copy\n> the hooks or use tools like overcommit, pre-commit, husky etc.\n>\n> I'm wondering why hooks are not made external like .gitignore. I guess\n> it would be better to have two git configuration directories in a\n> repo, one hosting all the metadata managed by git and the other with\n> user configured data (hooks, ignore/exclude, repo config etc).\n\nHooks are not external because they're not trusted. It essentially\namounts to allowing someone to download an arbitrary script or program\nonto your computer which you then execute. It's extremely unsafe, and\nis intentionally not possible. To get hooks in your instance, you have\nto _manually_ install them. This gives you a chance to _review_ them\nbefore they start executing on your system. Any other approach and the\nhooks become an attack vector.\n\n>\n> Kindly let me know why the current design choice is made and if the\n> proposed change would introduce unseen issues.\n>\n>\n> Thanks,\n> Satya\n\nHope this helps!\nBryan Turner\n"},{"id":"334909","messageId":"CAMZug26A0e=AunMOjZNC_xH2E5uqHe46mt6=jawWe7ozF=Jn0Q@mail.gmail.com","threadId":"47449","inReplyTo":"CAGyf7-F8cCprvK-e2S0kO0Wo+6n4m_gigpSQjCjSj-dhozMsMw@mail.gmail.com","subject":"Re: Git Hooks","fromName":"Satyakiran Duggina","fromEmail":"satya0521@gmail.com","sentAt":"2017-12-15T20:48:07Z","receivedAt":"2017-12-15T20:48:14Z","isPatch":false,"sender":{"key":"satya0521@gmail.com","avatar":null},"body":"Thanks, Bryan.\n\nTo give the code pullers a chance to review, can we not have a\n`trusted-hooks: default` and `trusted-SHA: ` field in .git/.\nI'm assuming githooks/ are source tracked here.\n\nWhen developer tries to execute `git commit`, git can ask developer to\nchange `trusted-hooks` field to true or false. Let's say developer\nsets it to true, git can record the SHA. If any latest pull has the\nhooks changed, git can revert the `trusted-hook` to default.\n\nThis way there is not much hassle for developers to manually copy\nhooks all the time. And at the same time, they are not running scripts\nthat they haven't reviewed.\n\nWill this work?\n\n\n\nOn Fri, Dec 15, 2017 at 11:23 AM, Bryan Turner wrote:\n> On Fri, Dec 15, 2017 at 11:12 AM, Satyakiran Duggina\n> wrote:\n>> I see that `git init` creates a .git directory and hooks are to be\n>> placed in that directory and these hooks are not tracked by version\n>> control. To achieve tracked hooks, either each developer has to copy\n>> the hooks or use tools like overcommit, pre-commit, husky etc.\n>>\n>> I'm wondering why hooks are not made external like .gitignore. I guess\n>> it would be better to have two git configuration directories in a\n>> repo, one hosting all the metadata managed by git and the other with\n>> user configured data (hooks, ignore/exclude, repo config etc).\n>\n> Hooks are not external because they're not trusted. It essentially\n> amounts to allowing someone to download an arbitrary script or program\n> onto your computer which you then execute. It's extremely unsafe, and\n> is intentionally not possible. To get hooks in your instance, you have\n> to _manually_ install them. This gives you a chance to _review_ them\n> before they start executing on your system. Any other approach and the\n> hooks become an attack vector.\n>\n>>\n>> Kindly let me know why the current design choice is made and if the\n>> proposed change would introduce unseen issues.\n>>\n>>\n>> Thanks,\n>> Satya\n>\n> Hope this helps!\n> Bryan Turner\n\n\n\n-- \nRegards & Thanks\nSatya Kiran Duggina\n"},{"id":"334923","messageId":"20171216095357.GB32706@sigill.intra.peff.net","threadId":"47449","inReplyTo":"CAMZug26A0e=AunMOjZNC_xH2E5uqHe46mt6=jawWe7ozF=Jn0Q@mail.gmail.com","subject":"Re: Git Hooks","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2017-12-16T09:53:58Z","receivedAt":"2017-12-16T09:54:08Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Fri, Dec 15, 2017 at 12:48:07PM -0800, Satyakiran Duggina wrote:\n\n> To give the code pullers a chance to review, can we not have a\n> `trusted-hooks: default` and `trusted-SHA: ` field in .git/.\n> I'm assuming githooks/ are source tracked here.\n> \n> When developer tries to execute `git commit`, git can ask developer to\n> change `trusted-hooks` field to true or false. Let's say developer\n> sets it to true, git can record the SHA. If any latest pull has the\n> hooks changed, git can revert the `trusted-hook` to default.\n> \n> This way there is not much hassle for developers to manually copy\n> hooks all the time. And at the same time, they are not running scripts\n> that they haven't reviewed.\n\nWe've talked about doing something like this (though more for config\nthan for hooks). But what the discussion always come down to is that\ncarrying a script like \"import-hooks.sh\" in the repository ends up being\nthe exact same amount of work for the developer as any git-blessed \"OK,\ntrust these hooks\" command.\n\nAnd it's a lot more flexible. The writer of that script can touch hooks,\nconfig, etc. They can base decisions about what values to use based on\ndata that Git otherwise wouldn't care about (e.g., uname). And they only\nhave to handle cases that the project cares about, whereas anything Git\ndoes has to work everywhere.\n\n-Peff\n"},{"id":"335019","messageId":"87zi6eakkt.fsf@evledraar.gmail.com","threadId":"47449","inReplyTo":"20171216095357.GB32706@sigill.intra.peff.net","subject":"Allowing remote git repos to set config & hook configuration","fromName":"Ævar Arnfjörð Bjarmason","fromEmail":"avarab@gmail.com","sentAt":"2017-12-19T13:55:30Z","receivedAt":"2017-12-19T13:55:39Z","isPatch":false,"sender":{"key":"avarab@gmail.com","avatar":"https://avatars.githubusercontent.com/u/45301?v=4"},"body":"\nOn Sat, Dec 16 2017, Jeff King jotted:\n\n> On Fri, Dec 15, 2017 at 12:48:07PM -0800, Satyakiran Duggina wrote:\n>\n>> To give the code pullers a chance to review, can we not have a\n>> `trusted-hooks: default` and `trusted-SHA: ` field in .git/.\n>> I'm assuming githooks/ are source tracked here.\n>>\n>> When developer tries to execute `git commit`, git can ask developer to\n>> change `trusted-hooks` field to true or false. Let's say developer\n>> sets it to true, git can record the SHA. If any latest pull has the\n>> hooks changed, git can revert the `trusted-hook` to default.\n>>\n>> This way there is not much hassle for developers to manually copy\n>> hooks all the time. And at the same time, they are not running scripts\n>> that they haven't reviewed.\n>\n> We've talked about doing something like this (though more for config\n> than for hooks). But what the discussion always come down to is that\n> carrying a script like \"import-hooks.sh\" in the repository ends up being\n> the exact same amount of work for the developer as any git-blessed \"OK,\n> trust these hooks\" command.\n>\n> And it's a lot more flexible. The writer of that script can touch hooks,\n> config, etc. They can base decisions about what values to use based on\n> data that Git otherwise wouldn't care about (e.g., uname). And they only\n> have to handle cases that the project cares about, whereas anything Git\n> does has to work everywhere.\n\nI brought this up at the dev meeting we had in NYC (and you can see how\nmuch I care since it's not implemented): It would be really neat to have\na system supported in git which would work the same way Emacs treats\nsafe file variables:\nhttps://www.gnu.org/software/emacs/manual/html_node/emacs/Safe-File-Variables.html#Safe-File-Variables\n\nI.e. git would recognize a .gitconfig and .githooks/* shipped in any\nrepo, but completely ignore those by default, but you could then set\nconfig (in .git/config or ~/.gitconfig etc) which would whitelist\ncertain types of config brought in from the repo.\n\nThis is how Emacs does it and it strikes a really good balance between\nsecurity and convenience, e.g. I can say a file is allowed to tweak my\ntab width settings, but can't alter my load path, or is allowed to\nspecify a syntax highlighting mode etc.\n\nSo you could for example say that any repo you clone is allowed to alter\nthe value of sendemail.to, or the value of tag.sort. It would work\nreally well with includeIf, e.g. I could clone all my work repos to a\n\"safe\" area in ~/work which is allowed to set more options,\ne.g. aliases.\n\nOther values would either be ignored, or you could set them to \"ask\", so\nfor example, when we clone a bunch of config would be accepted because\nyou'd said it was OK for any repo, and then client would ask you if you\nwanted to setup a hook the repo is suggesting.\n\nThis would be a much better user experience than every repo that needs\nthis suggesting in a README that you should run some local shellscript,\nand would strike a good balance between security and convenience since\nwe'd ignore all of this by default, with the user needing to granularly\nopt-in.\n"}]}