{"thread":{"id":"58935","subject":"feature request: git clone --branch should accept commit hash","startedAt":"2022-12-12T16:14:06Z","lastAt":"2022-12-12T18:15:06Z","messageCount":4,"participants":["mark.yagnatinsky@barclays.com","Konstantin Ryabitsev"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"468898","messageId":"MN2PR12MB3616CCD1EDC3EB976CE32546F9E29@MN2PR12MB3616.namprd12.prod.outlook.com","threadId":"58935","inReplyTo":null,"subject":"feature request: git clone --branch should accept commit hash","fromName":"","fromEmail":"mark.yagnatinsky@barclays.com","sentAt":"2022-12-12T16:13:50Z","receivedAt":"2022-12-12T16:14:06Z","isPatch":false,"sender":{"key":"mark.yagnatinsky@barclays.com","avatar":null},"body":"git clone has a nice branch flag which can take a branch OR a tag; this is very handy for shallow clones.\nBut it seems that it does NOT take a commit hash.  This would be very useful for cases when the version you need is not tagged.\nAny chance this can be supported?\nThis message is for information purposes only. It is not a recommendation, advice, offer or solicitation to buy or sell a product or service, nor an official confirmation of any transaction. It is directed at persons who are professionals and is intended for the recipient(s) only. It is not directed at retail customers. This message is subject to the terms at: https://www.cib.barclays/disclosures/web-and-email-disclaimer.html. \n\nFor important disclosures, please see: https://www.cib.barclays/disclosures/sales-and-trading-disclaimer.html regarding marketing commentary from Barclays Sales and/or Trading desks, who are active market participants; https://www.cib.barclays/disclosures/barclays-global-markets-disclosures.html regarding our standard terms for Barclays Corporate and Investment Bank where we trade with you in principal-to-principal wholesale markets transactions; and in respect to Barclays Research, including disclosures relating to specific issuers, see: http://publicresearch.barclays.com.\n__________________________________________________________________________________ \nIf you are incorporated or operating in Australia, read these important disclosures: https://www.cib.barclays/disclosures/important-disclosures-asia-pacific.html.\n__________________________________________________________________________________\nFor more details about how we use personal information, see our privacy notice: https://www.cib.barclays/disclosures/personal-information-use.html. \n__________________________________________________________________________________\n"},{"id":"468905","messageId":"MN2PR12MB3616C1F2E97A18547740651DF9E29@MN2PR12MB3616.namprd12.prod.outlook.com","threadId":"58935","inReplyTo":"MN2PR12MB3616CCD1EDC3EB976CE32546F9E29@MN2PR12MB3616.namprd12.prod.outlook.com","subject":"RE: feature request: git clone --branch should accept commit hash","fromName":"","fromEmail":"mark.yagnatinsky@barclays.com","sentAt":"2022-12-12T16:44:49Z","receivedAt":"2022-12-12T16:46:15Z","isPatch":false,"sender":{"key":"mark.yagnatinsky@barclays.com","avatar":null},"body":"Never mind, I see, feature exists but server needs to allow it.  Sigh.\n\n-----Original Message-----\nFrom: Yagnatinsky, Mark : Markets Pre Trade \nSent: Monday, December 12, 2022 11:14 AM\nTo: git@vger.kernel.org\nSubject: feature request: git clone --branch should accept commit hash\n\ngit clone has a nice branch flag which can take a branch OR a tag; this is very handy for shallow clones.\nBut it seems that it does NOT take a commit hash.  This would be very useful for cases when the version you need is not tagged.\nAny chance this can be supported?\nThis message is for information purposes only. It is not a recommendation, advice, offer or solicitation to buy or sell a product or service, nor an official confirmation of any transaction. It is directed at persons who are professionals and is intended for the recipient(s) only. It is not directed at retail customers. This message is subject to the terms at: https://www.cib.barclays/disclosures/web-and-email-disclaimer.html. \n\nFor important disclosures, please see: https://www.cib.barclays/disclosures/sales-and-trading-disclaimer.html regarding marketing commentary from Barclays Sales and/or Trading desks, who are active market participants; https://www.cib.barclays/disclosures/barclays-global-markets-disclosures.html regarding our standard terms for Barclays Corporate and Investment Bank where we trade with you in principal-to-principal wholesale markets transactions; and in respect to Barclays Research, including disclosures relating to specific issuers, see: http://publicresearch.barclays.com.\n__________________________________________________________________________________ \nIf you are incorporated or operating in Australia, read these important disclosures: https://www.cib.barclays/disclosures/important-disclosures-asia-pacific.html.\n__________________________________________________________________________________\nFor more details about how we use personal information, see our privacy notice: https://www.cib.barclays/disclosures/personal-information-use.html. \n__________________________________________________________________________________\n"},{"id":"468907","messageId":"20221212170547.a23nyw6j7sco3n4b@meerkat.local","threadId":"58935","inReplyTo":"MN2PR12MB3616C1F2E97A18547740651DF9E29@MN2PR12MB3616.namprd12.prod.outlook.com","subject":"Re: feature request: git clone --branch should accept commit hash","fromName":"Konstantin Ryabitsev","fromEmail":"konstantin@linuxfoundation.org","sentAt":"2022-12-12T17:05:47Z","receivedAt":"2022-12-12T17:06:34Z","isPatch":false,"sender":{"key":"konstantin@linuxfoundation.org","avatar":"https://gravatar.com/avatar/7cb8827c6de56e1bd2dea16508c6708aa43feed3bf3813bcdacecdf96ceadd79?d=mp&s=160"},"body":"On Mon, Dec 12, 2022 at 04:44:49PM +0000, mark.yagnatinsky@barclays.com wrote:\n> Never mind, I see, feature exists but server needs to allow it.  Sigh.\n\nThere are good reasons for remote servers to not allow this by default.\nImagine the following scenario:\n\nRepo 1: officialrepo.git -- official project repository\nRepo 2: forkedrepo.git   -- a random fork by someone\n\nFrequently, these repositories will use a common object storage backend, which\nallows saving a LOT of space on the remote server. So, on the backend these\nrepositories will be organized as:\n\nRepo 0: sharedrepo.git\nRepo 1: officialrepo.git (with alternates to sharedrepo.git)\nRepo 2: forkedrepo.git   (with alternates to sharedrepo.git)\n\nSo, if a random developer pushes commit abcde into forkedrepo.git and the\nbackend server pulls that object into sharedrepo.git, you are now able to\n\"see\" commit abcde from officialrepo.git. It's just a \"loose object\" and if\nyou clone officialrepo.git, that object won't be in it, because it's not\nconnected to any of the heads or tags.\n\nThis situation is frequently abused for silly reasons like making it appear\nas if Linus committed something that he actually didn't:\n\nhttps://github.com/torvalds/linux/blob/ac632c504d0b881d7cfb44e3fdde3ec30eb548d9/Makefile#L6\n\nFor this reason, Github prints that big warning at the top to tell you that\nwhat you are viewing isn't actually part of linux.git.\n\nHowever, there's no way to print this warning if you issue \"git clone\", so if\nthis feature were to be allowed by default, it would make it easy for someone\nto trick you into cloning malicious commits by making it look like you're\ncloning an official repository.\n\nI go into it in some detail here:\nhttps://people.kernel.org/monsieuricon/cross-fork-object-sharing-in-git-is-not-a-bug\n\nBest regards,\nKonstantin\n"},{"id":"468914","messageId":"MN2PR12MB361678CE59236032FE6521F0F9E29@MN2PR12MB3616.namprd12.prod.outlook.com","threadId":"58935","inReplyTo":"20221212170547.a23nyw6j7sco3n4b@meerkat.local","subject":"RE: feature request: git clone --branch should accept commit hash","fromName":"","fromEmail":"mark.yagnatinsky@barclays.com","sentAt":"2022-12-12T18:10:52Z","receivedAt":"2022-12-12T18:15:06Z","isPatch":false,"sender":{"key":"mark.yagnatinsky@barclays.com","avatar":null},"body":"Still annoying though.  Ideally default should be to allow fetching any commit reachable from a branch or tag.  Seems that commit graphs already make this pretty fast?\n\n-----Original Message-----\nFrom: Konstantin Ryabitsev <konstantin@linuxfoundation.org> \nSent: Monday, December 12, 2022 12:06 PM\nTo: Yagnatinsky, Mark : Markets Pre Trade <mark.yagnatinsky@barclays.com>\nCc: git@vger.kernel.org\nSubject: Re: feature request: git clone --branch should accept commit hash\n\n\nCAUTION: This email originated from outside our organisation - konstantin@linuxfoundation.org Do not click on links, open attachments, or respond unless you recognize the sender and can validate the content is safe.\nOn Mon, Dec 12, 2022 at 04:44:49PM +0000, mark.yagnatinsky@barclays.com wrote:\n> Never mind, I see, feature exists but server needs to allow it.  Sigh.\n\nThere are good reasons for remote servers to not allow this by default.\nImagine the following scenario:\n\nRepo 1: officialrepo.git -- official project repository\nRepo 2: forkedrepo.git   -- a random fork by someone\n\nFrequently, these repositories will use a common object storage backend, which allows saving a LOT of space on the remote server. So, on the backend these repositories will be organized as:\n\nRepo 0: sharedrepo.git\nRepo 1: officialrepo.git (with alternates to sharedrepo.git)\nRepo 2: forkedrepo.git   (with alternates to sharedrepo.git)\n\nSo, if a random developer pushes commit abcde into forkedrepo.git and the backend server pulls that object into sharedrepo.git, you are now able to \"see\" commit abcde from officialrepo.git. It's just a \"loose object\" and if you clone officialrepo.git, that object won't be in it, because it's not connected to any of the heads or tags.\n\nThis situation is frequently abused for silly reasons like making it appear as if Linus committed something that he actually didn't:\n\nhttps://clicktime.symantec.com/15sLvRfRRhRgHZarrDPj3?h=w3w5bFP_4AI8QKPR8q947BcV4VIwZSjyrG0fvyy79kg=&u=https://github.com/torvalds/linux/blob/ac632c504d0b881d7cfb44e3fdde3ec30eb548d9/Makefile%23L6\n\nFor this reason, Github prints that big warning at the top to tell you that what you are viewing isn't actually part of linux.git.\n\nHowever, there's no way to print this warning if you issue \"git clone\", so if this feature were to be allowed by default, it would make it easy for someone to trick you into cloning malicious commits by making it look like you're cloning an official repository.\n\nI go into it in some detail here:\nhttps://clicktime.symantec.com/15sM1FrhtK7GhWQnPmnsf?h=9VLQcMVeC9X4IS0ge7Qa4ficEFudanLVd4MBBtCkVek=&u=https://people.kernel.org/monsieuricon/cross-fork-object-sharing-in-git-is-not-a-bug\n\nBest regards,\nKonstantin\n\nThis message is for information purposes only. It is not a recommendation, advice, offer or solicitation to buy or sell a product or service, nor an official confirmation of any transaction. It is directed at persons who are professionals and is intended for the recipient(s) only. It is not directed at retail customers. This message is subject to the terms at: https://www.cib.barclays/disclosures/web-and-email-disclaimer.html. \n\nFor important disclosures, please see: https://www.cib.barclays/disclosures/sales-and-trading-disclaimer.html regarding marketing commentary from Barclays Sales and/or Trading desks, who are active market participants; https://www.cib.barclays/disclosures/barclays-global-markets-disclosures.html regarding our standard terms for Barclays Corporate and Investment Bank where we trade with you in principal-to-principal wholesale markets transactions; and in respect to Barclays Research, including disclosures relating to specific issuers, see: http://publicresearch.barclays.com.\n__________________________________________________________________________________ \nIf you are incorporated or operating in Australia, read these important disclosures: https://www.cib.barclays/disclosures/important-disclosures-asia-pacific.html.\n__________________________________________________________________________________\nFor more details about how we use personal information, see our privacy notice: https://www.cib.barclays/disclosures/personal-information-use.html. \n__________________________________________________________________________________\n"}]}