{"thread":{"id":"66415","subject":"[RFC] Optional per-repository consent before running local hooks","startedAt":"2026-09-29T04:23:56Z","lastAt":"2026-09-29T21:32:37Z","messageCount":3,"participants":["Dmytro Lymarenko","Junio C Hamano","brian m. carlson"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"553537","messageId":"CAF1QGTmK=WY_AODsfETOtzOSuwpZ_4KV5SiNPoRv0SAYeJ7T5A@mail.gmail.com","threadId":"66415","inReplyTo":null,"subject":"[RFC] Optional per-repository consent before running local hooks","fromName":"Dmytro Lymarenko","fromEmail":"dmytro.lymarenko@gmail.com","sentAt":"2026-09-29T04:23:43Z","receivedAt":"2026-09-29T04:23:56Z","isPatch":false,"body":"I’d like to propose an optional safety setting for Git hooks. When\nenabled, Git would check for an active hook before running it in a\nrepository that the user has not approved. It would show the hook’s\npath and ask whether to run it once, trust the current hooks for this\nrepository, or decline.\nThis would help when a tool or setup step installs hooks from files\nsupplied by a project. The check should happen immediately before\nexecution, so it also covers hooks installed after a repository was\ncloned. For scripts inside the working tree, Git should ask again if\nthe approved script changes.\nThe default behavior could remain unchanged, with this protection\nenabled by an explicit user setting.\n"},{"id":"553624","messageId":"xmqqjyo3hq0y.fsf@gitster.g","threadId":"66415","inReplyTo":"CAF1QGTmK=WY_AODsfETOtzOSuwpZ_4KV5SiNPoRv0SAYeJ7T5A@mail.gmail.com","subject":"Re: [RFC] Optional per-repository consent before running local hooks","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2026-09-29T18:27:09Z","receivedAt":"2026-09-29T18:27:11Z","isPatch":false,"body":"Dmytro Lymarenko <dmytro.lymarenko@gmail.com> writes:\n\n> I’d like to propose an optional safety setting for Git hooks. When\n> enabled, Git would check for an active hook before running it in a\n> repository that the user has not approved. It would show the hook’s\n> path and ask whether to run it once, trust the current hooks for this\n> repository, or decline.\n> This would help when a tool or setup step installs hooks from files\n> supplied by a project. The check should happen immediately before\n> execution, so it also covers hooks installed after a repository was\n> cloned. For scripts inside the working tree, Git should ask again if\n> the approved script changes.\n> The default behavior could remain unchanged, with this protection\n> enabled by an explicit user setting.\n\nOne thing that immediately comes to mind is that, if the \"tool or\nsetup step\" is allowed to install hooks from files supplied by a\nproject, it is unclear what prevents it from also approving these\nhooks on the user's behalf (or, rather, leaving the same \"clue\" that\nyour proposed mechanism uses to record that the user approved\nexecution of these hooks).\n"},{"id":"553648","messageId":"arwubFmKkRcbbto3@fruit.crustytoothpaste.net","threadId":"66415","inReplyTo":"CAF1QGTmK=WY_AODsfETOtzOSuwpZ_4KV5SiNPoRv0SAYeJ7T5A@mail.gmail.com","subject":"Re: [RFC] Optional per-repository consent before running local hooks","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2026-09-29T21:32:28Z","receivedAt":"2026-09-29T21:32:37Z","isPatch":false,"body":"On 2026-09-29 at 04:23:43, Dmytro Lymarenko wrote:\n> I’d like to propose an optional safety setting for Git hooks. When\n> enabled, Git would check for an active hook before running it in a\n> repository that the user has not approved. It would show the hook’s\n> path and ask whether to run it once, trust the current hooks for this\n> repository, or decline.\n\nIn addition to what Junio said, we need to consider what happens if Git\noperates noninteractively.  For instance, a CI system or a Docker\ncontainer.\n\n> This would help when a tool or setup step installs hooks from files\n> supplied by a project. The check should happen immediately before\n> execution, so it also covers hooks installed after a repository was\n> cloned. For scripts inside the working tree, Git should ask again if\n> the approved script changes.\n\nI agree this is undesirable behaviour from a project and I typically\nconsider installing hooks or other external software from the repository\nwithout the user's consent to be malicious.  Installing hooks from\nthings like Git LFS I consider less of a problem because I have\ninstalled that software and configured it on my system, so I presumably\nwant that behaviour.\n\nThe problem also becomes where to store this information because Git\ndoesn't have any sort of data store to store per-user information other\nthan the config file and as Junio mentioned, if the repository can\ninstall hooks, it can also set config.\n\nWhat may be kind of equivalent is to set `core.hooksPath` to `/dev/null`\nin the global config and then choose to set it to `hooks` or\n`.git/hooks` in the local config if you want that.  Or you can do the\nreverse and use `core.hooksPath=/dev/null` in the local config for\npoorly behaved repositories.  Of course, the repo can override that, but\nif it does that, then I'd just report it as malicious to its hosting\nprovider.\n-- \nbrian m. carlson (they/them)\nToronto, Ontario, CA\n"}]}