git/list[1] front-page[2] threads[3] people[4] search[5] about
 

RE: [Best Practices Request] clean/smudge configuration

From
Randall S. Becker <rsbecker@nexbridge.com>
Date
May 11, 2018, 19:25 UTC
Message-ID
<001601d3e95d$d76272a0$862757e0$@nexbridge.com>
In-Reply-To
<xmqq7eobhqpi.fsf@gitster-ct.c.googlers.com>
On May 10, 2018 10:27 PM, Junio C Hamano wrote:
Show 22 quoted lines
> "Randall S. Becker" <rsbecker@nexbridge.com> writes:
> 
> > What if we create a ../.gitconfig like ../.gitattributes, that is
> > loaded before .git/config?
> 
> You should not forget one of the two reasons why clean/smudge/diff etc.
> drivers must be given with a step of redirection, split between attributes and
> config.  "This path holds text from ancient macs" at the logical level may be
> expressed in .gitattributes, and then "when checking out text from ancient
> macs, process the blob data with this program to turn it into a form suitable
> for working tree" is given as a smudge filter program, that is (1) suitable for
> the platform _you_ as the writer of the config file is using *AND* (2)
> something you are confortable running on behalf of you.
> 
> We *deliberately* lack a mechanism to pay attention to in-tree config that
> gets propagated to those who get them via "git clone", exactly because
> otherwise your upstream may not just specify a "smudge" program that your
> platform would be unable to run, but can specify a "smudge" program that
> pretends to be a smudger, but is actually a program that installs a keylogger
> and posts your login password and bank details to this mailing list ;-)
> 
> So, no, I do not think in-tree configuration will fly.
I agree, which is why I asked the original question instead of posting it as a formal patch. We would probably get a brand new CVE implementing the proposed proto-changes even if the original intent was internal trusted repositories only. That's why I asked this as a "Best Practices" type question, which I think I have a better idea on now. The actual situation is rather cool from a DevOps point of view, and whatever the ultimate solution is, might make for a nice presentation at some future conference 😉.

Cheers and thanks, Randall

Previous: Junio C Hamano
Message 6 of 6 in “[Best Practices Request] clean/smudge configuration”
  1. Randall S. BeckerMay 9, 2018
  2. Bryan TurnerMay 9, 2018
  3. Randall S. BeckerMay 9, 2018
  4. Randall S. BeckerMay 10, 2018
  5. Junio C HamanoMay 11, 2018
  6. Randall S. BeckerMay 11, 2018

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.