Re: git submodule: update=!command
- From
- Ryan Lortie <desrt@desrt.ca>
- Date
- Mar 17, 2015, 20:48 UTC
- Message-ID
- <1426625302.1806008.241713717.52A37086@webmail.messagingengine.com>
- In-Reply-To
- <20150317195030.GA18725@peff.net>
On Tue, Mar 17, 2015, at 15:50, Jeff King wrote:
> Yeah, spelling out the security model more explicitly would be good.
Please see the attached patch.
Cheers
From a6d70056f21f039db8676f72a1deca00c39121bd Mon Sep 17 00:00:00 2001 From: Ryan Lortie <desrt@desrt.ca> Date: Tue, 17 Mar 2015 16:29:51 -0400 Subject: [PATCH] docs: clarify !command submodule update policy
Clarify that the !command submodule update policy is not available from .gitmodules files.
This should help calm any fears people have about the security implications of this otherwise scary-looking feature.
Signed-off-by: Ryan Lortie <desrt@desrt.ca> --- Documentation/git-submodule.txt | 10 +++++++--- Documentation/gitmodules.txt | 11 ++++++++--- 2 files changed, 15 insertions(+), 6 deletions(-)
diff --git a/Documentation/git-submodule.txt b/Documentation/git-submodule.txt index 8e6af65..a033e26 100644 --- a/Documentation/git-submodule.txt +++ b/Documentation/git-submodule.txt @@ -159,9 +159,13 @@ update:: This will make the submodules HEAD be detached unless `--rebase` or `--merge` is specified or the key `submodule.$name.update` is set to `rebase`, `merge` or `none`. `none` can be overridden by specifying - `--checkout`. Setting the key `submodule.$name.update` to `!command` - will cause `command` to be run. `command` can be any arbitrary shell - command that takes a single argument, namely the sha1 to update to. + `--checkout`. ++ +Setting the key `submodule.$name.update` in `.git/config` to +`!command` will cause `command` to be run. `command` can be any +arbitrary shell command that takes a single argument, namely the sha1 +to update to. For security reasons, this feature is not supported +from the `.gitmodules` file. + If the submodule is not yet initialized, and you just want to use the setting as stored in .gitmodules, you can automatically initialize the diff --git a/Documentation/gitmodules.txt b/Documentation/gitmodules.txt index f6c0dfd..f11e872 100644 --- a/Documentation/gitmodules.txt +++ b/Documentation/gitmodules.txt @@ -47,9 +47,14 @@ submodule.<name>.update:: in the submodule. If 'none', the submodule with name `$name` will not be updated by default. - - This config option is overridden if 'git submodule update' is given - the '--merge', '--rebase' or '--checkout' options. ++ +This config option is overridden if 'git submodule update' is given +the '--merge', '--rebase' or '--checkout' options. ++ +Only the values 'checkout', 'rebase', 'merge' and 'none' are +recognized when this key appears in the `.gitmodules` file. In +particular, '!command' is not recognised, and will be rewritten to +'none' by "git submodule init". submodule.<name>.branch:: A remote branch name for tracking updates in the upstream submodule.
-- 2.1.4