Re: [PATCH v4] Allow update hooks to update refs on their own.

From: Shawn O. Pearce <spearce@spearce.org>
Date: Dec 4, 2007, 02:34 UTC
Message-ID: <20071204023440.GD14735@spearce.org>
In-Reply-To: <Pine.LNX.4.64.0712040224080.27959@racer.site>

Johannes Schindelin <Johannes.Schindelin@gmx.de> wrote:

Show 8 quoted lines

> On Mon, 3 Dec 2007, Shawn O. Pearce wrote:
> > Actually <n> wouldn't be so bad.  We could do something like:
> > 
> > 	GIT_INHERITED_LOCKS="<ref> <depth> <ref> <depth> ..."
> 
> I am somewhat wary of using environment variables in that context, since 
> the variables could leak to subprocesses, or (even worse), they could be 
> set inadvertently by the user or other scripts.

Sure. But as bad as it is, its still more secure than the "repository of record" that my day-job uses for its source code tree (no, it doesn't use Git, and I wish it was as good as Visual Source Suck). </bad-joke>

I'd suggest also using something like getppid() to check the pid against a pid in the env, and *gasp* maybe do a SHA-1 hash in there or something to make it challening enough to fake that the average user won't set it unless they really understand what they are doing.

-- 
Shawn.