Re: HowTo distribute a hook with the reposity.

From: Jeff King <peff@peff.net>
Date: Dec 28, 2016, 06:08 UTC
Message-ID: <20161228060840.gelgcs2hd33id56j@sigill.intra.peff.net>
In-Reply-To: <CA+P7+xqHTgRvMRwgL2TJ7SRb_SR0sbtA039J_5N0xSjf3TNrgg@mail.gmail.com>

On Tue, Dec 27, 2016 at 09:32:22PM -0800, Jacob Keller wrote:

Show 15 quoted lines

> On Tue, Dec 27, 2016 at 5:34 PM, John P. Hartmann <jphartmann@gmail.com> wrote:
> > I would like a hook in .got/hooks to be made available to all who clone or
> > pull a particular project.  I'd also like the hook to be under git control
> > (changes committed &c).  I added a hook, but git status does not show it.
> > Presumably git excludes its files in .git/ from version control lest there
> > be a chiken-and-egg situation.
> >
> > Is there a way to achieve this?  Or a better way to do it?
> >
> > Thanks,  j.
> 
> Best way I found, was add a script with an "installme" shell script or
> similar that you tell all users of the repository that they are
> expected to run this to install the scripts. You can' make it happen
> automatically.

I agree that is the best way to do it.

I didn't dig up previous discussions, but the gist is usually:

  1. Cloning a repository should not run arbitrary code from the remote
     without the user on the cloning side taking some further affirmative
     action.

     This is for security reasons. Obviously the next step is quite often
     to run "make" which does run arbitrary code, but that counts as an
     action.

  2. We could write a feature in git that manages hooks (or config, etc).
     But ultimately you would still be running "git clone
     --trust-remote-hooks" or something to satisfy point (1).

  3. There's not much point in doing point (2), because you can just
     spell it as "git clone && cd clone && ./install-hooks" and then git
     does not have to care at all about your scripts.

  4. A hook (or config) management system could do fancy things like
     merging your custom local config, picking up changes from the
     remote, etc. But all of that can happen outside of Git totally (and
     quite often you want to manage things in contributors setups
     _besides_ Git data anyway).

     An example system is:

       https://github.com/Autodesk/enterprise-config-for-git

     (with the disclaimer that I've never used it myself, so I have no
     idea how good it is).

I think you probably know all that, Jake, but I am laying it out for the benefit of the OP and the list. :)

-Peff