git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Can I fetch an arbitrary commit by sha1?

From
Duy Nguyen <pclouds@gmail.com>
Date
Oct 7, 2014, 12:34 UTC
Message-ID
<CACsJy8B0dbE0C3M0PO-EfaZ_bSxwGJSFVejEGFzjHSOZKOc+Jw@mail.gmail.com>
In-Reply-To
<CACh33FpWPuyJRryf6hzbAkqWJMwzz1mLLDDRxEQ0niT2CznTRg@mail.gmail.com>
On Tue, Oct 7, 2014 at 1:25 AM, Patrick Donnelly <batrick@batbytes.com> wrote:
Show 23 quoted lines
> On Thu, Oct 2, 2014 at 12:10 PM, Jeff King <peff@peff.net> wrote:
>> On Thu, Oct 02, 2014 at 10:22:50AM -0400, Dan Johnson wrote:
>>> My understanding is that you are allowed to ask for a SHA1, but most
>>> git servers refuse the request. But if you already have the SHA
>>> locally, then git doesn't neet to bother asking the server for it, so
>>> there's no request to be refused.
>>
>> That's right. It is the server which enforces the "you cannot fetch an
>> arbitrary sha1" rule.
>>
>> But I think Christian is arguing that the client side should complain
>> that $sha1 is not a remote ref, and therefore not something we can
>> fetch.  This used to be the behavior until 6e7b66e (fetch: fetch objects
>> by their exact SHA-1 object names, 2013-01-29). The idea there is that
>> some refs may be kept "hidden" from the ref advertisement, but clients
>> who learn about the sha1 out-of-band may fetch the tips of hidden refs.
>>
>> I'm not sure it is a feature that has been particularly well-used to
>> date, though.
>
> There are efforts in the scientific communities at preserving
> experimental software and results. One of the things we'd like to do
> is shallow clone a specific sha1 commit

You're not the first one asking about making a shallow clone from from a specific point. I think the reason fetching from arbitrary sha-1 is not supported is because of security. If we can verify the asked sha-1 is reachable from the visible ref set, then we should allow it. With pack bitmaps, it's getting much cheaper to do such a test. If pack bitmaps are not used, we could set a default/configurable limit, like not traversing more than 1000 commits from any ref for this reachability test). Anybody objecting this approach?

-- 
Duy
Previous: David LangNext: Duy Nguyen
Message 8 of 12 in “Can I fetch an arbitrary commit by sha1?”
  1. Christian HalstrickOct 2, 2014
  2. Dan JohnsonOct 2, 2014
  3. Jeff KingOct 2, 2014
  4. Jonathan NiederOct 2, 2014
  5. Christian HalstrickOct 5, 2014
  6. Patrick DonnellyOct 6, 2014
  7. David LangOct 6, 2014
  8. Duy NguyenOct 7, 2014
  9. Duy NguyenOct 7, 2014
  10. Junio C HamanoOct 7, 2014
  11. Duy NguyenOct 8, 2014
  12. Junio C HamanoOct 9, 2014

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.