git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Fetching a specific commit by commit ID

From
OCOlivier Croquette <ocroquette@free.fr>
Date
Dec 7, 2014, 10:15 UTC
Message-ID
<F6468265-A6B4-4065-A3F0-3F198421C08F@free.fr>
In-Reply-To
<20141206155210.GA22146@vauxhall.crustytoothpaste.net>
On 06 Dec 2014, at 16:52, brian m. carlson <sandals@crustytoothpaste.net> wrote:
Show 10 quoted lines
>> - more interestingly: is there any reason why git fetch should not
>>  support fetching by commit id? There are real world use cases where
>>  this can be very useful, for instance when references on the remote
>>  have been overwritten or deleted.
> 
> The reason this isn't supported in the general case is because one might
> want to restrict access to certain branches.  For example, an open
> source project might want to embargo some security fixes that are in the
> repository.  Allowing a user to specify an arbitrary ID would permit
> someone to circumvent those access controls.
Shouldn’t these checks be implemented in the layers above, eg. in gitolite, gitosis, gerrit… ? Having it in git itself makes it impossible in all cases, even for projects/repositories with no ref-specific read restrictions (the vast majority of projects, I would guess).
It seems pretty straightforward to support access control in these layers. If a commit id is provided, go through all references of the repository, if one is found that is a child of the given commit, and the user has access to the ref, then it’s ok to fetch the commit. Of course it’s an expensive operation, but it’s is rarely required.
Previous: brian m. carlson
Message 3 of 3 in “Fetching a specific commit by commit ID”
  1. Olivier CroquetteDec 6, 2014
  2. brian m. carlsonDec 6, 2014
  3. Olivier CroquetteDec 7, 2014

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.