From: brian m. carlson <sandals@crustytoothpaste.net>
Date: Fri, 09 Jan 2026 20:11:41 GMT
Subject: Re: [PATCH] gitfaq: document using stash import/export to sync working tree
Message-ID: <aWFg_VUZH5_ZqTix@fruit.crustytoothpaste.net>
In-Reply-To: <xmqqseceua9j.fsf@gitster.g>

On 2026-01-09 at 14:32:40, Junio C Hamano wrote:
> "brian m. carlson" <sandals@crustytoothpaste.net> writes:
> 
> > Git 2.51 learned how to import and export stashes.  This is a
> > secure and robust way to transfer working tree states across machines
> 
> Here "secure" in "secure and robust" triggered my "huh?" sensor.  It
> is a robust way, but is there something particularly "secure" about
> it, other than "it is less likely to break your repository" in the
> sense that is already covered by "robust".

We know that sharing a working tree with different users is not secure
because people can have things like hooks or config options that execute
arbitrary code.  Transferring stashes doesn't have that downside.

Considering that we used to explain that the only way to do this was to
rsync the working tree across machines, this option is more secure than
the previous option since it avoids any potential code execution.  It
also avoids syncing things like ignored `.env` files, which people often
use to store secrets, since `git stash` doesn't transfer ignored files
(but rsync often does).

But if you disagree and prefer to remove it, please feel free to edit
the commit message before you merge to next, or let me know and I can
send a v2 if you prefer.
-- 
brian m. carlson (they/them)
Toronto, Ontario, CA