git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH] Documentation: clarify Git's security boundary

From
Junio C Hamano <gitster@pobox.com>
Date
Nov 1, 2026, 18:31 UTC
Message-ID
<xmqqy0bcz9m4.fsf@gitster.g>
In-Reply-To
<pull.2286.git.1793362370899.gitgitgadget@gmail.com>

"Johannes Schindelin via GitGitGadget" <gitgitgadget@gmail.com> writes:

> +Serving an untrusted repository to `git clone` still exposes
> +linkgit:git-upload-pack[1] to that repository. For additional isolation,
> +`upload-pack` can be run as an unprivileged user where the platform permits it.

This tricky thing is often forgotten, but it is nice to see it mentioned. 'git help upload-pack' also mentions this facility. Overall the document was a pleasant read.

Thanks.
Previous: Johannes Schindelin via GitGitGadget
Message 2 of 2 in “Documentation: clarify Git's security boundary”
  1. Documentation: clarify Git's security boundaryJohannes Schindelin via GitGitGadget, Oct 30, 2026
  2. Junio C HamanoNov 1, 2026

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.