threads / discuss / 12009

fetching a single commit from remote repo

Subject: fetching a single commit from remote repo

## tl;dr

5 messages between Feb 10, 2008 and Feb 15, 2008.

replies: 4people: 4as markdown or json

Nikita V. Youshchenko· Feb 10, 2008, 15:00 UTC · lore

Hello.

I'm looking for a way to fetch a single snapshot, without history, from remote git repository.

I've found how to do it with a head (clone --depth 1, or fetch --depth 1).

Is it possible to do the same with non-head and non-tagged commit, if only sha1 name of the commit is known? Looks like fetch and fetch-pack only take ref names :(

Johannes Schindelin· Feb 10, 2008, 16:45 UTC · re: Nikita V. Youshchenko · lore

Re: fetching a single commit from remote repo

Hi,

On Sun, 10 Feb 2008, Nikita V. Youshchenko wrote:

Show 8 quoted lines

> I'm looking for a way to fetch a single snapshot, without history, from
> remote git repository.
> 
> I've found how to do it with a head (clone --depth 1, or fetch --depth 1).
> 
> Is it possible to do the same with non-head and non-tagged commit, if only
> sha1 name of the commit is known?
> Looks like fetch and fetch-pack only take ref names :(

Yes, for security reasons. If you pushed some code you were not allowed to push, you have to have a way to undo the error by force-rewinding.

Ciao, Dscho

Nikita V. Youshchenko· Feb 10, 2008, 17:17 UTC · re: Johannes Schindelin · lore

Re: fetching a single commit from remote repo

Show 14 quoted lines

> Hi,
>
> On Sun, 10 Feb 2008, Nikita V. Youshchenko wrote:
> > I'm looking for a way to fetch a single snapshot, without history,
> > from remote git repository.
> >
> > I've found how to do it with a head (clone --depth 1, or fetch --depth
> > 1).
> >
> > Is it possible to do the same with non-head and non-tagged commit, if
> > only sha1 name of the commit is known?
> > Looks like fetch and fetch-pack only take ref names :(
>
> Yes, for security reasons.

I can't understand what security issues this may cause ...

If one has enough access to a repository to clone it, he already has a way to download each and every object from there.

Ability to fetch the tree corresponding to particular commit won't add any new permissions to him, will it?

I'm looking for a way to get a copy of a particular previous state of the project tree, without having to download entire tree. Something similar checking out particular svn revision. This is going to be wrapped into a script, which is intended to be executed by people without any knowledge of any VC system at all. Commit id could be a parameter for such a script.

Nikita

Jan Hudec· Feb 15, 2008, 23:07 UTC · re: Nikita V. Youshchenko · lore

Re: fetching a single commit from remote repo

On Sun, Feb 10, 2008 at 20:17:03 +0300, Nikita V. Youshchenko wrote:

Show 19 quoted lines

> > Hi,
> >
> > On Sun, 10 Feb 2008, Nikita V. Youshchenko wrote:
> > > I'm looking for a way to fetch a single snapshot, without history,
> > > from remote git repository.
> > >
> > > I've found how to do it with a head (clone --depth 1, or fetch --depth
> > > 1).
> > >
> > > Is it possible to do the same with non-head and non-tagged commit, if
> > > only sha1 name of the commit is known?
> > > Looks like fetch and fetch-pack only take ref names :(
> >
> > Yes, for security reasons.
> 
> I can't understand what security issues this may cause ...
> 
> If one has enough access to a repository to clone it, he already has a way 
> to download each and every object from there.

No, that's not true. That is, it is only true for dumb (http, ftp) protocols. The native git protocol (ssh is used as wrapper for that protocol anyway) will only give you the objects that are accessible from the references listed and no others.

> Ability to fetch the tree corresponding to particular commit won't add any 
> new permissions to him, will it?

It, indeed, may. Though, the git upload-pack could instead limit to only providing objects, that can be reached from a ref -- than it would not add any permissions.

Show 6 quoted lines

> I'm looking for a way to get a copy of a particular previous state of the 
> project tree, without having to download entire tree. Something similar 
> checking out particular svn revision.
> This is going to be wrapped into a script, which is intended to be executed 
> by people without any knowledge of any VC system at all. Commit id could 
> be a parameter for such a script.

Would a cgi calling git-archive on the server do instead? It even seems to be already part of gitweb -- the snapshot link for a commit should give you a .tar.gz of that tree. If the people don't know anything about VC, they probably won't need the metadata anyway.

-- 
						 Jan 'Bulb' Hudec <bulb@ucw.cz>

Jakub Narebski· Feb 10, 2008, 16:48 UTC · re: Nikita V. Youshchenko · lore

Re: fetching a single commit from remote repo

"Nikita V. Youshchenko" <yoush@debian.org> writes:

> I'm looking for a way to fetch a single snapshot, without history, from
> remote git repository.
> 
> I've found how to do it with a head (clone --depth 1, or fetch --depth 1).

You can also try "git archive --remote=<repo>" if it is enabled, or if project has gitweb, then use 'snapshot' feature (if enabled).

-- 
Jakub Narebski
Poland
ShadeHawk on #git