threads / discuss / 18125

Why isn't hook file cloned to bared repository ?

Subject: Why isn't hook file cloned to bared repository ?

## tl;dr

3 messages between Mar 4, 2009 and Mar 4, 2009.

replies: 2people: 3as markdown or json

Emily Ren· Mar 4, 2009, 05:40 UTC · lore

Hi,

I added file "update" in my git repository my_repo/.git/hooks/, then I run command "git clone --bare my_repo" to generate a bared repository my_repo.git. But there's no update in my_repo.git/hooks.

Do you know why ?

Thanks, Emily

Bryan Donlan· Mar 4, 2009, 06:13 UTC · re: Emily Ren · lore

Re: Why isn't hook file cloned to bared repository ?

On Wed, Mar 4, 2009 at 12:40 AM, Emily Ren <lingyan.ren@gmail.com> wrote:

Show 7 quoted lines

> Hi,
>
> I added file "update" in my git repository my_repo/.git/hooks/,  then
> I run command "git clone --bare my_repo" to generate a bared
> repository my_repo.git. But there's no update in my_repo.git/hooks.
>
> Do you know why ?

Because allowing code from an untrusted third-party repository to be executed automatically without giving a chance to examine it is not a very good idea from a security standpoint. In addition, hooks are often not of interest to the person cloning the repository. Because of these reasons, git clone will not copy hooks from the source repository (for consistency, this is the case even when the source is local).

Johannes Schindelin· Mar 4, 2009, 10:04 UTC · re: Bryan Donlan · lore

Re: Why isn't hook file cloned to bared repository ?

Hi,

On Wed, 4 Mar 2009, Bryan Donlan wrote:

Show 15 quoted lines

> On Wed, Mar 4, 2009 at 12:40 AM, Emily Ren <lingyan.ren@gmail.com> wrote:
>
> > I added file "update" in my git repository my_repo/.git/hooks/,  then
> > I run command "git clone --bare my_repo" to generate a bared
> > repository my_repo.git. But there's no update in my_repo.git/hooks.
> >
> > Do you know why ?
> 
> Because allowing code from an untrusted third-party repository to be
> executed automatically without giving a chance to examine it is not a
> very good idea from a security standpoint. In addition, hooks are
> often not of interest to the person cloning the repository. Because of
> these reasons, git clone will not copy hooks from the source
> repository (for consistency, this is the case even when the source is
> local).

I might add that hooks are not part of the repository. They are not versioned, for example.

Having said that, nothing prevents you from committing a set of example hooks and a script to install them, and tell your users that they may install default hooks using that script. I do that for one of my projects.

Ciao, Dscho