Question regarding Git updater

Hi

I hope you can help me with answering my question regarding the update mechanism for Git after it has been installed.

1) Does the updater autonomously figure out if there is a newer
version than the current one that is installed?

2) Or does the updater only ask, when the user actively uses a command
to ask Git to check for a newer version?

3) In both cases, what information about the user/system is sent with
the request? Is this information stored on a server or database etc.?

BR

Andreas

On Thu, Dec 14, 2023 at 05:44:41PM +0100, Andreas Scholz wrote:

You may need to be more specific here about how you're installing Git. The Git project itself does not ship any binary packages at all, let alone ones that have an update mechanism.

If you're using the Git for Windows installer, it looks like it does have an auto-update feature:

 https://github.com/git-for-windows/build-extra/blob/15b05c2399f152783d1fe9f167692dd5cd8ae1e1/installer/install.iss#L114

You might get a response on this list from Git for Windows folks, but there is also a separate Git for Windows list:

  https://groups.google.com/g/git-for-windows

You may be more likely to get a response there, or opening an issue on the GitHub repo:

  https://github.com/git-for-windows/git

If you're using something else, you may have to ask the specific packager.

-Peff

Hi Andreas,

On Thu, 14 Dec 2023, Andreas Scholz wrote:

Assuming that you mean Git for Windows and its updater that you can enable by checking the "Check daily for Git for Windows updates" option on the Components page, I will provide answers below (if you are not talking about Git for Windows, I apologize, and ask for clarification):

Git for Windows' updater is backed by a Unix shell script: https://github.com/git-for-windows/build-extra/blob/HEAD/git-extra/git-update-git-for-windows

When configured to run regularly via a scheduled task, it will be called with the options `--quiet --gui`. It starts by determining the latest tag: https://github.com/git-for-windows/build-extra/blob/15b05c2399f152783d1fe9f167692dd5cd8ae1e1/git-extra/git-update-git-for-windows#L222 which downloads https://gitforwindows.org/latest-tag.txt, a file that is hosted on GitHub Pages and that is updated as part of every Git for Windows release.

The script then continues by determining the local version: https://github.com/git-for-windows/build-extra/blob/15b05c2399f152783d1fe9f167692dd5cd8ae1e1/git-extra/git-update-git-for-windows#L248 and comparing both versions: https://github.com/git-for-windows/build-extra/blob/15b05c2399f152783d1fe9f167692dd5cd8ae1e1/git-extra/git-update-git-for-windows#L257-L262 exiting with success if they match.

Most notably, it does _not_ verify that the remote version is newer, meaning: If you build and install a custom Git version that reports a version number, say, 100.100.100, the updater will still propose to update from that, even if the current version is v2.43.0.

Users are welcome to run `git update-git-for-windows` manually. If aforementioned checkbox was checked during installation, this won't be necessary, strictly speaking.

The information that is sent is the IP address and the HTTP headers sent by `curl` in https://github.com/git-for-windows/build-extra/blob/15b05c2399f152783d1fe9f167692dd5cd8ae1e1/git-extra/git-update-git-for-windows#L120-L125 i.e. a User-Agent (`curl` does not seem to include the current OS there), but not the current Git for Windows version (an information that, if available, would actually help me perform my role of Git for Windows maintainer a lot better). Since the request goes to GitHub Pages, which does not store any information, all of that information vanishes right after the HTTP response is sent.

Ciao, Johannes