From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jeff King Subject: Re: what are the chances of a 'pre-upload' hook? Date: Sat, 26 Nov 2011 19:06:03 -0500 Message-ID: <20111127000603.GA7687@sigill.intra.peff.net> References: <20111125144007.GA4047@sigill.intra.peff.net> <7v7h2my0ky.fsf@alter.siamese.dyndns.org> <20111126225519.GA29482@sigill.intra.peff.net> <7vr50uwk7x.fsf@alter.siamese.dyndns.org> <20111126233133.GA31129@sigill.intra.peff.net> <20111126235135.GA7606@sigill.intra.peff.net> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Cc: Git , Sitaram Chamarty To: Junio C Hamano X-From: git-owner@vger.kernel.org Sun Nov 27 01:06:16 2011 Return-path: Envelope-to: gcvg-git-2@lo.gmane.org Received: from vger.kernel.org ([209.132.180.67]) by lo.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1RUSG6-00047V-L5 for gcvg-git-2@lo.gmane.org; Sun, 27 Nov 2011 01:06:14 +0100 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755163Ab1K0AGI (ORCPT ); Sat, 26 Nov 2011 19:06:08 -0500 Received: from 99-108-226-0.lightspeed.iplsin.sbcglobal.net ([99.108.226.0]:53552 "EHLO peff.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755152Ab1K0AGF (ORCPT ); Sat, 26 Nov 2011 19:06:05 -0500 Received: (qmail 9035 invoked by uid 107); 27 Nov 2011 00:12:37 -0000 Received: from sigill.intra.peff.net (HELO sigill.intra.peff.net) (10.0.0.7) (smtp-auth username relayok, mechanism cram-md5) by peff.net (qpsmtpd/0.84) with ESMTPA; Sat, 26 Nov 2011 19:12:37 -0500 Received: by sigill.intra.peff.net (sSMTP sendmail emulation); Sat, 26 Nov 2011 19:06:03 -0500 Content-Disposition: inline In-Reply-To: Sender: git-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: git@vger.kernel.org Archived-At: On Sat, Nov 26, 2011 at 03:57:40PM -0800, Junio C Hamano wrote: > Did I say anything about saNe?. I was talking about saFe. Fine. But that doesn't change my point: the purpose of such a feature is to tell git "do _not_ be safe; I have decided already for you whether it is OK to do this". > > By turning it on, you > > are saying "it's OK to run arbitrary code from the repo as the current > > user". > > The problem I have with it is that you are saying much more than that. > ... as the current user ANYWHERE on the machine. Just because it is passed through the environment does not mean you need to have it set all the time. There is nothing wrong with: GIT_ALLOW_UNTRUSTED_HOOKS=true git fetch ~bob/repo.git We can even spell it: git --allow-untrusted-hooks fetch ~bob/repo.git but it should probably still end up as an environment variable to make it through to the remote side (you could also tack it on to the upload-pack command line; that wouldn't make it across git:// or http:// connections, but those are irrelevant here anyway). -Peff