fetching a single commit from remote repo

fetching a single commit from remote repo

[Nikita V. Youshchenko]

Hello.

I'm looking for a way to fetch a single snapshot, without history, from
remote git repository.

I've found how to do it with a head (clone --depth 1, or fetch --depth 1).

Is it possible to do the same with non-head and non-tagged commit, if only
sha1 name of the commit is known?
Looks like fetch and fetch-pack only take ref names :(

Re: fetching a single commit from remote repo

[Johannes Schindelin]

Hi,

On Sun, 10 Feb 2008, Nikita V. Youshchenko wrote:

> I'm looking for a way to fetch a single snapshot, without history, from
> remote git repository.
> 
> I've found how to do it with a head (clone --depth 1, or fetch --depth 1).
> 
> Is it possible to do the same with non-head and non-tagged commit, if only
> sha1 name of the commit is known?
> Looks like fetch and fetch-pack only take ref names :(

Yes, for security reasons.  If you pushed some code you were not allowed 
to push, you have to have a way to undo the error by force-rewinding.

Ciao,
Dscho

Re: fetching a single commit from remote repo

[Nikita V. Youshchenko]

> Hi,
>
> On Sun, 10 Feb 2008, Nikita V. Youshchenko wrote:
> > I'm looking for a way to fetch a single snapshot, without history,
> > from remote git repository.
> >
> > I've found how to do it with a head (clone --depth 1, or fetch --depth
> > 1).
> >
> > Is it possible to do the same with non-head and non-tagged commit, if
> > only sha1 name of the commit is known?
> > Looks like fetch and fetch-pack only take ref names :(
>
> Yes, for security reasons.

I can't understand what security issues this may cause ...

If one has enough access to a repository to clone it, he already has a way 
to download each and every object from there.

Ability to fetch the tree corresponding to particular commit won't add any 
new permissions to him, will it?

I'm looking for a way to get a copy of a particular previous state of the 
project tree, without having to download entire tree. Something similar 
checking out particular svn revision.
This is going to be wrapped into a script, which is intended to be executed 
by people without any knowledge of any VC system at all. Commit id could 
be a parameter for such a script.

Nikita

Re: fetching a single commit from remote repo

[Jan Hudec]

[-- Attachment #1: Type: text/plain, Size: 2017 bytes --]

On Sun, Feb 10, 2008 at 20:17:03 +0300, Nikita V. Youshchenko wrote:
> > Hi,
> >
> > On Sun, 10 Feb 2008, Nikita V. Youshchenko wrote:
> > > I'm looking for a way to fetch a single snapshot, without history,
> > > from remote git repository.
> > >
> > > I've found how to do it with a head (clone --depth 1, or fetch --depth
> > > 1).
> > >
> > > Is it possible to do the same with non-head and non-tagged commit, if
> > > only sha1 name of the commit is known?
> > > Looks like fetch and fetch-pack only take ref names :(
> >
> > Yes, for security reasons.
> 
> I can't understand what security issues this may cause ...
> 
> If one has enough access to a repository to clone it, he already has a way 
> to download each and every object from there.

No, that's not true. That is, it is only true for dumb (http, ftp) protocols.
The native git protocol (ssh is used as wrapper for that protocol anyway)
will only give you the objects that are accessible from the references listed
and no others.

> Ability to fetch the tree corresponding to particular commit won't add any 
> new permissions to him, will it?

It, indeed, may. Though, the git upload-pack could instead limit to only
providing objects, that can be reached from a ref -- than it would not add
any permissions.

> I'm looking for a way to get a copy of a particular previous state of the 
> project tree, without having to download entire tree. Something similar 
> checking out particular svn revision.
> This is going to be wrapped into a script, which is intended to be executed 
> by people without any knowledge of any VC system at all. Commit id could 
> be a parameter for such a script.

Would a cgi calling git-archive on the server do instead? It even seems to be
already part of gitweb -- the snapshot link for a commit should give you
a .tar.gz of that tree. If the people don't know anything about VC, they
probably won't need the metadata anyway.

-- 
						 Jan 'Bulb' Hudec <bulb@ucw.cz>

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: fetching a single commit from remote repo

[Jakub Narebski]

"Nikita V. Youshchenko" <yoush@debian.org> writes:

> I'm looking for a way to fetch a single snapshot, without history, from
> remote git repository.
> 
> I've found how to do it with a head (clone --depth 1, or fetch --depth 1).

You can also try "git archive --remote=<repo>" if it is enabled,
or if project has gitweb, then use 'snapshot' feature (if enabled).

-- 
Jakub Narebski
Poland
ShadeHawk on #git