Re: fetching a single commit from remote repo

[Jan Hudec <bulb@ucw.cz>]

[-- Attachment #1: Type: text/plain, Size: 2017 bytes --]

On Sun, Feb 10, 2008 at 20:17:03 +0300, Nikita V. Youshchenko wrote:
> > Hi,
> >
> > On Sun, 10 Feb 2008, Nikita V. Youshchenko wrote:
> > > I'm looking for a way to fetch a single snapshot, without history,
> > > from remote git repository.
> > >
> > > I've found how to do it with a head (clone --depth 1, or fetch --depth
> > > 1).
> > >
> > > Is it possible to do the same with non-head and non-tagged commit, if
> > > only sha1 name of the commit is known?
> > > Looks like fetch and fetch-pack only take ref names :(
> >
> > Yes, for security reasons.
> 
> I can't understand what security issues this may cause ...
> 
> If one has enough access to a repository to clone it, he already has a way 
> to download each and every object from there.

No, that's not true. That is, it is only true for dumb (http, ftp) protocols.
The native git protocol (ssh is used as wrapper for that protocol anyway)
will only give you the objects that are accessible from the references listed
and no others.

> Ability to fetch the tree corresponding to particular commit won't add any 
> new permissions to him, will it?

It, indeed, may. Though, the git upload-pack could instead limit to only
providing objects, that can be reached from a ref -- than it would not add
any permissions.

> I'm looking for a way to get a copy of a particular previous state of the 
> project tree, without having to download entire tree. Something similar 
> checking out particular svn revision.
> This is going to be wrapped into a script, which is intended to be executed 
> by people without any knowledge of any VC system at all. Commit id could 
> be a parameter for such a script.

Would a cgi calling git-archive on the server do instead? It even seems to be
already part of gitweb -- the snapshot link for a commit should give you
a .tar.gz of that tree. If the people don't know anything about VC, they
probably won't need the metadata anyway.

-- 
						 Jan 'Bulb' Hudec <bulb@ucw.cz>

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]