Re: HowTo distribute a hook with the reposity.

From: Jeff King <peff@peff.net>
To: Jacob Keller <jacob.keller@gmail.com>
Cc: "John P. Hartmann" <jphartmann@gmail.com>,
	Git mailing list <git@vger.kernel.org>
Subject: Re: HowTo distribute a hook with the reposity.
Date: Wed, 28 Dec 2016 01:08:41 -0500	[thread overview]
Message-ID: <20161228060840.gelgcs2hd33id56j@sigill.intra.peff.net> (raw)
In-Reply-To: <CA+P7+xqHTgRvMRwgL2TJ7SRb_SR0sbtA039J_5N0xSjf3TNrgg@mail.gmail.com>

On Tue, Dec 27, 2016 at 09:32:22PM -0800, Jacob Keller wrote:

> On Tue, Dec 27, 2016 at 5:34 PM, John P. Hartmann <jphartmann@gmail.com> wrote:
> > I would like a hook in .got/hooks to be made available to all who clone or
> > pull a particular project.  I'd also like the hook to be under git control
> > (changes committed &c).  I added a hook, but git status does not show it.
> > Presumably git excludes its files in .git/ from version control lest there
> > be a chiken-and-egg situation.
> >
> > Is there a way to achieve this?  Or a better way to do it?
> >
> > Thanks,  j.
> 
> Best way I found, was add a script with an "installme" shell script or
> similar that you tell all users of the repository that they are
> expected to run this to install the scripts. You can' make it happen
> automatically.

I agree that is the best way to do it.

I didn't dig up previous discussions, but the gist is usually:

  1. Cloning a repository should not run arbitrary code from the remote
     without the user on the cloning side taking some further affirmative
     action.

     This is for security reasons. Obviously the next step is quite often
     to run "make" which does run arbitrary code, but that counts as an
     action.

  2. We could write a feature in git that manages hooks (or config, etc).
     But ultimately you would still be running "git clone
     --trust-remote-hooks" or something to satisfy point (1).

  3. There's not much point in doing point (2), because you can just
     spell it as "git clone && cd clone && ./install-hooks" and then git
     does not have to care at all about your scripts.

  4. A hook (or config) management system could do fancy things like
     merging your custom local config, picking up changes from the
     remote, etc. But all of that can happen outside of Git totally (and
     quite often you want to manage things in contributors setups
     _besides_ Git data anyway).

     An example system is:

       https://github.com/Autodesk/enterprise-config-for-git

     (with the disclaimer that I've never used it myself, so I have no
     idea how good it is).

I think you probably know all that, Jake, but I am laying it out for the
benefit of the OP and the list. :)

-Peff