1GIT-FETCH(1)                      Git Manual                      GIT-FETCH(1)
2
3
4

NAME

6       git-fetch - Download objects and refs from another repository
7

SYNOPSIS

9       git fetch [<options>] [<repository> [<refspec>...]]
10       git fetch [<options>] <group>
11       git fetch --multiple [<options>] [(<repository> | <group>)...]
12       git fetch --all [<options>]
13
14

DESCRIPTION

16       Fetch branches and/or tags (collectively, "refs") from one or more
17       other repositories, along with the objects necessary to complete their
18       histories. Remote-tracking branches are updated (see the description of
19       <refspec> below for ways to control this behavior).
20
21       By default, any tag that points into the histories being fetched is
22       also fetched; the effect is to fetch tags that point at branches that
23       you are interested in. This default behavior can be changed by using
24       the --tags or --no-tags options or by configuring remote.<name>.tagOpt.
25       By using a refspec that fetches tags explicitly, you can fetch tags
26       that do not point into branches you are interested in as well.
27
28       git fetch can fetch from either a single named repository or URL, or
29       from several repositories at once if <group> is given and there is a
30       remotes.<group> entry in the configuration file. (See git-config(1)).
31
32       When no remote is specified, by default the origin remote will be used,
33       unless there’s an upstream branch configured for the current branch.
34
35       The names of refs that are fetched, together with the object names they
36       point at, are written to .git/FETCH_HEAD. This information may be used
37       by scripts or other git commands, such as git-pull(1).
38

OPTIONS

40       --all
41           Fetch all remotes.
42
43       -a, --append
44           Append ref names and object names of fetched refs to the existing
45           contents of .git/FETCH_HEAD. Without this option old data in
46           .git/FETCH_HEAD will be overwritten.
47
48       --depth=<depth>
49           Limit fetching to the specified number of commits from the tip of
50           each remote branch history. If fetching to a shallow repository
51           created by git clone with --depth=<depth> option (see git-
52           clone(1)), deepen or shorten the history to the specified number of
53           commits. Tags for the deepened commits are not fetched.
54
55       --deepen=<depth>
56           Similar to --depth, except it specifies the number of commits from
57           the current shallow boundary instead of from the tip of each remote
58           branch history.
59
60       --shallow-since=<date>
61           Deepen or shorten the history of a shallow repository to include
62           all reachable commits after <date>.
63
64       --shallow-exclude=<revision>
65           Deepen or shorten the history of a shallow repository to exclude
66           commits reachable from a specified remote branch or tag. This
67           option can be specified multiple times.
68
69       --unshallow
70           If the source repository is complete, convert a shallow repository
71           to a complete one, removing all the limitations imposed by shallow
72           repositories.
73
74           If the source repository is shallow, fetch as much as possible so
75           that the current repository has the same history as the source
76           repository.
77
78       --update-shallow
79           By default when fetching from a shallow repository, git fetch
80           refuses refs that require updating .git/shallow. This option
81           updates .git/shallow and accept such refs.
82
83       --negotiation-tip=<commit|glob>
84           By default, Git will report, to the server, commits reachable from
85           all local refs to find common commits in an attempt to reduce the
86           size of the to-be-received packfile. If specified, Git will only
87           report commits reachable from the given tips. This is useful to
88           speed up fetches when the user knows which local ref is likely to
89           have commits in common with the upstream ref being fetched.
90
91           This option may be specified more than once; if so, Git will report
92           commits reachable from any of the given commits.
93
94           The argument to this option may be a glob on ref names, a ref, or
95           the (possibly abbreviated) SHA-1 of a commit. Specifying a glob is
96           equivalent to specifying this option multiple times, one for each
97           matching ref name.
98
99           See also the fetch.negotiationAlgorithm configuration variable
100           documented in git-config(1).
101
102       --dry-run
103           Show what would be done, without making any changes.
104
105       -f, --force
106           When git fetch is used with <src>:<dst> refspec it may refuse to
107           update the local branch as discussed in the <refspec> part below.
108           This option overrides that check.
109
110       -k, --keep
111           Keep downloaded pack.
112
113       --multiple
114           Allow several <repository> and <group> arguments to be specified.
115           No <refspec>s may be specified.
116
117       -p, --prune
118           Before fetching, remove any remote-tracking references that no
119           longer exist on the remote. Tags are not subject to pruning if they
120           are fetched only because of the default tag auto-following or due
121           to a --tags option. However, if tags are fetched due to an explicit
122           refspec (either on the command line or in the remote configuration,
123           for example if the remote was cloned with the --mirror option),
124           then they are also subject to pruning. Supplying --prune-tags is a
125           shorthand for providing the tag refspec.
126
127           See the PRUNING section below for more details.
128
129       -P, --prune-tags
130           Before fetching, remove any local tags that no longer exist on the
131           remote if --prune is enabled. This option should be used more
132           carefully, unlike --prune it will remove any local references
133           (local tags) that have been created. This option is a shorthand for
134           providing the explicit tag refspec along with --prune, see the
135           discussion about that in its documentation.
136
137           See the PRUNING section below for more details.
138
139       -n, --no-tags
140           By default, tags that point at objects that are downloaded from the
141           remote repository are fetched and stored locally. This option
142           disables this automatic tag following. The default behavior for a
143           remote may be specified with the remote.<name>.tagOpt setting. See
144           git-config(1).
145
146       --refmap=<refspec>
147           When fetching refs listed on the command line, use the specified
148           refspec (can be given more than once) to map the refs to
149           remote-tracking branches, instead of the values of remote.*.fetch
150           configuration variables for the remote repository. See section on
151           "Configured Remote-tracking Branches" for details.
152
153       -t, --tags
154           Fetch all tags from the remote (i.e., fetch remote tags refs/tags/*
155           into local tags with the same name), in addition to whatever else
156           would otherwise be fetched. Using this option alone does not
157           subject tags to pruning, even if --prune is used (though tags may
158           be pruned anyway if they are also the destination of an explicit
159           refspec; see --prune).
160
161       --recurse-submodules[=yes|on-demand|no]
162           This option controls if and under what conditions new commits of
163           populated submodules should be fetched too. It can be used as a
164           boolean option to completely disable recursion when set to no or to
165           unconditionally recurse into all populated submodules when set to
166           yes, which is the default when this option is used without any
167           value. Use on-demand to only recurse into a populated submodule
168           when the superproject retrieves a commit that updates the
169           submodule’s reference to a commit that isn’t already in the local
170           submodule clone.
171
172       -j, --jobs=<n>
173           Number of parallel children to be used for fetching submodules.
174           Each will fetch from different submodules, such that fetching many
175           submodules will be faster. By default submodules will be fetched
176           one at a time.
177
178       --no-recurse-submodules
179           Disable recursive fetching of submodules (this has the same effect
180           as using the --recurse-submodules=no option).
181
182       --submodule-prefix=<path>
183           Prepend <path> to paths printed in informative messages such as
184           "Fetching submodule foo". This option is used internally when
185           recursing over submodules.
186
187       --recurse-submodules-default=[yes|on-demand]
188           This option is used internally to temporarily provide a
189           non-negative default value for the --recurse-submodules option. All
190           other methods of configuring fetch’s submodule recursion (such as
191           settings in gitmodules(5) and git-config(1)) override this option,
192           as does specifying --[no-]recurse-submodules directly.
193
194       -u, --update-head-ok
195           By default git fetch refuses to update the head which corresponds
196           to the current branch. This flag disables the check. This is purely
197           for the internal use for git pull to communicate with git fetch,
198           and unless you are implementing your own Porcelain you are not
199           supposed to use it.
200
201       --upload-pack <upload-pack>
202           When given, and the repository to fetch from is handled by git
203           fetch-pack, --exec=<upload-pack> is passed to the command to
204           specify non-default path for the command run on the other end.
205
206       -q, --quiet
207           Pass --quiet to git-fetch-pack and silence any other internally
208           used git commands. Progress is not reported to the standard error
209           stream.
210
211       -v, --verbose
212           Be verbose.
213
214       --progress
215           Progress status is reported on the standard error stream by default
216           when it is attached to a terminal, unless -q is specified. This
217           flag forces progress status even if the standard error stream is
218           not directed to a terminal.
219
220       -o <option>, --server-option=<option>
221           Transmit the given string to the server when communicating using
222           protocol version 2. The given string must not contain a NUL or LF
223           character. When multiple --server-option=<option> are given, they
224           are all sent to the other side in the order listed on the command
225           line.
226
227       -4, --ipv4
228           Use IPv4 addresses only, ignoring IPv6 addresses.
229
230       -6, --ipv6
231           Use IPv6 addresses only, ignoring IPv4 addresses.
232
233       <repository>
234           The "remote" repository that is the source of a fetch or pull
235           operation. This parameter can be either a URL (see the section GIT
236           URLS below) or the name of a remote (see the section REMOTES
237           below).
238
239       <group>
240           A name referring to a list of repositories as the value of
241           remotes.<group> in the configuration file. (See git-config(1)).
242
243       <refspec>
244           Specifies which refs to fetch and which local refs to update. When
245           no <refspec>s appear on the command line, the refs to fetch are
246           read from remote.<repository>.fetch variables instead (see
247           CONFIGURED REMOTE-TRACKING BRANCHES below).
248
249           The format of a <refspec> parameter is an optional plus +, followed
250           by the source <src>, followed by a colon :, followed by the
251           destination ref <dst>. The colon can be omitted when <dst> is
252           empty. <src> is typically a ref, but it can also be a fully spelled
253           hex object name.
254
255           tag <tag> means the same as refs/tags/<tag>:refs/tags/<tag>; it
256           requests fetching everything up to the given tag.
257
258           The remote ref that matches <src> is fetched, and if <dst> is not
259           an empty string, an attempt is made to update the local ref that
260           matches it.
261
262           Whether that update is allowed without --force depends on the ref
263           namespace it’s being fetched to, the type of object being fetched,
264           and whether the update is considered to be a fast-forward.
265           Generally, the same rules apply for fetching as when pushing, see
266           the <refspec>...  section of git-push(1) for what those are.
267           Exceptions to those rules particular to git fetch are noted below.
268
269           Until Git version 2.20, and unlike when pushing with git-push(1),
270           any updates to refs/tags/* would be accepted without + in the
271           refspec (or --force). When fetching, we promiscuously considered
272           all tag updates from a remote to be forced fetches. Since Git
273           version 2.20, fetching to update refs/tags/* works the same way as
274           when pushing. I.e. any updates will be rejected without + in the
275           refspec (or --force).
276
277           Unlike when pushing with git-push(1), any updates outside of
278           refs/{tags,heads}/* will be accepted without + in the refspec (or
279           --force), whether that’s swapping e.g. a tree object for a blob, or
280           a commit for another commit that’s doesn’t have the previous commit
281           as an ancestor etc.
282
283           Unlike when pushing with git-push(1), there is no configuration
284           which’ll amend these rules, and nothing like a pre-fetch hook
285           analogous to the pre-receive hook.
286
287           As with pushing with git-push(1), all of the rules described above
288           about what’s not allowed as an update can be overridden by adding
289           an the optional leading + to a refspec (or using --force command
290           line option). The only exception to this is that no amount of
291           forcing will make the refs/heads/* namespace accept a non-commit
292           object.
293
294               Note
295               When the remote branch you want to fetch is known to be rewound
296               and rebased regularly, it is expected that its new tip will not
297               be descendant of its previous tip (as stored in your
298               remote-tracking branch the last time you fetched). You would
299               want to use the + sign to indicate non-fast-forward updates
300               will be needed for such branches. There is no way to determine
301               or declare that a branch will be made available in a repository
302               with this behavior; the pulling user simply must know this is
303               the expected usage pattern for a branch.
304

GIT URLS

306       In general, URLs contain information about the transport protocol, the
307       address of the remote server, and the path to the repository. Depending
308       on the transport protocol, some of this information may be absent.
309
310       Git supports ssh, git, http, and https protocols (in addition, ftp, and
311       ftps can be used for fetching, but this is inefficient and deprecated;
312       do not use it).
313
314       The native transport (i.e. git:// URL) does no authentication and
315       should be used with caution on unsecured networks.
316
317       The following syntaxes may be used with them:
318
319       ·   ssh://[user@]host.xz[:port]/path/to/repo.git/
320
321       ·   git://host.xz[:port]/path/to/repo.git/
322
323       ·   http[s]://host.xz[:port]/path/to/repo.git/
324
325       ·   ftp[s]://host.xz[:port]/path/to/repo.git/
326
327       An alternative scp-like syntax may also be used with the ssh protocol:
328
329       ·   [user@]host.xz:path/to/repo.git/
330
331       This syntax is only recognized if there are no slashes before the first
332       colon. This helps differentiate a local path that contains a colon. For
333       example the local path foo:bar could be specified as an absolute path
334       or ./foo:bar to avoid being misinterpreted as an ssh url.
335
336       The ssh and git protocols additionally support ~username expansion:
337
338       ·   ssh://[user@]host.xz[:port]/~[user]/path/to/repo.git/
339
340       ·   git://host.xz[:port]/~[user]/path/to/repo.git/
341
342       ·   [user@]host.xz:/~[user]/path/to/repo.git/
343
344       For local repositories, also supported by Git natively, the following
345       syntaxes may be used:
346
347       ·   /path/to/repo.git/
348
349       ·   file:///path/to/repo.git/
350
351       These two syntaxes are mostly equivalent, except when cloning, when the
352       former implies --local option. See git-clone(1) for details.
353
354       When Git doesn’t know how to handle a certain transport protocol, it
355       attempts to use the remote-<transport> remote helper, if one exists. To
356       explicitly request a remote helper, the following syntax may be used:
357
358       ·   <transport>::<address>
359
360       where <address> may be a path, a server and path, or an arbitrary
361       URL-like string recognized by the specific remote helper being invoked.
362       See gitremote-helpers(1) for details.
363
364       If there are a large number of similarly-named remote repositories and
365       you want to use a different format for them (such that the URLs you use
366       will be rewritten into URLs that work), you can create a configuration
367       section of the form:
368
369                   [url "<actual url base>"]
370                           insteadOf = <other url base>
371
372
373       For example, with this:
374
375                   [url "git://git.host.xz/"]
376                           insteadOf = host.xz:/path/to/
377                           insteadOf = work:
378
379
380       a URL like "work:repo.git" or like "host.xz:/path/to/repo.git" will be
381       rewritten in any context that takes a URL to be
382       "git://git.host.xz/repo.git".
383
384       If you want to rewrite URLs for push only, you can create a
385       configuration section of the form:
386
387                   [url "<actual url base>"]
388                           pushInsteadOf = <other url base>
389
390
391       For example, with this:
392
393                   [url "ssh://example.org/"]
394                           pushInsteadOf = git://example.org/
395
396
397       a URL like "git://example.org/path/to/repo.git" will be rewritten to
398       "ssh://example.org/path/to/repo.git" for pushes, but pulls will still
399       use the original URL.
400

REMOTES

402       The name of one of the following can be used instead of a URL as
403       <repository> argument:
404
405       ·   a remote in the Git configuration file: $GIT_DIR/config,
406
407       ·   a file in the $GIT_DIR/remotes directory, or
408
409       ·   a file in the $GIT_DIR/branches directory.
410
411       All of these also allow you to omit the refspec from the command line
412       because they each contain a refspec which git will use by default.
413
414   Named remote in configuration file
415       You can choose to provide the name of a remote which you had previously
416       configured using git-remote(1), git-config(1) or even by a manual edit
417       to the $GIT_DIR/config file. The URL of this remote will be used to
418       access the repository. The refspec of this remote will be used by
419       default when you do not provide a refspec on the command line. The
420       entry in the config file would appear like this:
421
422                   [remote "<name>"]
423                           url = <url>
424                           pushurl = <pushurl>
425                           push = <refspec>
426                           fetch = <refspec>
427
428
429       The <pushurl> is used for pushes only. It is optional and defaults to
430       <url>.
431
432   Named file in $GIT_DIR/remotes
433       You can choose to provide the name of a file in $GIT_DIR/remotes. The
434       URL in this file will be used to access the repository. The refspec in
435       this file will be used as default when you do not provide a refspec on
436       the command line. This file should have the following format:
437
438                   URL: one of the above URL format
439                   Push: <refspec>
440                   Pull: <refspec>
441
442
443       Push: lines are used by git push and Pull: lines are used by git pull
444       and git fetch. Multiple Push: and Pull: lines may be specified for
445       additional branch mappings.
446
447   Named file in $GIT_DIR/branches
448       You can choose to provide the name of a file in $GIT_DIR/branches. The
449       URL in this file will be used to access the repository. This file
450       should have the following format:
451
452                   <url>#<head>
453
454
455       <url> is required; #<head> is optional.
456
457       Depending on the operation, git will use one of the following refspecs,
458       if you don’t provide one on the command line. <branch> is the name of
459       this file in $GIT_DIR/branches and <head> defaults to master.
460
461       git fetch uses:
462
463                   refs/heads/<head>:refs/heads/<branch>
464
465
466       git push uses:
467
468                   HEAD:refs/heads/<head>
469
470

CONFIGURED REMOTE-TRACKING BRANCHES

472       You often interact with the same remote repository by regularly and
473       repeatedly fetching from it. In order to keep track of the progress of
474       such a remote repository, git fetch allows you to configure
475       remote.<repository>.fetch configuration variables.
476
477       Typically such a variable may look like this:
478
479           [remote "origin"]
480                   fetch = +refs/heads/*:refs/remotes/origin/*
481
482
483       This configuration is used in two ways:
484
485       ·   When git fetch is run without specifying what branches and/or tags
486           to fetch on the command line, e.g.  git fetch origin or git fetch,
487           remote.<repository>.fetch values are used as the refspecs—they
488           specify which refs to fetch and which local refs to update. The
489           example above will fetch all branches that exist in the origin
490           (i.e. any ref that matches the left-hand side of the value,
491           refs/heads/*) and update the corresponding remote-tracking branches
492           in the refs/remotes/origin/* hierarchy.
493
494       ·   When git fetch is run with explicit branches and/or tags to fetch
495           on the command line, e.g.  git fetch origin master, the <refspec>s
496           given on the command line determine what are to be fetched (e.g.
497           master in the example, which is a short-hand for master:, which in
498           turn means "fetch the master branch but I do not explicitly say
499           what remote-tracking branch to update with it from the command
500           line"), and the example command will fetch only the master branch.
501           The remote.<repository>.fetch values determine which
502           remote-tracking branch, if any, is updated. When used in this way,
503           the remote.<repository>.fetch values do not have any effect in
504           deciding what gets fetched (i.e. the values are not used as
505           refspecs when the command-line lists refspecs); they are only used
506           to decide where the refs that are fetched are stored by acting as a
507           mapping.
508
509       The latter use of the remote.<repository>.fetch values can be
510       overridden by giving the --refmap=<refspec> parameter(s) on the command
511       line.
512

PRUNING

514       Git has a default disposition of keeping data unless it’s explicitly
515       thrown away; this extends to holding onto local references to branches
516       on remotes that have themselves deleted those branches.
517
518       If left to accumulate, these stale references might make performance
519       worse on big and busy repos that have a lot of branch churn, and e.g.
520       make the output of commands like git branch -a --contains <commit>
521       needlessly verbose, as well as impacting anything else that’ll work
522       with the complete set of known references.
523
524       These remote-tracking references can be deleted as a one-off with
525       either of:
526
527           # While fetching
528           $ git fetch --prune <name>
529
530           # Only prune, don't fetch
531           $ git remote prune <name>
532
533
534       To prune references as part of your normal workflow without needing to
535       remember to run that, set fetch.prune globally, or remote.<name>.prune
536       per-remote in the config. See git-config(1).
537
538       Here’s where things get tricky and more specific. The pruning feature
539       doesn’t actually care about branches, instead it’ll prune local <→
540       remote-references as a function of the refspec of the remote (see
541       <refspec> and CONFIGURED REMOTE-TRACKING BRANCHES above).
542
543       Therefore if the refspec for the remote includes e.g.
544       refs/tags/*:refs/tags/*, or you manually run e.g. git fetch --prune
545       <name> "refs/tags/*:refs/tags/*" it won’t be stale remote tracking
546       branches that are deleted, but any local tag that doesn’t exist on the
547       remote.
548
549       This might not be what you expect, i.e. you want to prune remote
550       <name>, but also explicitly fetch tags from it, so when you fetch from
551       it you delete all your local tags, most of which may not have come from
552       the <name> remote in the first place.
553
554       So be careful when using this with a refspec like
555       refs/tags/*:refs/tags/*, or any other refspec which might map
556       references from multiple remotes to the same local namespace.
557
558       Since keeping up-to-date with both branches and tags on the remote is a
559       common use-case the --prune-tags option can be supplied along with
560       --prune to prune local tags that don’t exist on the remote, and
561       force-update those tags that differ. Tag pruning can also be enabled
562       with fetch.pruneTags or remote.<name>.pruneTags in the config. See git-
563       config(1).
564
565       The --prune-tags option is equivalent to having refs/tags/*:refs/tags/*
566       declared in the refspecs of the remote. This can lead to some seemingly
567       strange interactions:
568
569           # These both fetch tags
570           $ git fetch --no-tags origin 'refs/tags/*:refs/tags/*'
571           $ git fetch --no-tags --prune-tags origin
572
573
574       The reason it doesn’t error out when provided without --prune or its
575       config versions is for flexibility of the configured versions, and to
576       maintain a 1=1 mapping between what the command line flags do, and what
577       the configuration versions do.
578
579       It’s reasonable to e.g. configure fetch.pruneTags=true in ~/.gitconfig
580       to have tags pruned whenever git fetch --prune is run, without making
581       every invocation of git fetch without --prune an error.
582
583       Pruning tags with --prune-tags also works when fetching a URL instead
584       of a named remote. These will all prune tags not found on origin:
585
586           $ git fetch origin --prune --prune-tags
587           $ git fetch origin --prune 'refs/tags/*:refs/tags/*'
588           $ git fetch <url of origin> --prune --prune-tags
589           $ git fetch <url of origin> --prune 'refs/tags/*:refs/tags/*'
590
591

OUTPUT

593       The output of "git fetch" depends on the transport method used; this
594       section describes the output when fetching over the Git protocol
595       (either locally or via ssh) and Smart HTTP protocol.
596
597       The status of the fetch is output in tabular form, with each line
598       representing the status of a single ref. Each line is of the form:
599
600            <flag> <summary> <from> -> <to> [<reason>]
601
602
603       The status of up-to-date refs is shown only if the --verbose option is
604       used.
605
606       In compact output mode, specified with configuration variable
607       fetch.output, if either entire <from> or <to> is found in the other
608       string, it will be substituted with * in the other string. For example,
609       master -> origin/master becomes master -> origin/*.
610
611       flag
612           A single character indicating the status of the ref:
613
614           (space)
615               for a successfully fetched fast-forward;
616
617           +
618               for a successful forced update;
619
620           -
621               for a successfully pruned ref;
622
623           t
624               for a successful tag update;
625
626           *
627               for a successfully fetched new ref;
628
629           !
630               for a ref that was rejected or failed to update; and
631
632           =
633               for a ref that was up to date and did not need fetching.
634
635       summary
636           For a successfully fetched ref, the summary shows the old and new
637           values of the ref in a form suitable for using as an argument to
638           git log (this is <old>..<new> in most cases, and <old>...<new> for
639           forced non-fast-forward updates).
640
641       from
642           The name of the remote ref being fetched from, minus its
643           refs/<type>/ prefix. In the case of deletion, the name of the
644           remote ref is "(none)".
645
646       to
647           The name of the local ref being updated, minus its refs/<type>/
648           prefix.
649
650       reason
651           A human-readable explanation. In the case of successfully fetched
652           refs, no explanation is needed. For a failed ref, the reason for
653           failure is described.
654

EXAMPLES

656       ·   Update the remote-tracking branches:
657
658               $ git fetch origin
659
660           The above command copies all branches from the remote refs/heads/
661           namespace and stores them to the local refs/remotes/origin/
662           namespace, unless the branch.<name>.fetch option is used to specify
663           a non-default refspec.
664
665       ·   Using refspecs explicitly:
666
667               $ git fetch origin +pu:pu maint:tmp
668
669           This updates (or creates, as necessary) branches pu and tmp in the
670           local repository by fetching from the branches (respectively) pu
671           and maint from the remote repository.
672
673           The pu branch will be updated even if it is does not fast-forward,
674           because it is prefixed with a plus sign; tmp will not be.
675
676       ·   Peek at a remote’s branch, without configuring the remote in your
677           local repository:
678
679               $ git fetch git://git.kernel.org/pub/scm/git/git.git maint
680               $ git log FETCH_HEAD
681
682           The first command fetches the maint branch from the repository at
683           git://git.kernel.org/pub/scm/git/git.git and the second command
684           uses FETCH_HEAD to examine the branch with git-log(1). The fetched
685           objects will eventually be removed by git’s built-in housekeeping
686           (see git-gc(1)).
687

SECURITY

689       The fetch and push protocols are not designed to prevent one side from
690       stealing data from the other repository that was not intended to be
691       shared. If you have private data that you need to protect from a
692       malicious peer, your best option is to store it in another repository.
693       This applies to both clients and servers. In particular, namespaces on
694       a server are not effective for read access control; you should only
695       grant read access to a namespace to clients that you would trust with
696       read access to the entire repository.
697
698       The known attack vectors are as follows:
699
700        1. The victim sends "have" lines advertising the IDs of objects it has
701           that are not explicitly intended to be shared but can be used to
702           optimize the transfer if the peer also has them. The attacker
703           chooses an object ID X to steal and sends a ref to X, but isn’t
704           required to send the content of X because the victim already has
705           it. Now the victim believes that the attacker has X, and it sends
706           the content of X back to the attacker later. (This attack is most
707           straightforward for a client to perform on a server, by creating a
708           ref to X in the namespace the client has access to and then
709           fetching it. The most likely way for a server to perform it on a
710           client is to "merge" X into a public branch and hope that the user
711           does additional work on this branch and pushes it back to the
712           server without noticing the merge.)
713
714        2. As in #1, the attacker chooses an object ID X to steal. The victim
715           sends an object Y that the attacker already has, and the attacker
716           falsely claims to have X and not Y, so the victim sends Y as a
717           delta against X. The delta reveals regions of X that are similar to
718           Y to the attacker.
719

BUGS

721       Using --recurse-submodules can only fetch new commits in already
722       checked out submodules right now. When e.g. upstream added a new
723       submodule in the just fetched commits of the superproject the submodule
724       itself can not be fetched, making it impossible to check out that
725       submodule later without having to do a fetch again. This is expected to
726       be fixed in a future Git version.
727

SEE ALSO

729       git-pull(1)
730

GIT

732       Part of the git(1) suite
733
734
735
736Git 2.20.1                        12/15/2018                      GIT-FETCH(1)
Impressum