1GIT-FETCH(1) Git Manual GIT-FETCH(1)
2
6 git-fetch - Download objects and refs from another repository
7
9 git fetch [<options>] [<repository> [<refspec>...]]
10 git fetch [<options>] <group>
11 git fetch --multiple [<options>] [(<repository> | <group>)...]
12 git fetch --all [<options>]
13
16 Fetch branches and/or tags (collectively, "refs") from one or more
17 other repositories, along with the objects necessary to complete their
18 histories. Remote-tracking branches are updated (see the description of
19 <refspec> below for ways to control this behavior).
20 By default, any tag that points into the histories being fetched is
22 also fetched; the effect is to fetch tags that point at branches that
23 you are interested in. This default behavior can be changed by using
24 the --tags or --no-tags options or by configuring remote.<name>.tagOpt.
25 By using a refspec that fetches tags explicitly, you can fetch tags
26 that do not point into branches you are interested in as well.
27 git fetch can fetch from either a single named repository or URL, or
29 from several repositories at once if <group> is given and there is a
30 remotes.<group> entry in the configuration file. (See git-config(1)).
31 When no remote is specified, by default the origin remote will be used,
33 unless there’s an upstream branch configured for the current branch.
34 The names of refs that are fetched, together with the object names they
36 point at, are written to .git/FETCH_HEAD. This information may be used
37 by scripts or other git commands, such as git-pull(1).
38
40 --all
41 Fetch all remotes.
42 -a, --append
44 Append ref names and object names of fetched refs to the existing
45 contents of .git/FETCH_HEAD. Without this option old data in
46 .git/FETCH_HEAD will be overwritten.
47 --depth=<depth>
49 Limit fetching to the specified number of commits from the tip of
50 each remote branch history. If fetching to a shallow repository
51 created by git clone with --depth=<depth> option (see git-
52 clone(1)), deepen or shorten the history to the specified number of
53 commits. Tags for the deepened commits are not fetched.
54 --deepen=<depth>
56 Similar to --depth, except it specifies the number of commits from
57 the current shallow boundary instead of from the tip of each remote
58 branch history.
59 --shallow-since=<date>
61 Deepen or shorten the history of a shallow repository to include
62 all reachable commits after <date>.
63 --shallow-exclude=<revision>
65 Deepen or shorten the history of a shallow repository to exclude
66 commits reachable from a specified remote branch or tag. This
67 option can be specified multiple times.
68 --unshallow
70 If the source repository is complete, convert a shallow repository
71 to a complete one, removing all the limitations imposed by shallow
72 repositories.
73 If the source repository is shallow, fetch as much as possible so
75 that the current repository has the same history as the source
76 repository.
77 --update-shallow
79 By default when fetching from a shallow repository, git fetch
80 refuses refs that require updating .git/shallow. This option
81 updates .git/shallow and accept such refs.
82 --negotiation-tip=<commit|glob>
84 By default, Git will report, to the server, commits reachable from
85 all local refs to find common commits in an attempt to reduce the
86 size of the to-be-received packfile. If specified, Git will only
87 report commits reachable from the given tips. This is useful to
88 speed up fetches when the user knows which local ref is likely to
89 have commits in common with the upstream ref being fetched.
90 This option may be specified more than once; if so, Git will report
92 commits reachable from any of the given commits.
93 The argument to this option may be a glob on ref names, a ref, or
95 the (possibly abbreviated) SHA-1 of a commit. Specifying a glob is
96 equivalent to specifying this option multiple times, one for each
97 matching ref name.
98 See also the fetch.negotiationAlgorithm configuration variable
100 documented in git-config(1).
101 --dry-run
103 Show what would be done, without making any changes.
104 -f, --force
106 When git fetch is used with <src>:<dst> refspec it may refuse to
107 update the local branch as discussed in the <refspec> part below.
108 This option overrides that check.
109 -k, --keep
111 Keep downloaded pack.
112 --multiple
114 Allow several <repository> and <group> arguments to be specified.
115 No <refspec>s may be specified.
116 --[no-]auto-gc
118 Run git gc --auto at the end to perform garbage collection if
119 needed. This is enabled by default.
120 -p, --prune
122 Before fetching, remove any remote-tracking references that no
123 longer exist on the remote. Tags are not subject to pruning if they
124 are fetched only because of the default tag auto-following or due
125 to a --tags option. However, if tags are fetched due to an explicit
126 refspec (either on the command line or in the remote configuration,
127 for example if the remote was cloned with the --mirror option),
128 then they are also subject to pruning. Supplying --prune-tags is a
129 shorthand for providing the tag refspec.
130 See the PRUNING section below for more details.
132 -P, --prune-tags
134 Before fetching, remove any local tags that no longer exist on the
135 remote if --prune is enabled. This option should be used more
136 carefully, unlike --prune it will remove any local references
137 (local tags) that have been created. This option is a shorthand for
138 providing the explicit tag refspec along with --prune, see the
139 discussion about that in its documentation.
140 See the PRUNING section below for more details.
142 -n, --no-tags
144 By default, tags that point at objects that are downloaded from the
145 remote repository are fetched and stored locally. This option
146 disables this automatic tag following. The default behavior for a
147 remote may be specified with the remote.<name>.tagOpt setting. See
148 git-config(1).
149 --refmap=<refspec>
151 When fetching refs listed on the command line, use the specified
152 refspec (can be given more than once) to map the refs to
153 remote-tracking branches, instead of the values of remote.*.fetch
154 configuration variables for the remote repository. See section on
155 "Configured Remote-tracking Branches" for details.
156 -t, --tags
158 Fetch all tags from the remote (i.e., fetch remote tags refs/tags/*
159 into local tags with the same name), in addition to whatever else
160 would otherwise be fetched. Using this option alone does not
161 subject tags to pruning, even if --prune is used (though tags may
162 be pruned anyway if they are also the destination of an explicit
163 refspec; see --prune).
164 --recurse-submodules[=yes|on-demand|no]
166 This option controls if and under what conditions new commits of
167 populated submodules should be fetched too. It can be used as a
168 boolean option to completely disable recursion when set to no or to
169 unconditionally recurse into all populated submodules when set to
170 yes, which is the default when this option is used without any
171 value. Use on-demand to only recurse into a populated submodule
172 when the superproject retrieves a commit that updates the
173 submodule’s reference to a commit that isn’t already in the local
174 submodule clone.
175 -j, --jobs=<n>
177 Number of parallel children to be used for all forms of fetching.
178 If the --multiple option was specified, the different remotes will
180 be fetched in parallel. If multiple submodules are fetched, they
181 will be fetched in parallel. To control them independently, use the
182 config settings fetch.parallel and submodule.fetchJobs (see git-
183 config(1)).
184 Typically, parallel recursive and multi-remote fetches will be
186 faster. By default fetches are performed sequentially, not in
187 parallel.
188 --no-recurse-submodules
190 Disable recursive fetching of submodules (this has the same effect
191 as using the --recurse-submodules=no option).
192 --set-upstream
194 If the remote is fetched successfully, pull and add upstream
195 (tracking) reference, used by argument-less git-pull(1) and other
196 commands. For more information, see branch.<name>.merge and
197 branch.<name>.remote in git-config(1).
198 --submodule-prefix=<path>
200 Prepend <path> to paths printed in informative messages such as
201 "Fetching submodule foo". This option is used internally when
202 recursing over submodules.
203 --recurse-submodules-default=[yes|on-demand]
205 This option is used internally to temporarily provide a
206 non-negative default value for the --recurse-submodules option. All
207 other methods of configuring fetch’s submodule recursion (such as
208 settings in gitmodules(5) and git-config(1)) override this option,
209 as does specifying --[no-]recurse-submodules directly.
210 -u, --update-head-ok
212 By default git fetch refuses to update the head which corresponds
213 to the current branch. This flag disables the check. This is purely
214 for the internal use for git pull to communicate with git fetch,
215 and unless you are implementing your own Porcelain you are not
216 supposed to use it.
217 --upload-pack <upload-pack>
219 When given, and the repository to fetch from is handled by git
220 fetch-pack, --exec=<upload-pack> is passed to the command to
221 specify non-default path for the command run on the other end.
222 -q, --quiet
224 Pass --quiet to git-fetch-pack and silence any other internally
225 used git commands. Progress is not reported to the standard error
226 stream.
227 -v, --verbose
229 Be verbose.
230 --progress
232 Progress status is reported on the standard error stream by default
233 when it is attached to a terminal, unless -q is specified. This
234 flag forces progress status even if the standard error stream is
235 not directed to a terminal.
236 -o <option>, --server-option=<option>
238 Transmit the given string to the server when communicating using
239 protocol version 2. The given string must not contain a NUL or LF
240 character. The server’s handling of server options, including
241 unknown ones, is server-specific. When multiple
242 --server-option=<option> are given, they are all sent to the other
243 side in the order listed on the command line.
244 --show-forced-updates
246 By default, git checks if a branch is force-updated during fetch.
247 This can be disabled through fetch.showForcedUpdates, but the
248 --show-forced-updates option guarantees this check occurs. See git-
249 config(1).
250 --no-show-forced-updates
252 By default, git checks if a branch is force-updated during fetch.
253 Pass --no-show-forced-updates or set fetch.showForcedUpdates to
254 false to skip this check for performance reasons. If used during
255 git-pull the --ff-only option will still check for forced updates
256 before attempting a fast-forward update. See git-config(1).
257 -4, --ipv4
259 Use IPv4 addresses only, ignoring IPv6 addresses.
260 -6, --ipv6
262 Use IPv6 addresses only, ignoring IPv4 addresses.
263 <repository>
265 The "remote" repository that is the source of a fetch or pull
266 operation. This parameter can be either a URL (see the section GIT
267 URLS below) or the name of a remote (see the section REMOTES
268 below).
269 <group>
271 A name referring to a list of repositories as the value of
272 remotes.<group> in the configuration file. (See git-config(1)).
273 <refspec>
275 Specifies which refs to fetch and which local refs to update. When
276 no <refspec>s appear on the command line, the refs to fetch are
277 read from remote.<repository>.fetch variables instead (see
278 CONFIGURED REMOTE-TRACKING BRANCHES below).
279 The format of a <refspec> parameter is an optional plus +, followed
281 by the source <src>, followed by a colon :, followed by the
282 destination ref <dst>. The colon can be omitted when <dst> is
283 empty. <src> is typically a ref, but it can also be a fully spelled
284 hex object name.
285 tag <tag> means the same as refs/tags/<tag>:refs/tags/<tag>; it
287 requests fetching everything up to the given tag.
288 The remote ref that matches <src> is fetched, and if <dst> is not
290 an empty string, an attempt is made to update the local ref that
291 matches it.
292 Whether that update is allowed without --force depends on the ref
294 namespace it’s being fetched to, the type of object being fetched,
295 and whether the update is considered to be a fast-forward.
296 Generally, the same rules apply for fetching as when pushing, see
297 the <refspec>... section of git-push(1) for what those are.
298 Exceptions to those rules particular to git fetch are noted below.
299 Until Git version 2.20, and unlike when pushing with git-push(1),
301 any updates to refs/tags/* would be accepted without + in the
302 refspec (or --force). When fetching, we promiscuously considered
303 all tag updates from a remote to be forced fetches. Since Git
304 version 2.20, fetching to update refs/tags/* works the same way as
305 when pushing. I.e. any updates will be rejected without + in the
306 refspec (or --force).
307 Unlike when pushing with git-push(1), any updates outside of
309 refs/{tags,heads}/* will be accepted without + in the refspec (or
310 --force), whether that’s swapping e.g. a tree object for a blob, or
311 a commit for another commit that’s doesn’t have the previous commit
312 as an ancestor etc.
313 Unlike when pushing with git-push(1), there is no configuration
315 which’ll amend these rules, and nothing like a pre-fetch hook
316 analogous to the pre-receive hook.
317 As with pushing with git-push(1), all of the rules described above
319 about what’s not allowed as an update can be overridden by adding
320 an the optional leading + to a refspec (or using --force command
321 line option). The only exception to this is that no amount of
322 forcing will make the refs/heads/* namespace accept a non-commit
323 object.
324 Note
326 When the remote branch you want to fetch is known to be rewound
327 and rebased regularly, it is expected that its new tip will not
328 be descendant of its previous tip (as stored in your
329 remote-tracking branch the last time you fetched). You would
330 want to use the + sign to indicate non-fast-forward updates
331 will be needed for such branches. There is no way to determine
332 or declare that a branch will be made available in a repository
333 with this behavior; the pulling user simply must know this is
334 the expected usage pattern for a branch.
335
337 In general, URLs contain information about the transport protocol, the
338 address of the remote server, and the path to the repository. Depending
339 on the transport protocol, some of this information may be absent.
340 Git supports ssh, git, http, and https protocols (in addition, ftp, and
342 ftps can be used for fetching, but this is inefficient and deprecated;
343 do not use it).
344 The native transport (i.e. git:// URL) does no authentication and
346 should be used with caution on unsecured networks.
347 The following syntaxes may be used with them:
349 · ssh://[user@]host.xz[:port]/path/to/repo.git/
351 · git://host.xz[:port]/path/to/repo.git/
353 · http[s]://host.xz[:port]/path/to/repo.git/
355 · ftp[s]://host.xz[:port]/path/to/repo.git/
357 An alternative scp-like syntax may also be used with the ssh protocol:
359 · [user@]host.xz:path/to/repo.git/
361 This syntax is only recognized if there are no slashes before the first
363 colon. This helps differentiate a local path that contains a colon. For
364 example the local path foo:bar could be specified as an absolute path
365 or ./foo:bar to avoid being misinterpreted as an ssh url.
366 The ssh and git protocols additionally support ~username expansion:
368 · ssh://[user@]host.xz[:port]/~[user]/path/to/repo.git/
370 · git://host.xz[:port]/~[user]/path/to/repo.git/
372 · [user@]host.xz:/~[user]/path/to/repo.git/
374 For local repositories, also supported by Git natively, the following
376 syntaxes may be used:
377 · /path/to/repo.git/
379 · file:///path/to/repo.git/
381 These two syntaxes are mostly equivalent, except when cloning, when the
383 former implies --local option. See git-clone(1) for details.
384 When Git doesn’t know how to handle a certain transport protocol, it
386 attempts to use the remote-<transport> remote helper, if one exists. To
387 explicitly request a remote helper, the following syntax may be used:
388 · <transport>::<address>
390 where <address> may be a path, a server and path, or an arbitrary
392 URL-like string recognized by the specific remote helper being invoked.
393 See gitremote-helpers(7) for details.
394 If there are a large number of similarly-named remote repositories and
396 you want to use a different format for them (such that the URLs you use
397 will be rewritten into URLs that work), you can create a configuration
398 section of the form:
399 [url "<actual url base>"]
401 insteadOf = <other url base>
402 For example, with this:
405 [url "git://git.host.xz/"]
407 insteadOf = host.xz:/path/to/
408 insteadOf = work:
409 a URL like "work:repo.git" or like "host.xz:/path/to/repo.git" will be
412 rewritten in any context that takes a URL to be
413 "git://git.host.xz/repo.git".
414 If you want to rewrite URLs for push only, you can create a
416 configuration section of the form:
417 [url "<actual url base>"]
419 pushInsteadOf = <other url base>
420 For example, with this:
423 [url "ssh://example.org/"]
425 pushInsteadOf = git://example.org/
426 a URL like "git://example.org/path/to/repo.git" will be rewritten to
429 "ssh://example.org/path/to/repo.git" for pushes, but pulls will still
430 use the original URL.
431
433 The name of one of the following can be used instead of a URL as
434 <repository> argument:
435 · a remote in the Git configuration file: $GIT_DIR/config,
437 · a file in the $GIT_DIR/remotes directory, or
439 · a file in the $GIT_DIR/branches directory.
441 All of these also allow you to omit the refspec from the command line
443 because they each contain a refspec which git will use by default.
444 Named remote in configuration file
446 You can choose to provide the name of a remote which you had previously
447 configured using git-remote(1), git-config(1) or even by a manual edit
448 to the $GIT_DIR/config file. The URL of this remote will be used to
449 access the repository. The refspec of this remote will be used by
450 default when you do not provide a refspec on the command line. The
451 entry in the config file would appear like this:
452 [remote "<name>"]
454 url = <url>
455 pushurl = <pushurl>
456 push = <refspec>
457 fetch = <refspec>
458 The <pushurl> is used for pushes only. It is optional and defaults to
461 <url>.
462 Named file in $GIT_DIR/remotes
464 You can choose to provide the name of a file in $GIT_DIR/remotes. The
465 URL in this file will be used to access the repository. The refspec in
466 this file will be used as default when you do not provide a refspec on
467 the command line. This file should have the following format:
468 URL: one of the above URL format
470 Push: <refspec>
471 Pull: <refspec>
472 Push: lines are used by git push and Pull: lines are used by git pull
475 and git fetch. Multiple Push: and Pull: lines may be specified for
476 additional branch mappings.
477 Named file in $GIT_DIR/branches
479 You can choose to provide the name of a file in $GIT_DIR/branches. The
480 URL in this file will be used to access the repository. This file
481 should have the following format:
482 <url>#<head>
484 <url> is required; #<head> is optional.
487 Depending on the operation, git will use one of the following refspecs,
489 if you don’t provide one on the command line. <branch> is the name of
490 this file in $GIT_DIR/branches and <head> defaults to master.
491 git fetch uses:
493 refs/heads/<head>:refs/heads/<branch>
495 git push uses:
498 HEAD:refs/heads/<head>
500
503 You often interact with the same remote repository by regularly and
504 repeatedly fetching from it. In order to keep track of the progress of
505 such a remote repository, git fetch allows you to configure
506 remote.<repository>.fetch configuration variables.
507 Typically such a variable may look like this:
509 [remote "origin"]
511 fetch = +refs/heads/*:refs/remotes/origin/*
512 This configuration is used in two ways:
515 · When git fetch is run without specifying what branches and/or tags
517 to fetch on the command line, e.g. git fetch origin or git fetch,
518 remote.<repository>.fetch values are used as the refspecs—they
519 specify which refs to fetch and which local refs to update. The
520 example above will fetch all branches that exist in the origin
521 (i.e. any ref that matches the left-hand side of the value,
522 refs/heads/*) and update the corresponding remote-tracking branches
523 in the refs/remotes/origin/* hierarchy.
524 · When git fetch is run with explicit branches and/or tags to fetch
526 on the command line, e.g. git fetch origin master, the <refspec>s
527 given on the command line determine what are to be fetched (e.g.
528 master in the example, which is a short-hand for master:, which in
529 turn means "fetch the master branch but I do not explicitly say
530 what remote-tracking branch to update with it from the command
531 line"), and the example command will fetch only the master branch.
532 The remote.<repository>.fetch values determine which
533 remote-tracking branch, if any, is updated. When used in this way,
534 the remote.<repository>.fetch values do not have any effect in
535 deciding what gets fetched (i.e. the values are not used as
536 refspecs when the command-line lists refspecs); they are only used
537 to decide where the refs that are fetched are stored by acting as a
538 mapping.
539 The latter use of the remote.<repository>.fetch values can be
541 overridden by giving the --refmap=<refspec> parameter(s) on the command
542 line.
543
545 Git has a default disposition of keeping data unless it’s explicitly
546 thrown away; this extends to holding onto local references to branches
547 on remotes that have themselves deleted those branches.
548 If left to accumulate, these stale references might make performance
550 worse on big and busy repos that have a lot of branch churn, and e.g.
551 make the output of commands like git branch -a --contains <commit>
552 needlessly verbose, as well as impacting anything else that’ll work
553 with the complete set of known references.
554 These remote-tracking references can be deleted as a one-off with
556 either of:
557 # While fetching
559 $ git fetch --prune <name>
560 # Only prune, don't fetch
562 $ git remote prune <name>
563 To prune references as part of your normal workflow without needing to
566 remember to run that, set fetch.prune globally, or remote.<name>.prune
567 per-remote in the config. See git-config(1).
568 Here’s where things get tricky and more specific. The pruning feature
570 doesn’t actually care about branches, instead it’ll prune local <→
571 remote-references as a function of the refspec of the remote (see
572 <refspec> and CONFIGURED REMOTE-TRACKING BRANCHES above).
573 Therefore if the refspec for the remote includes e.g.
575 refs/tags/*:refs/tags/*, or you manually run e.g. git fetch --prune
576 <name> "refs/tags/*:refs/tags/*" it won’t be stale remote tracking
577 branches that are deleted, but any local tag that doesn’t exist on the
578 remote.
579 This might not be what you expect, i.e. you want to prune remote
581 <name>, but also explicitly fetch tags from it, so when you fetch from
582 it you delete all your local tags, most of which may not have come from
583 the <name> remote in the first place.
584 So be careful when using this with a refspec like
586 refs/tags/*:refs/tags/*, or any other refspec which might map
587 references from multiple remotes to the same local namespace.
588 Since keeping up-to-date with both branches and tags on the remote is a
590 common use-case the --prune-tags option can be supplied along with
591 --prune to prune local tags that don’t exist on the remote, and
592 force-update those tags that differ. Tag pruning can also be enabled
593 with fetch.pruneTags or remote.<name>.pruneTags in the config. See git-
594 config(1).
595 The --prune-tags option is equivalent to having refs/tags/*:refs/tags/*
597 declared in the refspecs of the remote. This can lead to some seemingly
598 strange interactions:
599 # These both fetch tags
601 $ git fetch --no-tags origin 'refs/tags/*:refs/tags/*'
602 $ git fetch --no-tags --prune-tags origin
603 The reason it doesn’t error out when provided without --prune or its
606 config versions is for flexibility of the configured versions, and to
607 maintain a 1=1 mapping between what the command line flags do, and what
608 the configuration versions do.
609 It’s reasonable to e.g. configure fetch.pruneTags=true in ~/.gitconfig
611 to have tags pruned whenever git fetch --prune is run, without making
612 every invocation of git fetch without --prune an error.
613 Pruning tags with --prune-tags also works when fetching a URL instead
615 of a named remote. These will all prune tags not found on origin:
616 $ git fetch origin --prune --prune-tags
618 $ git fetch origin --prune 'refs/tags/*:refs/tags/*'
619 $ git fetch <url of origin> --prune --prune-tags
620 $ git fetch <url of origin> --prune 'refs/tags/*:refs/tags/*'
621
624 The output of "git fetch" depends on the transport method used; this
625 section describes the output when fetching over the Git protocol
626 (either locally or via ssh) and Smart HTTP protocol.
627 The status of the fetch is output in tabular form, with each line
629 representing the status of a single ref. Each line is of the form:
630 <flag> <summary> <from> -> <to> [<reason>]
632 The status of up-to-date refs is shown only if the --verbose option is
635 used.
636 In compact output mode, specified with configuration variable
638 fetch.output, if either entire <from> or <to> is found in the other
639 string, it will be substituted with * in the other string. For example,
640 master -> origin/master becomes master -> origin/*.
641 flag
643 A single character indicating the status of the ref:
644 (space)
646 for a successfully fetched fast-forward;
647 +
649 for a successful forced update;
650 -
652 for a successfully pruned ref;
653 t
655 for a successful tag update;
656 *
658 for a successfully fetched new ref;
659 !
661 for a ref that was rejected or failed to update; and
662 =
664 for a ref that was up to date and did not need fetching.
665 summary
667 For a successfully fetched ref, the summary shows the old and new
668 values of the ref in a form suitable for using as an argument to
669 git log (this is <old>..<new> in most cases, and <old>...<new> for
670 forced non-fast-forward updates).
671 from
673 The name of the remote ref being fetched from, minus its
674 refs/<type>/ prefix. In the case of deletion, the name of the
675 remote ref is "(none)".
676 to
678 The name of the local ref being updated, minus its refs/<type>/
679 prefix.
680 reason
682 A human-readable explanation. In the case of successfully fetched
683 refs, no explanation is needed. For a failed ref, the reason for
684 failure is described.
685
687 · Update the remote-tracking branches:
688 $ git fetch origin
690 The above command copies all branches from the remote refs/heads/
692 namespace and stores them to the local refs/remotes/origin/
693 namespace, unless the branch.<name>.fetch option is used to specify
694 a non-default refspec.
695 · Using refspecs explicitly:
697 $ git fetch origin +pu:pu maint:tmp
699 This updates (or creates, as necessary) branches pu and tmp in the
701 local repository by fetching from the branches (respectively) pu
702 and maint from the remote repository.
703 The pu branch will be updated even if it does not fast-forward,
705 because it is prefixed with a plus sign; tmp will not be.
706 · Peek at a remote’s branch, without configuring the remote in your
708 local repository:
709 $ git fetch git://git.kernel.org/pub/scm/git/git.git maint
711 $ git log FETCH_HEAD
712 The first command fetches the maint branch from the repository at
714 git://git.kernel.org/pub/scm/git/git.git and the second command
715 uses FETCH_HEAD to examine the branch with git-log(1). The fetched
716 objects will eventually be removed by git’s built-in housekeeping
717 (see git-gc(1)).
718
720 The fetch and push protocols are not designed to prevent one side from
721 stealing data from the other repository that was not intended to be
722 shared. If you have private data that you need to protect from a
723 malicious peer, your best option is to store it in another repository.
724 This applies to both clients and servers. In particular, namespaces on
725 a server are not effective for read access control; you should only
726 grant read access to a namespace to clients that you would trust with
727 read access to the entire repository.
728 The known attack vectors are as follows:
730 1. The victim sends "have" lines advertising the IDs of objects it has
732 that are not explicitly intended to be shared but can be used to
733 optimize the transfer if the peer also has them. The attacker
734 chooses an object ID X to steal and sends a ref to X, but isn’t
735 required to send the content of X because the victim already has
736 it. Now the victim believes that the attacker has X, and it sends
737 the content of X back to the attacker later. (This attack is most
738 straightforward for a client to perform on a server, by creating a
739 ref to X in the namespace the client has access to and then
740 fetching it. The most likely way for a server to perform it on a
741 client is to "merge" X into a public branch and hope that the user
742 does additional work on this branch and pushes it back to the
743 server without noticing the merge.)
744 2. As in #1, the attacker chooses an object ID X to steal. The victim
746 sends an object Y that the attacker already has, and the attacker
747 falsely claims to have X and not Y, so the victim sends Y as a
748 delta against X. The delta reveals regions of X that are similar to
749 Y to the attacker.
750
752 Using --recurse-submodules can only fetch new commits in already
753 checked out submodules right now. When e.g. upstream added a new
754 submodule in the just fetched commits of the superproject the submodule
755 itself cannot be fetched, making it impossible to check out that
756 submodule later without having to do a fetch again. This is expected to
757 be fixed in a future Git version.
758
760 git-pull(1)
761
763 Part of the git(1) suite
764Git 2.24.1 12/10/2019 GIT-FETCH(1)