1GIT-FETCH(1) Git Manual GIT-FETCH(1)
2
6 git-fetch - Download objects and refs from another repository
7
9 git fetch [<options>] [<repository> [<refspec>...]]
10 git fetch [<options>] <group>
11 git fetch --multiple [<options>] [(<repository> | <group>)...]
12 git fetch --all [<options>]
13
15 Fetch branches and/or tags (collectively, "refs") from one or more
16 other repositories, along with the objects necessary to complete their
17 histories. Remote-tracking branches are updated (see the description of
18 <refspec> below for ways to control this behavior).
19 By default, any tag that points into the histories being fetched is
21 also fetched; the effect is to fetch tags that point at branches that
22 you are interested in. This default behavior can be changed by using
23 the --tags or --no-tags options or by configuring remote.<name>.tagOpt.
24 By using a refspec that fetches tags explicitly, you can fetch tags
25 that do not point into branches you are interested in as well.
26 git fetch can fetch from either a single named repository or URL, or
28 from several repositories at once if <group> is given and there is a
29 remotes.<group> entry in the configuration file. (See git-config(1)).
30 When no remote is specified, by default the origin remote will be used,
32 unless there’s an upstream branch configured for the current branch.
33 The names of refs that are fetched, together with the object names they
35 point at, are written to .git/FETCH_HEAD. This information may be used
36 by scripts or other git commands, such as git-pull(1).
37
39 --all
40 Fetch all remotes.
41 -a, --append
43 Append ref names and object names of fetched refs to the existing
44 contents of .git/FETCH_HEAD. Without this option old data in
45 .git/FETCH_HEAD will be overwritten.
46 --depth=<depth>
48 Limit fetching to the specified number of commits from the tip of
49 each remote branch history. If fetching to a shallow repository
50 created by git clone with --depth=<depth> option (see git-
51 clone(1)), deepen or shorten the history to the specified number of
52 commits. Tags for the deepened commits are not fetched.
53 --deepen=<depth>
55 Similar to --depth, except it specifies the number of commits from
56 the current shallow boundary instead of from the tip of each remote
57 branch history.
58 --shallow-since=<date>
60 Deepen or shorten the history of a shallow repository to include
61 all reachable commits after <date>.
62 --shallow-exclude=<revision>
64 Deepen or shorten the history of a shallow repository to exclude
65 commits reachable from a specified remote branch or tag. This
66 option can be specified multiple times.
67 --unshallow
69 If the source repository is complete, convert a shallow repository
70 to a complete one, removing all the limitations imposed by shallow
71 repositories.
72 If the source repository is shallow, fetch as much as possible so
74 that the current repository has the same history as the source
75 repository.
76 --update-shallow
78 By default when fetching from a shallow repository, git fetch
79 refuses refs that require updating .git/shallow. This option
80 updates .git/shallow and accept such refs.
81 --negotiation-tip=<commit|glob>
83 By default, Git will report, to the server, commits reachable from
84 all local refs to find common commits in an attempt to reduce the
85 size of the to-be-received packfile. If specified, Git will only
86 report commits reachable from the given tips. This is useful to
87 speed up fetches when the user knows which local ref is likely to
88 have commits in common with the upstream ref being fetched.
89 This option may be specified more than once; if so, Git will report
91 commits reachable from any of the given commits.
92 The argument to this option may be a glob on ref names, a ref, or
94 the (possibly abbreviated) SHA-1 of a commit. Specifying a glob is
95 equivalent to specifying this option multiple times, one for each
96 matching ref name.
97 See also the fetch.negotiationAlgorithm configuration variable
99 documented in git-config(1).
100 --dry-run
102 Show what would be done, without making any changes.
103 -f, --force
105 When git fetch is used with <src>:<dst> refspec it may refuse to
106 update the local branch as discussed in the <refspec> part below.
107 This option overrides that check.
108 -k, --keep
110 Keep downloaded pack.
111 --multiple
113 Allow several <repository> and <group> arguments to be specified.
114 No <refspec>s may be specified.
115 --[no-]auto-gc
117 Run git gc --auto at the end to perform garbage collection if
118 needed. This is enabled by default.
119 --[no-]write-commit-graph
121 Write a commit-graph after fetching. This overrides the config
122 setting fetch.writeCommitGraph.
123 -p, --prune
125 Before fetching, remove any remote-tracking references that no
126 longer exist on the remote. Tags are not subject to pruning if they
127 are fetched only because of the default tag auto-following or due
128 to a --tags option. However, if tags are fetched due to an explicit
129 refspec (either on the command line or in the remote configuration,
130 for example if the remote was cloned with the --mirror option),
131 then they are also subject to pruning. Supplying --prune-tags is a
132 shorthand for providing the tag refspec.
133 See the PRUNING section below for more details.
135 -P, --prune-tags
137 Before fetching, remove any local tags that no longer exist on the
138 remote if --prune is enabled. This option should be used more
139 carefully, unlike --prune it will remove any local references
140 (local tags) that have been created. This option is a shorthand for
141 providing the explicit tag refspec along with --prune, see the
142 discussion about that in its documentation.
143 See the PRUNING section below for more details.
145 -n, --no-tags
147 By default, tags that point at objects that are downloaded from the
148 remote repository are fetched and stored locally. This option
149 disables this automatic tag following. The default behavior for a
150 remote may be specified with the remote.<name>.tagOpt setting. See
151 git-config(1).
152 --refmap=<refspec>
154 When fetching refs listed on the command line, use the specified
155 refspec (can be given more than once) to map the refs to
156 remote-tracking branches, instead of the values of remote.*.fetch
157 configuration variables for the remote repository. Providing an
158 empty <refspec> to the --refmap option causes Git to ignore the
159 configured refspecs and rely entirely on the refspecs supplied as
160 command-line arguments. See section on "Configured Remote-tracking
161 Branches" for details.
162 -t, --tags
164 Fetch all tags from the remote (i.e., fetch remote tags refs/tags/*
165 into local tags with the same name), in addition to whatever else
166 would otherwise be fetched. Using this option alone does not
167 subject tags to pruning, even if --prune is used (though tags may
168 be pruned anyway if they are also the destination of an explicit
169 refspec; see --prune).
170 --recurse-submodules[=yes|on-demand|no]
172 This option controls if and under what conditions new commits of
173 populated submodules should be fetched too. It can be used as a
174 boolean option to completely disable recursion when set to no or to
175 unconditionally recurse into all populated submodules when set to
176 yes, which is the default when this option is used without any
177 value. Use on-demand to only recurse into a populated submodule
178 when the superproject retrieves a commit that updates the
179 submodule’s reference to a commit that isn’t already in the local
180 submodule clone.
181 -j, --jobs=<n>
183 Number of parallel children to be used for all forms of fetching.
184 If the --multiple option was specified, the different remotes will
186 be fetched in parallel. If multiple submodules are fetched, they
187 will be fetched in parallel. To control them independently, use the
188 config settings fetch.parallel and submodule.fetchJobs (see git-
189 config(1)).
190 Typically, parallel recursive and multi-remote fetches will be
192 faster. By default fetches are performed sequentially, not in
193 parallel.
194 --no-recurse-submodules
196 Disable recursive fetching of submodules (this has the same effect
197 as using the --recurse-submodules=no option).
198 --set-upstream
200 If the remote is fetched successfully, pull and add upstream
201 (tracking) reference, used by argument-less git-pull(1) and other
202 commands. For more information, see branch.<name>.merge and
203 branch.<name>.remote in git-config(1).
204 --submodule-prefix=<path>
206 Prepend <path> to paths printed in informative messages such as
207 "Fetching submodule foo". This option is used internally when
208 recursing over submodules.
209 --recurse-submodules-default=[yes|on-demand]
211 This option is used internally to temporarily provide a
212 non-negative default value for the --recurse-submodules option. All
213 other methods of configuring fetch’s submodule recursion (such as
214 settings in gitmodules(5) and git-config(1)) override this option,
215 as does specifying --[no-]recurse-submodules directly.
216 -u, --update-head-ok
218 By default git fetch refuses to update the head which corresponds
219 to the current branch. This flag disables the check. This is purely
220 for the internal use for git pull to communicate with git fetch,
221 and unless you are implementing your own Porcelain you are not
222 supposed to use it.
223 --upload-pack <upload-pack>
225 When given, and the repository to fetch from is handled by git
226 fetch-pack, --exec=<upload-pack> is passed to the command to
227 specify non-default path for the command run on the other end.
228 -q, --quiet
230 Pass --quiet to git-fetch-pack and silence any other internally
231 used git commands. Progress is not reported to the standard error
232 stream.
233 -v, --verbose
235 Be verbose.
236 --progress
238 Progress status is reported on the standard error stream by default
239 when it is attached to a terminal, unless -q is specified. This
240 flag forces progress status even if the standard error stream is
241 not directed to a terminal.
242 -o <option>, --server-option=<option>
244 Transmit the given string to the server when communicating using
245 protocol version 2. The given string must not contain a NUL or LF
246 character. The server’s handling of server options, including
247 unknown ones, is server-specific. When multiple
248 --server-option=<option> are given, they are all sent to the other
249 side in the order listed on the command line.
250 --show-forced-updates
252 By default, git checks if a branch is force-updated during fetch.
253 This can be disabled through fetch.showForcedUpdates, but the
254 --show-forced-updates option guarantees this check occurs. See git-
255 config(1).
256 --no-show-forced-updates
258 By default, git checks if a branch is force-updated during fetch.
259 Pass --no-show-forced-updates or set fetch.showForcedUpdates to
260 false to skip this check for performance reasons. If used during
261 git-pull the --ff-only option will still check for forced updates
262 before attempting a fast-forward update. See git-config(1).
263 -4, --ipv4
265 Use IPv4 addresses only, ignoring IPv6 addresses.
266 -6, --ipv6
268 Use IPv6 addresses only, ignoring IPv4 addresses.
269 <repository>
271 The "remote" repository that is the source of a fetch or pull
272 operation. This parameter can be either a URL (see the section GIT
273 URLS below) or the name of a remote (see the section REMOTES
274 below).
275 <group>
277 A name referring to a list of repositories as the value of
278 remotes.<group> in the configuration file. (See git-config(1)).
279 <refspec>
281 Specifies which refs to fetch and which local refs to update. When
282 no <refspec>s appear on the command line, the refs to fetch are
283 read from remote.<repository>.fetch variables instead (see
284 CONFIGURED REMOTE-TRACKING BRANCHES below).
285 The format of a <refspec> parameter is an optional plus +, followed
287 by the source <src>, followed by a colon :, followed by the
288 destination ref <dst>. The colon can be omitted when <dst> is
289 empty. <src> is typically a ref, but it can also be a fully spelled
290 hex object name.
291 tag <tag> means the same as refs/tags/<tag>:refs/tags/<tag>; it
293 requests fetching everything up to the given tag.
294 The remote ref that matches <src> is fetched, and if <dst> is not
296 an empty string, an attempt is made to update the local ref that
297 matches it.
298 Whether that update is allowed without --force depends on the ref
300 namespace it’s being fetched to, the type of object being fetched,
301 and whether the update is considered to be a fast-forward.
302 Generally, the same rules apply for fetching as when pushing, see
303 the <refspec>... section of git-push(1) for what those are.
304 Exceptions to those rules particular to git fetch are noted below.
305 Until Git version 2.20, and unlike when pushing with git-push(1),
307 any updates to refs/tags/* would be accepted without + in the
308 refspec (or --force). When fetching, we promiscuously considered
309 all tag updates from a remote to be forced fetches. Since Git
310 version 2.20, fetching to update refs/tags/* works the same way as
311 when pushing. I.e. any updates will be rejected without + in the
312 refspec (or --force).
313 Unlike when pushing with git-push(1), any updates outside of
315 refs/{tags,heads}/* will be accepted without + in the refspec (or
316 --force), whether that’s swapping e.g. a tree object for a blob, or
317 a commit for another commit that’s doesn’t have the previous commit
318 as an ancestor etc.
319 Unlike when pushing with git-push(1), there is no configuration
321 which’ll amend these rules, and nothing like a pre-fetch hook
322 analogous to the pre-receive hook.
323 As with pushing with git-push(1), all of the rules described above
325 about what’s not allowed as an update can be overridden by adding
326 an the optional leading + to a refspec (or using --force command
327 line option). The only exception to this is that no amount of
328 forcing will make the refs/heads/* namespace accept a non-commit
329 object.
330 Note
332 When the remote branch you want to fetch is known to be rewound
333 and rebased regularly, it is expected that its new tip will not
334 be descendant of its previous tip (as stored in your
335 remote-tracking branch the last time you fetched). You would
336 want to use the + sign to indicate non-fast-forward updates
337 will be needed for such branches. There is no way to determine
338 or declare that a branch will be made available in a repository
339 with this behavior; the pulling user simply must know this is
340 the expected usage pattern for a branch.
341
343 In general, URLs contain information about the transport protocol, the
344 address of the remote server, and the path to the repository. Depending
345 on the transport protocol, some of this information may be absent.
346 Git supports ssh, git, http, and https protocols (in addition, ftp, and
348 ftps can be used for fetching, but this is inefficient and deprecated;
349 do not use it).
350 The native transport (i.e. git:// URL) does no authentication and
352 should be used with caution on unsecured networks.
353 The following syntaxes may be used with them:
355 · ssh://[user@]host.xz[:port]/path/to/repo.git/
357 · git://host.xz[:port]/path/to/repo.git/
359 · http[s]://host.xz[:port]/path/to/repo.git/
361 · ftp[s]://host.xz[:port]/path/to/repo.git/
363 An alternative scp-like syntax may also be used with the ssh protocol:
365 · [user@]host.xz:path/to/repo.git/
367 This syntax is only recognized if there are no slashes before the first
369 colon. This helps differentiate a local path that contains a colon. For
370 example the local path foo:bar could be specified as an absolute path
371 or ./foo:bar to avoid being misinterpreted as an ssh url.
372 The ssh and git protocols additionally support ~username expansion:
374 · ssh://[user@]host.xz[:port]/~[user]/path/to/repo.git/
376 · git://host.xz[:port]/~[user]/path/to/repo.git/
378 · [user@]host.xz:/~[user]/path/to/repo.git/
380 For local repositories, also supported by Git natively, the following
382 syntaxes may be used:
383 · /path/to/repo.git/
385 · file:///path/to/repo.git/
387 These two syntaxes are mostly equivalent, except when cloning, when the
389 former implies --local option. See git-clone(1) for details.
390 git clone, git fetch and git pull, but not git push, will also accept a
392 suitable bundle file. See git-bundle(1).
393 When Git doesn’t know how to handle a certain transport protocol, it
395 attempts to use the remote-<transport> remote helper, if one exists. To
396 explicitly request a remote helper, the following syntax may be used:
397 · <transport>::<address>
399 where <address> may be a path, a server and path, or an arbitrary
401 URL-like string recognized by the specific remote helper being invoked.
402 See gitremote-helpers(7) for details.
403 If there are a large number of similarly-named remote repositories and
405 you want to use a different format for them (such that the URLs you use
406 will be rewritten into URLs that work), you can create a configuration
407 section of the form:
408 [url "<actual url base>"]
410 insteadOf = <other url base>
411 For example, with this:
413 [url "git://git.host.xz/"]
415 insteadOf = host.xz:/path/to/
416 insteadOf = work:
417 a URL like "work:repo.git" or like "host.xz:/path/to/repo.git" will be
419 rewritten in any context that takes a URL to be
420 "git://git.host.xz/repo.git".
421 If you want to rewrite URLs for push only, you can create a
423 configuration section of the form:
424 [url "<actual url base>"]
426 pushInsteadOf = <other url base>
427 For example, with this:
429 [url "ssh://example.org/"]
431 pushInsteadOf = git://example.org/
432 a URL like "git://example.org/path/to/repo.git" will be rewritten to
434 "ssh://example.org/path/to/repo.git" for pushes, but pulls will still
435 use the original URL.
436
438 The name of one of the following can be used instead of a URL as
439 <repository> argument:
440 · a remote in the Git configuration file: $GIT_DIR/config,
442 · a file in the $GIT_DIR/remotes directory, or
444 · a file in the $GIT_DIR/branches directory.
446 All of these also allow you to omit the refspec from the command line
448 because they each contain a refspec which git will use by default.
449 Named remote in configuration file
451 You can choose to provide the name of a remote which you had previously
452 configured using git-remote(1), git-config(1) or even by a manual edit
453 to the $GIT_DIR/config file. The URL of this remote will be used to
454 access the repository. The refspec of this remote will be used by
455 default when you do not provide a refspec on the command line. The
456 entry in the config file would appear like this:
457 [remote "<name>"]
459 url = <url>
460 pushurl = <pushurl>
461 push = <refspec>
462 fetch = <refspec>
463 The <pushurl> is used for pushes only. It is optional and defaults to
465 <url>.
466 Named file in $GIT_DIR/remotes
468 You can choose to provide the name of a file in $GIT_DIR/remotes. The
469 URL in this file will be used to access the repository. The refspec in
470 this file will be used as default when you do not provide a refspec on
471 the command line. This file should have the following format:
472 URL: one of the above URL format
474 Push: <refspec>
475 Pull: <refspec>
476 Push: lines are used by git push and Pull: lines are used by git pull
478 and git fetch. Multiple Push: and Pull: lines may be specified for
479 additional branch mappings.
480 Named file in $GIT_DIR/branches
482 You can choose to provide the name of a file in $GIT_DIR/branches. The
483 URL in this file will be used to access the repository. This file
484 should have the following format:
485 <url>#<head>
487 <url> is required; #<head> is optional.
489 Depending on the operation, git will use one of the following refspecs,
491 if you don’t provide one on the command line. <branch> is the name of
492 this file in $GIT_DIR/branches and <head> defaults to master.
493 git fetch uses:
495 refs/heads/<head>:refs/heads/<branch>
497 git push uses:
499 HEAD:refs/heads/<head>
501
503 You often interact with the same remote repository by regularly and
504 repeatedly fetching from it. In order to keep track of the progress of
505 such a remote repository, git fetch allows you to configure
506 remote.<repository>.fetch configuration variables.
507 Typically such a variable may look like this:
509 [remote "origin"]
511 fetch = +refs/heads/*:refs/remotes/origin/*
512 This configuration is used in two ways:
514 · When git fetch is run without specifying what branches and/or tags
516 to fetch on the command line, e.g. git fetch origin or git fetch,
517 remote.<repository>.fetch values are used as the refspecs—they
518 specify which refs to fetch and which local refs to update. The
519 example above will fetch all branches that exist in the origin
520 (i.e. any ref that matches the left-hand side of the value,
521 refs/heads/*) and update the corresponding remote-tracking branches
522 in the refs/remotes/origin/* hierarchy.
523 · When git fetch is run with explicit branches and/or tags to fetch
525 on the command line, e.g. git fetch origin master, the <refspec>s
526 given on the command line determine what are to be fetched (e.g.
527 master in the example, which is a short-hand for master:, which in
528 turn means "fetch the master branch but I do not explicitly say
529 what remote-tracking branch to update with it from the command
530 line"), and the example command will fetch only the master branch.
531 The remote.<repository>.fetch values determine which
532 remote-tracking branch, if any, is updated. When used in this way,
533 the remote.<repository>.fetch values do not have any effect in
534 deciding what gets fetched (i.e. the values are not used as
535 refspecs when the command-line lists refspecs); they are only used
536 to decide where the refs that are fetched are stored by acting as a
537 mapping.
538 The latter use of the remote.<repository>.fetch values can be
540 overridden by giving the --refmap=<refspec> parameter(s) on the command
541 line.
542
544 Git has a default disposition of keeping data unless it’s explicitly
545 thrown away; this extends to holding onto local references to branches
546 on remotes that have themselves deleted those branches.
547 If left to accumulate, these stale references might make performance
549 worse on big and busy repos that have a lot of branch churn, and e.g.
550 make the output of commands like git branch -a --contains <commit>
551 needlessly verbose, as well as impacting anything else that’ll work
552 with the complete set of known references.
553 These remote-tracking references can be deleted as a one-off with
555 either of:
556 # While fetching
558 $ git fetch --prune <name>
559 # Only prune, don't fetch
561 $ git remote prune <name>
562 To prune references as part of your normal workflow without needing to
564 remember to run that, set fetch.prune globally, or remote.<name>.prune
565 per-remote in the config. See git-config(1).
566 Here’s where things get tricky and more specific. The pruning feature
568 doesn’t actually care about branches, instead it’ll prune local <→
569 remote-references as a function of the refspec of the remote (see
570 <refspec> and CONFIGURED REMOTE-TRACKING BRANCHES above).
571 Therefore if the refspec for the remote includes e.g.
573 refs/tags/*:refs/tags/*, or you manually run e.g. git fetch --prune
574 <name> "refs/tags/*:refs/tags/*" it won’t be stale remote tracking
575 branches that are deleted, but any local tag that doesn’t exist on the
576 remote.
577 This might not be what you expect, i.e. you want to prune remote
579 <name>, but also explicitly fetch tags from it, so when you fetch from
580 it you delete all your local tags, most of which may not have come from
581 the <name> remote in the first place.
582 So be careful when using this with a refspec like
584 refs/tags/*:refs/tags/*, or any other refspec which might map
585 references from multiple remotes to the same local namespace.
586 Since keeping up-to-date with both branches and tags on the remote is a
588 common use-case the --prune-tags option can be supplied along with
589 --prune to prune local tags that don’t exist on the remote, and
590 force-update those tags that differ. Tag pruning can also be enabled
591 with fetch.pruneTags or remote.<name>.pruneTags in the config. See git-
592 config(1).
593 The --prune-tags option is equivalent to having refs/tags/*:refs/tags/*
595 declared in the refspecs of the remote. This can lead to some seemingly
596 strange interactions:
597 # These both fetch tags
599 $ git fetch --no-tags origin 'refs/tags/*:refs/tags/*'
600 $ git fetch --no-tags --prune-tags origin
601 The reason it doesn’t error out when provided without --prune or its
603 config versions is for flexibility of the configured versions, and to
604 maintain a 1=1 mapping between what the command line flags do, and what
605 the configuration versions do.
606 It’s reasonable to e.g. configure fetch.pruneTags=true in ~/.gitconfig
608 to have tags pruned whenever git fetch --prune is run, without making
609 every invocation of git fetch without --prune an error.
610 Pruning tags with --prune-tags also works when fetching a URL instead
612 of a named remote. These will all prune tags not found on origin:
613 $ git fetch origin --prune --prune-tags
615 $ git fetch origin --prune 'refs/tags/*:refs/tags/*'
616 $ git fetch <url of origin> --prune --prune-tags
617 $ git fetch <url of origin> --prune 'refs/tags/*:refs/tags/*'
618
620 The output of "git fetch" depends on the transport method used; this
621 section describes the output when fetching over the Git protocol
622 (either locally or via ssh) and Smart HTTP protocol.
623 The status of the fetch is output in tabular form, with each line
625 representing the status of a single ref. Each line is of the form:
626 <flag> <summary> <from> -> <to> [<reason>]
628 The status of up-to-date refs is shown only if the --verbose option is
630 used.
631 In compact output mode, specified with configuration variable
633 fetch.output, if either entire <from> or <to> is found in the other
634 string, it will be substituted with * in the other string. For example,
635 master -> origin/master becomes master -> origin/*.
636 flag
638 A single character indicating the status of the ref:
639 (space)
641 for a successfully fetched fast-forward;
642 +
644 for a successful forced update;
645 -
647 for a successfully pruned ref;
648 t
650 for a successful tag update;
651 *
653 for a successfully fetched new ref;
654 !
656 for a ref that was rejected or failed to update; and
657 =
659 for a ref that was up to date and did not need fetching.
660 summary
662 For a successfully fetched ref, the summary shows the old and new
663 values of the ref in a form suitable for using as an argument to
664 git log (this is <old>..<new> in most cases, and <old>...<new> for
665 forced non-fast-forward updates).
666 from
668 The name of the remote ref being fetched from, minus its
669 refs/<type>/ prefix. In the case of deletion, the name of the
670 remote ref is "(none)".
671 to
673 The name of the local ref being updated, minus its refs/<type>/
674 prefix.
675 reason
677 A human-readable explanation. In the case of successfully fetched
678 refs, no explanation is needed. For a failed ref, the reason for
679 failure is described.
680
682 · Update the remote-tracking branches:
683 $ git fetch origin
685 The above command copies all branches from the remote refs/heads/
687 namespace and stores them to the local refs/remotes/origin/
688 namespace, unless the branch.<name>.fetch option is used to specify
689 a non-default refspec.
690 · Using refspecs explicitly:
692 $ git fetch origin +pu:pu maint:tmp
694 This updates (or creates, as necessary) branches pu and tmp in the
696 local repository by fetching from the branches (respectively) pu
697 and maint from the remote repository.
698 The pu branch will be updated even if it does not fast-forward,
700 because it is prefixed with a plus sign; tmp will not be.
701 · Peek at a remote’s branch, without configuring the remote in your
703 local repository:
704 $ git fetch git://git.kernel.org/pub/scm/git/git.git maint
706 $ git log FETCH_HEAD
707 The first command fetches the maint branch from the repository at
709 git://git.kernel.org/pub/scm/git/git.git and the second command
710 uses FETCH_HEAD to examine the branch with git-log(1). The fetched
711 objects will eventually be removed by git’s built-in housekeeping
712 (see git-gc(1)).
713
715 The fetch and push protocols are not designed to prevent one side from
716 stealing data from the other repository that was not intended to be
717 shared. If you have private data that you need to protect from a
718 malicious peer, your best option is to store it in another repository.
719 This applies to both clients and servers. In particular, namespaces on
720 a server are not effective for read access control; you should only
721 grant read access to a namespace to clients that you would trust with
722 read access to the entire repository.
723 The known attack vectors are as follows:
725 1. The victim sends "have" lines advertising the IDs of objects it has
727 that are not explicitly intended to be shared but can be used to
728 optimize the transfer if the peer also has them. The attacker
729 chooses an object ID X to steal and sends a ref to X, but isn’t
730 required to send the content of X because the victim already has
731 it. Now the victim believes that the attacker has X, and it sends
732 the content of X back to the attacker later. (This attack is most
733 straightforward for a client to perform on a server, by creating a
734 ref to X in the namespace the client has access to and then
735 fetching it. The most likely way for a server to perform it on a
736 client is to "merge" X into a public branch and hope that the user
737 does additional work on this branch and pushes it back to the
738 server without noticing the merge.)
739 2. As in #1, the attacker chooses an object ID X to steal. The victim
741 sends an object Y that the attacker already has, and the attacker
742 falsely claims to have X and not Y, so the victim sends Y as a
743 delta against X. The delta reveals regions of X that are similar to
744 Y to the attacker.
745
747 Using --recurse-submodules can only fetch new commits in already
748 checked out submodules right now. When e.g. upstream added a new
749 submodule in the just fetched commits of the superproject the submodule
750 itself cannot be fetched, making it impossible to check out that
751 submodule later without having to do a fetch again. This is expected to
752 be fixed in a future Git version.
753
755 git-pull(1)
756
758 Part of the git(1) suite
759Git 2.26.2 2020-04-20 GIT-FETCH(1)