1GIT-FETCH(1) Git Manual GIT-FETCH(1)
2
3
4
6 git-fetch - Download objects and refs from another repository
7
9 git fetch [<options>] [<repository> [<refspec>...]]
10 git fetch [<options>] <group>
11 git fetch --multiple [<options>] [(<repository> | <group>)...]
12 git fetch --all [<options>]
13
14
16 Fetch branches and/or tags (collectively, "refs") from one or more
17 other repositories, along with the objects necessary to complete their
18 histories. Remote-tracking branches are updated (see the description of
19 <refspec> below for ways to control this behavior).
20
21 By default, any tag that points into the histories being fetched is
22 also fetched; the effect is to fetch tags that point at branches that
23 you are interested in. This default behavior can be changed by using
24 the --tags or --no-tags options or by configuring remote.<name>.tagOpt.
25 By using a refspec that fetches tags explicitly, you can fetch tags
26 that do not point into branches you are interested in as well.
27
28 git fetch can fetch from either a single named repository or URL, or
29 from several repositories at once if <group> is given and there is a
30 remotes.<group> entry in the configuration file. (See git-config(1)).
31
32 When no remote is specified, by default the origin remote will be used,
33 unless there’s an upstream branch configured for the current branch.
34
35 The names of refs that are fetched, together with the object names they
36 point at, are written to .git/FETCH_HEAD. This information may be used
37 by scripts or other git commands, such as git-pull(1).
38
40 --all
41 Fetch all remotes.
42
43 -a, --append
44 Append ref names and object names of fetched refs to the existing
45 contents of .git/FETCH_HEAD. Without this option old data in
46 .git/FETCH_HEAD will be overwritten.
47
48 --depth=<depth>
49 Limit fetching to the specified number of commits from the tip of
50 each remote branch history. If fetching to a shallow repository
51 created by git clone with --depth=<depth> option (see git-
52 clone(1)), deepen or shorten the history to the specified number of
53 commits. Tags for the deepened commits are not fetched.
54
55 --deepen=<depth>
56 Similar to --depth, except it specifies the number of commits from
57 the current shallow boundary instead of from the tip of each remote
58 branch history.
59
60 --shallow-since=<date>
61 Deepen or shorten the history of a shallow repository to include
62 all reachable commits after <date>.
63
64 --shallow-exclude=<revision>
65 Deepen or shorten the history of a shallow repository to exclude
66 commits reachable from a specified remote branch or tag. This
67 option can be specified multiple times.
68
69 --unshallow
70 If the source repository is complete, convert a shallow repository
71 to a complete one, removing all the limitations imposed by shallow
72 repositories.
73
74 If the source repository is shallow, fetch as much as possible so
75 that the current repository has the same history as the source
76 repository.
77
78 --update-shallow
79 By default when fetching from a shallow repository, git fetch
80 refuses refs that require updating .git/shallow. This option
81 updates .git/shallow and accept such refs.
82
83 --negotiation-tip=<commit|glob>
84 By default, Git will report, to the server, commits reachable from
85 all local refs to find common commits in an attempt to reduce the
86 size of the to-be-received packfile. If specified, Git will only
87 report commits reachable from the given tips. This is useful to
88 speed up fetches when the user knows which local ref is likely to
89 have commits in common with the upstream ref being fetched.
90
91 This option may be specified more than once; if so, Git will report
92 commits reachable from any of the given commits.
93
94 The argument to this option may be a glob on ref names, a ref, or
95 the (possibly abbreviated) SHA-1 of a commit. Specifying a glob is
96 equivalent to specifying this option multiple times, one for each
97 matching ref name.
98
99 See also the fetch.negotiationAlgorithm configuration variable
100 documented in git-config(1).
101
102 --dry-run
103 Show what would be done, without making any changes.
104
105 -f, --force
106 When git fetch is used with <src>:<dst> refspec it may refuse to
107 update the local branch as discussed in the <refspec> part below.
108 This option overrides that check.
109
110 -k, --keep
111 Keep downloaded pack.
112
113 --multiple
114 Allow several <repository> and <group> arguments to be specified.
115 No <refspec>s may be specified.
116
117 -p, --prune
118 Before fetching, remove any remote-tracking references that no
119 longer exist on the remote. Tags are not subject to pruning if they
120 are fetched only because of the default tag auto-following or due
121 to a --tags option. However, if tags are fetched due to an explicit
122 refspec (either on the command line or in the remote configuration,
123 for example if the remote was cloned with the --mirror option),
124 then they are also subject to pruning. Supplying --prune-tags is a
125 shorthand for providing the tag refspec.
126
127 See the PRUNING section below for more details.
128
129 -P, --prune-tags
130 Before fetching, remove any local tags that no longer exist on the
131 remote if --prune is enabled. This option should be used more
132 carefully, unlike --prune it will remove any local references
133 (local tags) that have been created. This option is a shorthand for
134 providing the explicit tag refspec along with --prune, see the
135 discussion about that in its documentation.
136
137 See the PRUNING section below for more details.
138
139 -n, --no-tags
140 By default, tags that point at objects that are downloaded from the
141 remote repository are fetched and stored locally. This option
142 disables this automatic tag following. The default behavior for a
143 remote may be specified with the remote.<name>.tagOpt setting. See
144 git-config(1).
145
146 --refmap=<refspec>
147 When fetching refs listed on the command line, use the specified
148 refspec (can be given more than once) to map the refs to
149 remote-tracking branches, instead of the values of remote.*.fetch
150 configuration variables for the remote repository. See section on
151 "Configured Remote-tracking Branches" for details.
152
153 -t, --tags
154 Fetch all tags from the remote (i.e., fetch remote tags refs/tags/*
155 into local tags with the same name), in addition to whatever else
156 would otherwise be fetched. Using this option alone does not
157 subject tags to pruning, even if --prune is used (though tags may
158 be pruned anyway if they are also the destination of an explicit
159 refspec; see --prune).
160
161 --recurse-submodules[=yes|on-demand|no]
162 This option controls if and under what conditions new commits of
163 populated submodules should be fetched too. It can be used as a
164 boolean option to completely disable recursion when set to no or to
165 unconditionally recurse into all populated submodules when set to
166 yes, which is the default when this option is used without any
167 value. Use on-demand to only recurse into a populated submodule
168 when the superproject retrieves a commit that updates the
169 submodule’s reference to a commit that isn’t already in the local
170 submodule clone.
171
172 -j, --jobs=<n>
173 Number of parallel children to be used for fetching submodules.
174 Each will fetch from different submodules, such that fetching many
175 submodules will be faster. By default submodules will be fetched
176 one at a time.
177
178 --no-recurse-submodules
179 Disable recursive fetching of submodules (this has the same effect
180 as using the --recurse-submodules=no option).
181
182 --submodule-prefix=<path>
183 Prepend <path> to paths printed in informative messages such as
184 "Fetching submodule foo". This option is used internally when
185 recursing over submodules.
186
187 --recurse-submodules-default=[yes|on-demand]
188 This option is used internally to temporarily provide a
189 non-negative default value for the --recurse-submodules option. All
190 other methods of configuring fetch’s submodule recursion (such as
191 settings in gitmodules(5) and git-config(1)) override this option,
192 as does specifying --[no-]recurse-submodules directly.
193
194 -u, --update-head-ok
195 By default git fetch refuses to update the head which corresponds
196 to the current branch. This flag disables the check. This is purely
197 for the internal use for git pull to communicate with git fetch,
198 and unless you are implementing your own Porcelain you are not
199 supposed to use it.
200
201 --upload-pack <upload-pack>
202 When given, and the repository to fetch from is handled by git
203 fetch-pack, --exec=<upload-pack> is passed to the command to
204 specify non-default path for the command run on the other end.
205
206 -q, --quiet
207 Pass --quiet to git-fetch-pack and silence any other internally
208 used git commands. Progress is not reported to the standard error
209 stream.
210
211 -v, --verbose
212 Be verbose.
213
214 --progress
215 Progress status is reported on the standard error stream by default
216 when it is attached to a terminal, unless -q is specified. This
217 flag forces progress status even if the standard error stream is
218 not directed to a terminal.
219
220 -o <option>, --server-option=<option>
221 Transmit the given string to the server when communicating using
222 protocol version 2. The given string must not contain a NUL or LF
223 character. When multiple --server-option=<option> are given, they
224 are all sent to the other side in the order listed on the command
225 line.
226
227 -4, --ipv4
228 Use IPv4 addresses only, ignoring IPv6 addresses.
229
230 -6, --ipv6
231 Use IPv6 addresses only, ignoring IPv4 addresses.
232
233 <repository>
234 The "remote" repository that is the source of a fetch or pull
235 operation. This parameter can be either a URL (see the section GIT
236 URLS below) or the name of a remote (see the section REMOTES
237 below).
238
239 <group>
240 A name referring to a list of repositories as the value of
241 remotes.<group> in the configuration file. (See git-config(1)).
242
243 <refspec>
244 Specifies which refs to fetch and which local refs to update. When
245 no <refspec>s appear on the command line, the refs to fetch are
246 read from remote.<repository>.fetch variables instead (see
247 CONFIGURED REMOTE-TRACKING BRANCHES below).
248
249 The format of a <refspec> parameter is an optional plus +, followed
250 by the source <src>, followed by a colon :, followed by the
251 destination ref <dst>. The colon can be omitted when <dst> is
252 empty. <src> is typically a ref, but it can also be a fully spelled
253 hex object name.
254
255 tag <tag> means the same as refs/tags/<tag>:refs/tags/<tag>; it
256 requests fetching everything up to the given tag.
257
258 The remote ref that matches <src> is fetched, and if <dst> is not
259 an empty string, an attempt is made to update the local ref that
260 matches it.
261
262 Whether that update is allowed without --force depends on the ref
263 namespace it’s being fetched to, the type of object being fetched,
264 and whether the update is considered to be a fast-forward.
265 Generally, the same rules apply for fetching as when pushing, see
266 the <refspec>... section of git-push(1) for what those are.
267 Exceptions to those rules particular to git fetch are noted below.
268
269 Until Git version 2.20, and unlike when pushing with git-push(1),
270 any updates to refs/tags/* would be accepted without + in the
271 refspec (or --force). When fetching, we promiscuously considered
272 all tag updates from a remote to be forced fetches. Since Git
273 version 2.20, fetching to update refs/tags/* works the same way as
274 when pushing. I.e. any updates will be rejected without + in the
275 refspec (or --force).
276
277 Unlike when pushing with git-push(1), any updates outside of
278 refs/{tags,heads}/* will be accepted without + in the refspec (or
279 --force), whether that’s swapping e.g. a tree object for a blob, or
280 a commit for another commit that’s doesn’t have the previous commit
281 as an ancestor etc.
282
283 Unlike when pushing with git-push(1), there is no configuration
284 which’ll amend these rules, and nothing like a pre-fetch hook
285 analogous to the pre-receive hook.
286
287 As with pushing with git-push(1), all of the rules described above
288 about what’s not allowed as an update can be overridden by adding
289 an the optional leading + to a refspec (or using --force command
290 line option). The only exception to this is that no amount of
291 forcing will make the refs/heads/* namespace accept a non-commit
292 object.
293
294 Note
295 When the remote branch you want to fetch is known to be rewound
296 and rebased regularly, it is expected that its new tip will not
297 be descendant of its previous tip (as stored in your
298 remote-tracking branch the last time you fetched). You would
299 want to use the + sign to indicate non-fast-forward updates
300 will be needed for such branches. There is no way to determine
301 or declare that a branch will be made available in a repository
302 with this behavior; the pulling user simply must know this is
303 the expected usage pattern for a branch.
304
306 In general, URLs contain information about the transport protocol, the
307 address of the remote server, and the path to the repository. Depending
308 on the transport protocol, some of this information may be absent.
309
310 Git supports ssh, git, http, and https protocols (in addition, ftp, and
311 ftps can be used for fetching, but this is inefficient and deprecated;
312 do not use it).
313
314 The native transport (i.e. git:// URL) does no authentication and
315 should be used with caution on unsecured networks.
316
317 The following syntaxes may be used with them:
318
319 · ssh://[user@]host.xz[:port]/path/to/repo.git/
320
321 · git://host.xz[:port]/path/to/repo.git/
322
323 · http[s]://host.xz[:port]/path/to/repo.git/
324
325 · ftp[s]://host.xz[:port]/path/to/repo.git/
326
327 An alternative scp-like syntax may also be used with the ssh protocol:
328
329 · [user@]host.xz:path/to/repo.git/
330
331 This syntax is only recognized if there are no slashes before the first
332 colon. This helps differentiate a local path that contains a colon. For
333 example the local path foo:bar could be specified as an absolute path
334 or ./foo:bar to avoid being misinterpreted as an ssh url.
335
336 The ssh and git protocols additionally support ~username expansion:
337
338 · ssh://[user@]host.xz[:port]/~[user]/path/to/repo.git/
339
340 · git://host.xz[:port]/~[user]/path/to/repo.git/
341
342 · [user@]host.xz:/~[user]/path/to/repo.git/
343
344 For local repositories, also supported by Git natively, the following
345 syntaxes may be used:
346
347 · /path/to/repo.git/
348
349 · file:///path/to/repo.git/
350
351 These two syntaxes are mostly equivalent, except when cloning, when the
352 former implies --local option. See git-clone(1) for details.
353
354 When Git doesn’t know how to handle a certain transport protocol, it
355 attempts to use the remote-<transport> remote helper, if one exists. To
356 explicitly request a remote helper, the following syntax may be used:
357
358 · <transport>::<address>
359
360 where <address> may be a path, a server and path, or an arbitrary
361 URL-like string recognized by the specific remote helper being invoked.
362 See gitremote-helpers(1) for details.
363
364 If there are a large number of similarly-named remote repositories and
365 you want to use a different format for them (such that the URLs you use
366 will be rewritten into URLs that work), you can create a configuration
367 section of the form:
368
369 [url "<actual url base>"]
370 insteadOf = <other url base>
371
372
373 For example, with this:
374
375 [url "git://git.host.xz/"]
376 insteadOf = host.xz:/path/to/
377 insteadOf = work:
378
379
380 a URL like "work:repo.git" or like "host.xz:/path/to/repo.git" will be
381 rewritten in any context that takes a URL to be
382 "git://git.host.xz/repo.git".
383
384 If you want to rewrite URLs for push only, you can create a
385 configuration section of the form:
386
387 [url "<actual url base>"]
388 pushInsteadOf = <other url base>
389
390
391 For example, with this:
392
393 [url "ssh://example.org/"]
394 pushInsteadOf = git://example.org/
395
396
397 a URL like "git://example.org/path/to/repo.git" will be rewritten to
398 "ssh://example.org/path/to/repo.git" for pushes, but pulls will still
399 use the original URL.
400
402 The name of one of the following can be used instead of a URL as
403 <repository> argument:
404
405 · a remote in the Git configuration file: $GIT_DIR/config,
406
407 · a file in the $GIT_DIR/remotes directory, or
408
409 · a file in the $GIT_DIR/branches directory.
410
411 All of these also allow you to omit the refspec from the command line
412 because they each contain a refspec which git will use by default.
413
414 Named remote in configuration file
415 You can choose to provide the name of a remote which you had previously
416 configured using git-remote(1), git-config(1) or even by a manual edit
417 to the $GIT_DIR/config file. The URL of this remote will be used to
418 access the repository. The refspec of this remote will be used by
419 default when you do not provide a refspec on the command line. The
420 entry in the config file would appear like this:
421
422 [remote "<name>"]
423 url = <url>
424 pushurl = <pushurl>
425 push = <refspec>
426 fetch = <refspec>
427
428
429 The <pushurl> is used for pushes only. It is optional and defaults to
430 <url>.
431
432 Named file in $GIT_DIR/remotes
433 You can choose to provide the name of a file in $GIT_DIR/remotes. The
434 URL in this file will be used to access the repository. The refspec in
435 this file will be used as default when you do not provide a refspec on
436 the command line. This file should have the following format:
437
438 URL: one of the above URL format
439 Push: <refspec>
440 Pull: <refspec>
441
442
443 Push: lines are used by git push and Pull: lines are used by git pull
444 and git fetch. Multiple Push: and Pull: lines may be specified for
445 additional branch mappings.
446
447 Named file in $GIT_DIR/branches
448 You can choose to provide the name of a file in $GIT_DIR/branches. The
449 URL in this file will be used to access the repository. This file
450 should have the following format:
451
452 <url>#<head>
453
454
455 <url> is required; #<head> is optional.
456
457 Depending on the operation, git will use one of the following refspecs,
458 if you don’t provide one on the command line. <branch> is the name of
459 this file in $GIT_DIR/branches and <head> defaults to master.
460
461 git fetch uses:
462
463 refs/heads/<head>:refs/heads/<branch>
464
465
466 git push uses:
467
468 HEAD:refs/heads/<head>
469
470
472 You often interact with the same remote repository by regularly and
473 repeatedly fetching from it. In order to keep track of the progress of
474 such a remote repository, git fetch allows you to configure
475 remote.<repository>.fetch configuration variables.
476
477 Typically such a variable may look like this:
478
479 [remote "origin"]
480 fetch = +refs/heads/*:refs/remotes/origin/*
481
482
483 This configuration is used in two ways:
484
485 · When git fetch is run without specifying what branches and/or tags
486 to fetch on the command line, e.g. git fetch origin or git fetch,
487 remote.<repository>.fetch values are used as the refspecs—they
488 specify which refs to fetch and which local refs to update. The
489 example above will fetch all branches that exist in the origin
490 (i.e. any ref that matches the left-hand side of the value,
491 refs/heads/*) and update the corresponding remote-tracking branches
492 in the refs/remotes/origin/* hierarchy.
493
494 · When git fetch is run with explicit branches and/or tags to fetch
495 on the command line, e.g. git fetch origin master, the <refspec>s
496 given on the command line determine what are to be fetched (e.g.
497 master in the example, which is a short-hand for master:, which in
498 turn means "fetch the master branch but I do not explicitly say
499 what remote-tracking branch to update with it from the command
500 line"), and the example command will fetch only the master branch.
501 The remote.<repository>.fetch values determine which
502 remote-tracking branch, if any, is updated. When used in this way,
503 the remote.<repository>.fetch values do not have any effect in
504 deciding what gets fetched (i.e. the values are not used as
505 refspecs when the command-line lists refspecs); they are only used
506 to decide where the refs that are fetched are stored by acting as a
507 mapping.
508
509 The latter use of the remote.<repository>.fetch values can be
510 overridden by giving the --refmap=<refspec> parameter(s) on the command
511 line.
512
514 Git has a default disposition of keeping data unless it’s explicitly
515 thrown away; this extends to holding onto local references to branches
516 on remotes that have themselves deleted those branches.
517
518 If left to accumulate, these stale references might make performance
519 worse on big and busy repos that have a lot of branch churn, and e.g.
520 make the output of commands like git branch -a --contains <commit>
521 needlessly verbose, as well as impacting anything else that’ll work
522 with the complete set of known references.
523
524 These remote-tracking references can be deleted as a one-off with
525 either of:
526
527 # While fetching
528 $ git fetch --prune <name>
529
530 # Only prune, don't fetch
531 $ git remote prune <name>
532
533
534 To prune references as part of your normal workflow without needing to
535 remember to run that, set fetch.prune globally, or remote.<name>.prune
536 per-remote in the config. See git-config(1).
537
538 Here’s where things get tricky and more specific. The pruning feature
539 doesn’t actually care about branches, instead it’ll prune local <→
540 remote-references as a function of the refspec of the remote (see
541 <refspec> and CONFIGURED REMOTE-TRACKING BRANCHES above).
542
543 Therefore if the refspec for the remote includes e.g.
544 refs/tags/*:refs/tags/*, or you manually run e.g. git fetch --prune
545 <name> "refs/tags/*:refs/tags/*" it won’t be stale remote tracking
546 branches that are deleted, but any local tag that doesn’t exist on the
547 remote.
548
549 This might not be what you expect, i.e. you want to prune remote
550 <name>, but also explicitly fetch tags from it, so when you fetch from
551 it you delete all your local tags, most of which may not have come from
552 the <name> remote in the first place.
553
554 So be careful when using this with a refspec like
555 refs/tags/*:refs/tags/*, or any other refspec which might map
556 references from multiple remotes to the same local namespace.
557
558 Since keeping up-to-date with both branches and tags on the remote is a
559 common use-case the --prune-tags option can be supplied along with
560 --prune to prune local tags that don’t exist on the remote, and
561 force-update those tags that differ. Tag pruning can also be enabled
562 with fetch.pruneTags or remote.<name>.pruneTags in the config. See git-
563 config(1).
564
565 The --prune-tags option is equivalent to having refs/tags/*:refs/tags/*
566 declared in the refspecs of the remote. This can lead to some seemingly
567 strange interactions:
568
569 # These both fetch tags
570 $ git fetch --no-tags origin 'refs/tags/*:refs/tags/*'
571 $ git fetch --no-tags --prune-tags origin
572
573
574 The reason it doesn’t error out when provided without --prune or its
575 config versions is for flexibility of the configured versions, and to
576 maintain a 1=1 mapping between what the command line flags do, and what
577 the configuration versions do.
578
579 It’s reasonable to e.g. configure fetch.pruneTags=true in ~/.gitconfig
580 to have tags pruned whenever git fetch --prune is run, without making
581 every invocation of git fetch without --prune an error.
582
583 Pruning tags with --prune-tags also works when fetching a URL instead
584 of a named remote. These will all prune tags not found on origin:
585
586 $ git fetch origin --prune --prune-tags
587 $ git fetch origin --prune 'refs/tags/*:refs/tags/*'
588 $ git fetch <url of origin> --prune --prune-tags
589 $ git fetch <url of origin> --prune 'refs/tags/*:refs/tags/*'
590
591
593 The output of "git fetch" depends on the transport method used; this
594 section describes the output when fetching over the Git protocol
595 (either locally or via ssh) and Smart HTTP protocol.
596
597 The status of the fetch is output in tabular form, with each line
598 representing the status of a single ref. Each line is of the form:
599
600 <flag> <summary> <from> -> <to> [<reason>]
601
602
603 The status of up-to-date refs is shown only if the --verbose option is
604 used.
605
606 In compact output mode, specified with configuration variable
607 fetch.output, if either entire <from> or <to> is found in the other
608 string, it will be substituted with * in the other string. For example,
609 master -> origin/master becomes master -> origin/*.
610
611 flag
612 A single character indicating the status of the ref:
613
614 (space)
615 for a successfully fetched fast-forward;
616
617 +
618 for a successful forced update;
619
620 -
621 for a successfully pruned ref;
622
623 t
624 for a successful tag update;
625
626 *
627 for a successfully fetched new ref;
628
629 !
630 for a ref that was rejected or failed to update; and
631
632 =
633 for a ref that was up to date and did not need fetching.
634
635 summary
636 For a successfully fetched ref, the summary shows the old and new
637 values of the ref in a form suitable for using as an argument to
638 git log (this is <old>..<new> in most cases, and <old>...<new> for
639 forced non-fast-forward updates).
640
641 from
642 The name of the remote ref being fetched from, minus its
643 refs/<type>/ prefix. In the case of deletion, the name of the
644 remote ref is "(none)".
645
646 to
647 The name of the local ref being updated, minus its refs/<type>/
648 prefix.
649
650 reason
651 A human-readable explanation. In the case of successfully fetched
652 refs, no explanation is needed. For a failed ref, the reason for
653 failure is described.
654
656 · Update the remote-tracking branches:
657
658 $ git fetch origin
659
660 The above command copies all branches from the remote refs/heads/
661 namespace and stores them to the local refs/remotes/origin/
662 namespace, unless the branch.<name>.fetch option is used to specify
663 a non-default refspec.
664
665 · Using refspecs explicitly:
666
667 $ git fetch origin +pu:pu maint:tmp
668
669 This updates (or creates, as necessary) branches pu and tmp in the
670 local repository by fetching from the branches (respectively) pu
671 and maint from the remote repository.
672
673 The pu branch will be updated even if it is does not fast-forward,
674 because it is prefixed with a plus sign; tmp will not be.
675
676 · Peek at a remote’s branch, without configuring the remote in your
677 local repository:
678
679 $ git fetch git://git.kernel.org/pub/scm/git/git.git maint
680 $ git log FETCH_HEAD
681
682 The first command fetches the maint branch from the repository at
683 git://git.kernel.org/pub/scm/git/git.git and the second command
684 uses FETCH_HEAD to examine the branch with git-log(1). The fetched
685 objects will eventually be removed by git’s built-in housekeeping
686 (see git-gc(1)).
687
689 The fetch and push protocols are not designed to prevent one side from
690 stealing data from the other repository that was not intended to be
691 shared. If you have private data that you need to protect from a
692 malicious peer, your best option is to store it in another repository.
693 This applies to both clients and servers. In particular, namespaces on
694 a server are not effective for read access control; you should only
695 grant read access to a namespace to clients that you would trust with
696 read access to the entire repository.
697
698 The known attack vectors are as follows:
699
700 1. The victim sends "have" lines advertising the IDs of objects it has
701 that are not explicitly intended to be shared but can be used to
702 optimize the transfer if the peer also has them. The attacker
703 chooses an object ID X to steal and sends a ref to X, but isn’t
704 required to send the content of X because the victim already has
705 it. Now the victim believes that the attacker has X, and it sends
706 the content of X back to the attacker later. (This attack is most
707 straightforward for a client to perform on a server, by creating a
708 ref to X in the namespace the client has access to and then
709 fetching it. The most likely way for a server to perform it on a
710 client is to "merge" X into a public branch and hope that the user
711 does additional work on this branch and pushes it back to the
712 server without noticing the merge.)
713
714 2. As in #1, the attacker chooses an object ID X to steal. The victim
715 sends an object Y that the attacker already has, and the attacker
716 falsely claims to have X and not Y, so the victim sends Y as a
717 delta against X. The delta reveals regions of X that are similar to
718 Y to the attacker.
719
721 Using --recurse-submodules can only fetch new commits in already
722 checked out submodules right now. When e.g. upstream added a new
723 submodule in the just fetched commits of the superproject the submodule
724 itself can not be fetched, making it impossible to check out that
725 submodule later without having to do a fetch again. This is expected to
726 be fixed in a future Git version.
727
729 git-pull(1)
730
732 Part of the git(1) suite
733
734
735
736Git 2.21.0 02/24/2019 GIT-FETCH(1)