Say I cloned a repo, then maybe worked on it a bit. Then I reverted/pushed all changes, so my friend has all the repo files. Is it safe for me to send him the .git folder? Is there any private information there, such as my username, my email, command history, or perhaps some secrets?
5
-
8If you have pushed all of your changes, why can't your friend access those changes from the place you pushed them to? Shouldn't they be able to clone, too?– jpaughCommented Apr 2, 2021 at 19:31
-
@jpaugh it's just a simple made-up story. In reality there can be several reasons, e.g.: The folder was sent as part of a larger archive of files or disk-on-key. Or, there are commits which weren't pushed that I want to send as files. Or, maybe I have an open source website and I wonder whether having .git accessible is OK. etc.– PaulCommented Apr 2, 2021 at 19:46
-
2Ok. I recommend you get your push/pull process down, so that you and your teammates can rely on it, rather than having to use special cases. Of course, there are (the same) security concerns with the normal push process.– jpaughCommented Apr 2, 2021 at 19:48
-
If you don't want to push something into your main development or production branches, you could push to a new branch called paul/wizbang-feature, and ask your friend to pull from there. There are tools like Git Flow which help you standardize the way you work with branches in a team, to help with situations like this.– jpaughCommented Apr 2, 2021 at 19:50
-
The .git folder is explicitly used as a device in some CTF scenarios. The answers there don't allude to orphan reflog items like yours do, but they might give you more hints for how someone could dredge for sensitive things.– Michael come latelyCommented Apr 22 at 18:25
Add a comment
|
3 Answers
The contents of your .git repository may contain loose objects that you may not want to share (e.g. something you committed but changed your mind and deleted/amended), so there is no definite "yes, this is safe."
A better way to share git repositories offline is to create a bundle file and send that to your friend, e.g.:
git bundle create /tmp/myrepo.bundle --all
Then you can send myrepo.bundle to your friend and they can clone from it like they would from any remote:
git clone myrepo.bundle
That would be a better way to make sure that you're not sharing loose objects that aren't intended to be seen by others.
-
4That's a good strategy. People forget that
git clonewill grab the entire history, not only the recent view of the files... Commented Apr 1, 2021 at 21:19 -
22@ThoriumBR as opposed to git bundle, which also grabs the entire history, and not only the recent view of the files? The only difference is with dangling commits, AFAICT. Commented Apr 2, 2021 at 18:43
-
2@EricDuminil, and the reflog and the config. Those might be more important than the lose objects. Commented Apr 3, 2021 at 12:54
-
1@EricDuminil, the bundle does not, as far as I can tell, contain the reflog. Only the explicitly referenced refs and the revisions reachable from them. Commented Apr 4, 2021 at 11:23
-
1@jpaugh You are correct. It will not include the metadata of the last commit. It will also exclude files marked in
.gitattributesto explicitly exclude from the archive. Commented Jan 29 at 1:08
Is it safe for me to send him the
.gitfolder?
One place you would need to be careful is that sharing your entire .git folder would include .git/config. Depending on what you've done, this could have very little information, or quite a lot. If all you've done is a clone, there won't be much more than your list of remotes. If you've worked extensively in the repository, however, there might be things like aliases or configuration settings, as well as a partial record of what branches you've pushed (more specifically, what tracking branches you have configured). Worse, if you've set up any access credentials (e.g. for code review or CI) that are stored in the local .git/config, those would be leaked.
Beyond this, see the other answers.
All that said, however, I don't believe you would need to send the .git/config anyway. However, sending a bundle is going to be much safer, as well as more reliable, so the short answer is that you just shouldn't send your .git folder in any case. Not just for security/privacy, but for ease of use also.
Is there any private information there, such as my username
Your local machine username should only be present in a repository if you have not configured your git identification. In this case, git defaults to something like $(id)@$(hostname), which will be recorded if you commit anything. This might be especially relevant if you commit something, realize you need to set your identification, and amend the commit, as the old commit may still be present until it gets garbage-collected.
my email
Your e-mail is part of a git commit's authorship record. If you've pushed to a public repository, that's already out there. Note that even if you change the author, the committer is a separate record. See also the previous paragraph.
command history, or perhaps some secrets?
If there are any secrets in your .git/config, these might be leaked.
Your command history won't be directly leaked. However, it may be possible to infer your command history, at least as far as (some) git commands, via careful analysis of the contents of the .git folder. Note that this is partly true for public repositories as well, although it is much harder to impossible there to uncover anything other than commits and merges. The difference mainly comes down to your .git folder will contain artifacts from commits that have been amended, rebases, abandoned branches, and so forth.
Realistically speaking, other than maybe your .git/config, a local .git folder which is a clone of a public repository will rarely contain anything you're likely to truly consider "sensitive" unless you accidentally committed something that definitely is sensitive. In most cases, however, if you don't mind someone seeing the "official" history, you probably aren't likely to mind if they can see where/how that history has been created/edited, unless you have a near-pathological need to maintain an appearance of tidiness.
...but again, just use a bundle. The tiny amount of extra effort on your part — if any; you'd still have to pack up the .git folder contents somehow — is canceled out by how much easier it is for your recipient to use a bundle, and on top of that you won't be worried about leaking sensitive information.
-
Thank you for writing this elaborate information, this is the kind of answer I was hoping for. I'm not sure whether it would be right to accept it, since it completes the currently accepted answer, but I upvoted, and am thankful.– PaulCommented Apr 2, 2021 at 15:10
-
5Another sort of inference leak might be your
.git/excludefile. Commented Apr 2, 2021 at 17:04
It depends on what you were doing. E.g. there can be files that you have deleted afterwards that contain some sensitive data.
You are not the first one who asks such question. Look at the Git documentation, chapter Removing sensitive data from a repository. It describes what should you care of, what tools and what specific commands you can use to remove possible sensitive data.
answered Apr 1, 2021 at 21:23
