Git pre receive hook and fragments left behind

Question

Quite a common use of a git pre-receive hook is to scan for sensitive information and then block from entering the repository. It appears from looking at examples, that conventionally, you are given arguments of the parent and new sha.

Typically, you then use those to run a git show or git diff to see the real text and actually run operations on the files, for example, looking for secrets.

I assume if the hashes are provided then the git server actually writes these to the file system so that an invocation of git show can actually find and display the file.

if the hook returns a fail, such that the push and commit fails, do these fragments get cleaned up? or are they visible to someone that runs git clone after the hook ran. Also wondering if there are any best practices to configure git so that this storage is somewhere volatile until the commit actually passes the hook and can be safely committed to the repository, so that it would not make it into backup systems and the like that might be archiving the repository.

Answer 1

Exists a temporary storage that is removed if the hook fails: from the man page of git-receive-pack

QUARANTINE ENVIRONMENT
       When receive-pack takes in objects, they are placed into a temporary "quarantine" directory within the $GIT_DIR/objects directory and migrated into the main object store only after the pre-receive hook has completed. If the
       push fails before then, the temporary directory is removed entirely.

       This has a few user-visible effects and caveats:

        1. Pushes which fail due to problems with the incoming pack, missing objects, or due to the pre-receive hook will not leave any on-disk data. This is usually helpful to prevent repeated failed pushes from filling up your
           disk, but can make debugging more challenging.

        2. Any objects created by the pre-receive hook will be created in the quarantine directory (and migrated only if it succeeds).

        3. The pre-receive hook MUST NOT update any refs to point to quarantined objects. Other programs accessing the repository will not be able to see the objects (and if the pre-receive hook fails, those refs would become
           corrupted). For safety, any ref updates from within pre-receive are automatically rejected.

So if your script is not creating something of its own should be ok.