Documentation / git-receive-pack.txton commit receive-pack: GPG-validate push certificates (d05b961)
   1git-receive-pack(1)
   2===================
   3
   4NAME
   5----
   6git-receive-pack - Receive what is pushed into the repository
   7
   8
   9SYNOPSIS
  10--------
  11[verse]
  12'git-receive-pack' <directory>
  13
  14DESCRIPTION
  15-----------
  16Invoked by 'git send-pack' and updates the repository with the
  17information fed from the remote end.
  18
  19This command is usually not invoked directly by the end user.
  20The UI for the protocol is on the 'git send-pack' side, and the
  21program pair is meant to be used to push updates to remote
  22repository.  For pull operations, see linkgit:git-fetch-pack[1].
  23
  24The command allows for creation and fast-forwarding of sha1 refs
  25(heads/tags) on the remote end (strictly speaking, it is the
  26local end 'git-receive-pack' runs, but to the user who is sitting at
  27the send-pack end, it is updating the remote.  Confused?)
  28
  29There are other real-world examples of using update and
  30post-update hooks found in the Documentation/howto directory.
  31
  32'git-receive-pack' honours the receive.denyNonFastForwards config
  33option, which tells it if updates to a ref should be denied if they
  34are not fast-forwards.
  35
  36OPTIONS
  37-------
  38<directory>::
  39        The repository to sync into.
  40
  41pre-receive Hook
  42----------------
  43Before any ref is updated, if $GIT_DIR/hooks/pre-receive file exists
  44and is executable, it will be invoked once with no parameters.  The
  45standard input of the hook will be one line per ref to be updated:
  46
  47       sha1-old SP sha1-new SP refname LF
  48
  49The refname value is relative to $GIT_DIR; e.g. for the master
  50head this is "refs/heads/master".  The two sha1 values before
  51each refname are the object names for the refname before and after
  52the update.  Refs to be created will have sha1-old equal to 0\{40},
  53while refs to be deleted will have sha1-new equal to 0\{40}, otherwise
  54sha1-old and sha1-new should be valid objects in the repository.
  55
  56When accepting a signed push (see linkgit:git-push[1]), the signed
  57push certificate is stored in a blob and an environment variable
  58`GIT_PUSH_CERT` can be consulted for its object name.  See the
  59description of `post-receive` hook for an example.  In addition, the
  60certificate is verified using GPG and the result is exported with
  61the following environment variables:
  62
  63`GIT_PUSH_CERT_SIGNER`::
  64        The name and the e-mail address of the owner of the key that
  65        signed the push certificate.
  66
  67`GIT_PUSH_CERT_KEY`::
  68        The GPG key ID of the key that signed the push certificate.
  69
  70`GIT_PUSH_CERT_STATUS`::
  71        The status of GPG verification of the push certificate,
  72        using the same mnemonic as used in `%G?` format of `git log`
  73        family of commands (see linkgit:git-log[1]).
  74
  75This hook is called before any refname is updated and before any
  76fast-forward checks are performed.
  77
  78If the pre-receive hook exits with a non-zero exit status no updates
  79will be performed, and the update, post-receive and post-update
  80hooks will not be invoked either.  This can be useful to quickly
  81bail out if the update is not to be supported.
  82
  83update Hook
  84-----------
  85Before each ref is updated, if $GIT_DIR/hooks/update file exists
  86and is executable, it is invoked once per ref, with three parameters:
  87
  88       $GIT_DIR/hooks/update refname sha1-old sha1-new
  89
  90The refname parameter is relative to $GIT_DIR; e.g. for the master
  91head this is "refs/heads/master".  The two sha1 arguments are
  92the object names for the refname before and after the update.
  93Note that the hook is called before the refname is updated,
  94so either sha1-old is 0\{40} (meaning there is no such ref yet),
  95or it should match what is recorded in refname.
  96
  97The hook should exit with non-zero status if it wants to disallow
  98updating the named ref.  Otherwise it should exit with zero.
  99
 100Successful execution (a zero exit status) of this hook does not
 101ensure the ref will actually be updated, it is only a prerequisite.
 102As such it is not a good idea to send notices (e.g. email) from
 103this hook.  Consider using the post-receive hook instead.
 104
 105post-receive Hook
 106-----------------
 107After all refs were updated (or attempted to be updated), if any
 108ref update was successful, and if $GIT_DIR/hooks/post-receive
 109file exists and is executable, it will be invoked once with no
 110parameters.  The standard input of the hook will be one line
 111for each successfully updated ref:
 112
 113       sha1-old SP sha1-new SP refname LF
 114
 115The refname value is relative to $GIT_DIR; e.g. for the master
 116head this is "refs/heads/master".  The two sha1 values before
 117each refname are the object names for the refname before and after
 118the update.  Refs that were created will have sha1-old equal to
 1190\{40}, while refs that were deleted will have sha1-new equal to
 1200\{40}, otherwise sha1-old and sha1-new should be valid objects in
 121the repository.
 122
 123The `GIT_PUSH_CERT*` environment variables can be inspected, just as
 124in `pre-receive` hook, after accepting a signed push.
 125
 126Using this hook, it is easy to generate mails describing the updates
 127to the repository.  This example script sends one mail message per
 128ref listing the commits pushed to the repository, and logs the push
 129certificates of signed pushes with good signatures to a logger
 130service:
 131
 132        #!/bin/sh
 133        # mail out commit update information.
 134        while read oval nval ref
 135        do
 136                if expr "$oval" : '0*$' >/dev/null
 137                then
 138                        echo "Created a new ref, with the following commits:"
 139                        git rev-list --pretty "$nval"
 140                else
 141                        echo "New commits:"
 142                        git rev-list --pretty "$nval" "^$oval"
 143                fi |
 144                mail -s "Changes to ref $ref" commit-list@mydomain
 145        done
 146        # log signed push certificate, if any
 147        if test -n "${GIT_PUSH_CERT-}" && test ${GIT_PUSH_CERT_STATUS} = G
 148        then
 149                (
 150                        git cat-file blob ${GIT_PUSH_CERT}
 151                ) | mail -s "push certificate from $GIT_PUSH_CERT_SIGNER" push-log@mydomain
 152        fi
 153        exit 0
 154
 155The exit code from this hook invocation is ignored, however a
 156non-zero exit code will generate an error message.
 157
 158Note that it is possible for refname to not have sha1-new when this
 159hook runs.  This can easily occur if another user modifies the ref
 160after it was updated by 'git-receive-pack', but before the hook was able
 161to evaluate it.  It is recommended that hooks rely on sha1-new
 162rather than the current value of refname.
 163
 164post-update Hook
 165----------------
 166After all other processing, if at least one ref was updated, and
 167if $GIT_DIR/hooks/post-update file exists and is executable, then
 168post-update will be called with the list of refs that have been updated.
 169This can be used to implement any repository wide cleanup tasks.
 170
 171The exit code from this hook invocation is ignored; the only thing
 172left for 'git-receive-pack' to do at that point is to exit itself
 173anyway.
 174
 175This hook can be used, for example, to run `git update-server-info`
 176if the repository is packed and is served via a dumb transport.
 177
 178        #!/bin/sh
 179        exec git update-server-info
 180
 181
 182SEE ALSO
 183--------
 184linkgit:git-send-pack[1], linkgit:gitnamespaces[7]
 185
 186GIT
 187---
 188Part of the linkgit:git[1] suite