Cloning a repo is in fact the only safe way to get a repo from an untrusted source. Specifically, the Git project considers it a vulnerability if cloning a repo pwns you; they do not consider it a vulnerability if installing a repo a different way pwns you.
Since I never use Git hooks, I have completely disabled them with:
git config --global core.hooksPath /dev/nullscore 2 · canonical
I like the idea; but it looks like a malicious repo can reenable hooks in its config file:
[core] hooksPath = .git/hooksSo I guess this global deactivation switch probably won’t help against malicious repos?
score 1 · canonical
score 1 · canonical
True. Mitigating this problem:
core.hooksPathis not inherited from cloned repos.An extremely cautionary move would be to never copy repos, always preferring cloning them.
score 1 · canonical
Cloning a repo is in fact the only safe way to get a repo from an untrusted source. Specifically, the Git project considers it a vulnerability if cloning a repo pwns you; they do not consider it a vulnerability if installing a repo a different way pwns you.
score 1 · canonical
deleted by creator