Git Documentation and Security

`git log`, and so on. However, it is not safe to run Git commands in a `.git` directory (or the working tree that surrounds it) when that `.git` directory itself comes from an untrusted source. The commands in its config and hooks are executed in the usual way. By default, Git will refuse to run when the repository is owned by someone other than the user running the command. See the entry for `safe.directory` in linkgit:git-config[1]. While this can help protect you in a multi-user environment, note that you can also acquire untrusted repositories that are owned by you (for example, if you extract a zip file or tarball from an untrusted source). In such cases, you'd need to "sanitize" the untrusted repository first. If you have an untrusted `.git` directory, you should first clone it with `git clone --no-local` to obtain a clean copy. Git does restrict the set of options and hooks that will be run by `upload-pack`, which handles the server side of a clone or fetch, but beware that the surface area for attack against `upload-pack` is large, so this does carry some risk. The safest thing is to serve the repository as an unprivileged user (either via linkgit:git-daemon[1], ssh, or using other tools to change user ids). See the discussion in the `SECURITY` section of linkgit:git-upload-pack[1]. FURTHER DOCUMENTATION --------------------- See the references in the "description" section to get started using Git. The following is probably more detail than necessary for a first-time user. The link:user-manual.html#git-concepts[Git concepts chapter of the user-manual] and linkgit:gitcore-tutorial[7] both provide introductions to the underlying Git architecture. See linkgit:gitworkflows[7] for an overview of recommended workflows. See also the link:howto-index.html[howto] documents for some useful examples. The internals are documented in the link:technical/api-index.html[Git API documentation]. Users migrating from CVS may also want to read linkgit:gitcvs-migration[7]. Authors ------- Git was started by Linus Torvalds, and is currently maintained by Junio C Hamano. Numerous contributions have come from the Git mailing list <git@vger.kernel.org>. https://openhub.net/p/git/contributors/summary gives you a more complete list of contributors. If you have a clone of git.git itself, the output of linkgit:git-shortlog[1] and linkgit:git-blame[1] can show you the authors for specific parts of the project. Reporting Bugs -------------- Report bugs to the Git mailing list <git@vger.kernel.org> where the development and maintenance is primarily done. You do not have to be subscribed to the list to send a message there. See the list archive at https://lore.kernel.org/git for previous bug reports and other discussions. Issues which are security relevant should be disclosed privately to the Git Security mailing list <git-security@googlegroups.com>. SEE ALSO -------- linkgit:gittutorial[7], linkgit:gittutorial-2[7], linkgit:giteveryday[7], linkgit:gitcvs-migration[7], linkgit:gitglossary[7], linkgit:gitcore-tutorial[7], linkgit:gitcli[7], link:user-manual.html[The Git User's Manual], linkgit:gitworkflows[7] GIT --- Part of the linkgit:git[1] suite

This section provides further documentation and resources for using Git, including user manuals, tutorials, and guides for migrating from CVS, as well as information on reporting bugs and security issues, and a list of additional Git commands and resources for further learning.