On 2020-09-25 at 16:44:25, Frank Illenseer wrote:
> Dear Git User-group,
>
> I am having a setup where I use worktrees and I was now experimenting with adding git aliases to work more efficiently with the commands.
> However I found that obviously it does not seem to work like I would like to have it:
>
> My intention is to have a ".gitconfig" file as part of the repo so that all developers can easily get to the same configuration that was setup and also to have the config tracked as part of the repo.
> We are using Git for Windows v2.28 and also git 2.28 on Linux.
I'm not sure about what's causing the issue that you're having, but let
me dissuade you from trying to store configuration in the repository.
Git's security model doesn't permit untrusted configuration because
configuration can be used to specify programs and execute arbitrary
code. If you specify a config file that's in the repository and someone
checks out a branch with a malicious config file, they can execute
arbitrary code on that system.
If you want to provide settings, it would be better to provide a shell
script that developers could _optionally_ run (after first verifying)
that sets certain config options. Because that would be run only on
demand by the user and can be inspected before running, it would be a
lot more secure. In addition, if you're setting aliases, it's possible
that the user may already have an alias for that option that they are
used to and expect to work a certain way (e.g., my "git co" is
recursive) and may not want your alias.
I realize you may be working in a corporate environment where users are
somewhat more trusted, but take note that you probably don't let
developers execute arbitrary code on each other's systems and social
engineering attacks ("Hey, can you check out this branch and see why the
code isn't working?") are easy. There's a big difference between "I
ran this script" and "I checked out this branch".
Hopefully someone else can provide an answer to why your alias isn't
working. I have some guesses, but no definitive answers at the moment.
I'll try to play around with some things and figure it out over the next
couple of days if nobody gets to it before me.
--
brian m. carlson: Houston, Texas, US
Attachment:
signature.asc
Description: PGP signature
