hooks: introduce 'hooks.allowNoVerify' configuration - #2215
Conversation
Welcome to GitGitGadgetHi @kairosci, and welcome to GitGitGadget, the GitHub App to send patch series to the Git mailing list from GitHub Pull Requests. Please make sure that either:
You can CC potential reviewers by adding a footer to the PR description with the following syntax: NOTE: DO NOT copy/paste your CC list from a previous GGG PR's description, Also, it is a good idea to review the commit messages one last time, as the Git project expects them in a quite specific form:
It is in general a good idea to await the automated test ("Checks") in this Pull Request before contributing the patches, e.g. to avoid trivial issues such as unportable code. Contributing the patchesBefore you can contribute the patches, your GitHub username needs to be added to the list of permitted users. Any already-permitted user can do that, by adding a comment to your PR of the form Both the person who commented An alternative is the channel Once on the list of permitted usernames, you can contribute the patches to the Git mailing list by adding a PR comment If you want to see what email(s) would be sent for a After you submit, GitGitGadget will respond with another comment that contains the link to the cover letter mail in the Git mailing list archive. Please make sure to monitor the discussion in that thread and to address comments and suggestions (while the comments and suggestions will be mirrored into the PR by GitGitGadget, you will still want to reply via mail). If you do not want to subscribe to the Git mailing list just to be able to respond to a mail, you can download the mbox from the Git mailing list archive (click the curl -g --user "<EMailAddress>:<Password>" \
--url "imaps://imap.gmail.com/INBOX" -T /path/to/raw.txtTo iterate on your change, i.e. send a revised patch or patch series, you will first want to (force-)push to the same branch. You probably also want to modify your Pull Request description (or title). It is a good idea to summarize the revision by adding something like this to the cover letter (read: by editing the first comment on the PR, i.e. the PR description): To send a new iteration, just add another PR comment with the contents: Need help?New contributors who want advice are encouraged to join git-mentoring@googlegroups.com, where volunteers who regularly contribute to Git are willing to answer newbie questions, give advice, or otherwise provide mentoring to interested contributors. You must join in order to post or view messages, but anyone can join. You may also be able to find help in real time in the developer IRC channel, |
ce6969e to
853636d
Compare
|
/allow |
|
User kairosci is now allowed to use GitGitGadget. |
|
/submit |
|
Submitted as pull.2215.git.1788365862670.gitgitgadget@gmail.com To fetch this version into To fetch this version to local tag |
853636d to
4e59456
Compare
|
/submit |
|
Submitted as pull.2215.v2.git.1788366925041.gitgitgadget@gmail.com To fetch this version into To fetch this version to local tag |
c9557f4 to
fdf4546
Compare
|
There is an issue in commit fdf4546:
|
fdf4546 to
cc98af8
Compare
|
/submit |
|
Submitted as pull.2215.v3.git.1788369794965.gitgitgadget@gmail.com To fetch this version into To fetch this version to local tag |
cc98af8 to
a9f7541
Compare
|
/submit |
|
Submitted as pull.2215.v4.git.1788371123325.gitgitgadget@gmail.com To fetch this version into To fetch this version to local tag |
a9f7541 to
992ec60
Compare
Introduce the 'hook.allowNoVerify' configuration variable to control whether the '--no-verify' (or '-n') command-line option is permitted during operations executing client-side hooks (commit, push, merge, rebase, am). Client-side hooks execute in the user's local repository and cannot serve as an authoritative security boundary; authoritative policy enforcement belongs on the server (such as via pre-receive hooks). However, developers often invoke '--no-verify' out of habit or muscle memory, inadvertently skipping local checks. To address concerns regarding false senses of security without breaking legitimate emergency escape hatches, allow configuring the variable to 'true' (the default), 'warn', or 'false'. In 'warn' mode, Git permits the bypass while emitting a warning to standard error, ensuring visibility without interrupting urgent workflows. When set to 'false', Git aborts execution and provides actionable advice explaining that the setting is an ergonomic workflow guardrail. To avoid trapping developers during broken hook scripts or critical hotfixes, the guardrail can be overridden by passing '-c hook.allowNoVerify=true' or by setting the 'GIT_ALLOW_NO_VERIFY=1' environment variable. This prevents developers from having to resort to destructive workarounds such as removing hook files or clearing execute permissions. In automated or non-interactive environments such as CI/CD runners, 'warn' mode avoids pipeline failures while preserving audit visibility, and 'GIT_ALLOW_NO_VERIFY=1' provides a clean override without modifying configuration files. Follow the canonical 'hook.*' configuration namespace established by modern Git hook commands, while accepting 'hooks.allowNoVerify' as a backward-compatible fallback. Centralize the option verification logic across all affected commands into validate_no_verify() in hook.c. Signed-off-by: Alessio Attilio <alessio.attilio@protonmail.com>
992ec60 to
9344d71
Compare
|
@kairosci quick word of warning: The Git maintainer usually gets pretty angry when people submit patch series in quick succession; As a rule of thumb, I'd suggest to leave a day or so between sending iterations. |
|
I apologize. I will follow your advice moving forward. |
|
Junio C Hamano wrote on the Git mailing list (how to reply to this email): "Alessio Attilio via GitGitGadget" <gitgitgadget@gmail.com> writes:
> From: Alessio Attilio <alessio.attilio@protonmail.com>
>
> Introduce 'hooks.allowNoVerify' as an opt-in workflow guardrail to
> prevent accidental bypass of hooks with '--no-verify' when set to false.
> Authoritative enforcement remains server-side.
Accidental
$ git foo --no-verify
may be prevented by setting this configuration variable, but then
would we need another layer of protection to prevent accidental
$ git -c hooks.allownoverify foo --no-verify
by introducing another configuration variable to forbid
hooks.allownoverify to be overriden?
I do not think we want to go into this slipperly slope. Thanks for
sending a patch, but I am personally not interested.
Besides, verifications that users may be tempted to bypass, but want
to instill discipline to prevent bypassing, may not be implemented
as hooks, and the way they are bypassed may not be "--[no-]verify"
command line option. When one wants a way to prevent such
verifications from getting disabled, the mechanism should also allow
forbidding verification that is built into the system from getting
disabled. Limiting a settings to hooks is probably not a good idea,
and introducing a new "hooks." hierarchy for this setting is not
something we want to see.
|
|
"brian m. carlson" wrote on the Git mailing list (how to reply to this email): On 2026-09-02 at 17:23:14, Alessio Attilio via GitGitGadget wrote:
> From: Alessio Attilio <alessio.attilio@protonmail.com>
>
> Introduce the 'hooks.allowNoVerify' configuration variable to control
> whether the '--no-verify' (or '-n') command-line option is permitted
> during operations executing client-side hooks (commit, push, merge,
> rebase, am).
>
> Client-side hooks execute in the user's local repository and cannot serve
> as an authoritative security boundary; authoritative policy enforcement
> belongs on the server (such as via pre-receive hooks). However,
> developers often invoke '--no-verify' out of habit or muscle memory,
> inadvertently skipping local checks.
I agree with Junio that this doesn't seem like a good idea. It's up to
the user whether they want to install or use hooks and they are free to
disable them or override them as they see fit. If the user doesn't want
to use local hooks on an individual case basis, then `--no-verify` is
the right option.
In my case, I use hooks for Git LFS when I use that software, but I
never use repository owner-provided hooks, although I may use my own. As
a result, I almost never use `--no-verify`.
If in your environment you are trying to force developers to use local
hooks, the Git FAQ mentions that this is not an effective control and
you should stop trying to do that. In fact, I would even argue that you
should simply not install hooks by default for repositories using your
scripts or build tools because it's up to users whether those are useful
for them. The Git FAQ mentions reasons why forced installation of hooks
is harmful for many workflows and I don't think we should be hassling
users like that.
In any event, it's trivial to simply bypass all hooks by setting
`core.hooksPath` to `/dev/null` using a variety of different techniques.
--
brian m. carlson (they/them)
Toronto, Ontario, CA |
|
User |
2 participants
Introduce 'hooks.allowNoVerify' as an opt-in workflow guardrail (default: true) to prevent accidental bypass of hooks via '--no-verify'.
This setting is intended for workflows and managed environments to avoid inadvertent bypasses, without altering Git's server-side security model.
cc: "brian m. carlson" sandals@crustytoothpaste.net