Skip to content


Subversion checkout URL

You can clone with
Download ZIP
100644 495 lines (378 sloc) 19.423 kB
9d90043 @schacon added smart-http post
schacon authored
1 Packfile transfer protocols
2 ===========================
4 Git supports transferring data in packfiles over the ssh://, git:// and
5 file:// transports. There exist two sets of protocols, one for pushing
6 data from a client to a server and another for fetching data from a
7 server to a client. All three transports (ssh, git, file) use the same
8 protocol to transfer data.
10 The processes invoked in the canonical Git implementation are 'upload-pack'
11 on the server side and 'fetch-pack' on the client side for fetching data;
12 then 'receive-pack' on the server and 'send-pack' on the client for pushing
13 data. The protocol functions to have a server tell a client what is
14 currently on the server, then for the two to negotiate the smallest amount
15 of data to send in order to fully update one or the other.
17 Transports
18 ----------
19 There are three transports over which the packfile protocol is
20 initiated. The Git transport is a simple, unauthenticated server that
21 takes the command (almost always 'upload-pack', though Git
22 servers can be configured to be globally writable, in which 'receive-
23 pack' initiation is also allowed) with which the client wishes to
24 communicate and executes it and connects it to the requesting
25 process.
27 In the SSH transport, the client just runs the 'upload-pack'
28 or 'receive-pack' process on the server over the SSH protocol and then
29 communicates with that invoked process over the SSH connection.
31 The file:// transport runs the 'upload-pack' or 'receive-pack'
32 process locally and communicates with it over a pipe.
34 Git Transport
35 -------------
37 The Git transport starts off by sending the command and repository
38 on the wire using the pkt-line format, followed by a NUL byte and a
39 hostname paramater, terminated by a NUL byte.
41 0032git-upload-pack /project.git\\0
43 --
44 git-proto-request = request-command SP pathname NUL [ host-parameter NUL ]
45 request-command = "git-upload-pack" / "git-receive-pack" /
46 "git-upload-archive" ; case sensitive
47 pathname = *( %x01-ff ) ; exclude NUL
48 host-parameter = "host=" hostname [ ":" port ]
49 --
51 Only host-parameter is allowed in the git-proto-request. Clients
52 MUST NOT attempt to send additional parameters. It is used for the
53 git-daemon name based virtual hosting. See --interpolated-path
54 option to git daemon, with the %H/%CH format characters.
56 Basically what the Git client is doing to connect to an 'upload-pack'
57 process on the server side over the Git protocol is this:
59 $ echo -e -n \
60 "0039git-upload-pack /schacon/gitbook.git\\0" |
61 nc -v 9418
64 SSH Transport
65 -------------
67 Initiating the upload-pack or receive-pack processes over SSH is
68 executing the binary on the server via SSH remote execution.
69 It is basically equivalent to running this:
71 $ ssh "git-upload-pack '/project.git'"
73 For a server to support Git pushing and pulling for a given user over
74 SSH, that user needs to be able to execute one or both of those
75 commands via the SSH shell that they are provided on login. On some
76 systems, that shell access is limited to only being able to run those
77 two commands, or even just one of them.
79 In an ssh:// format URI, it's absolute in the URI, so the '/' after
80 the host name (or port number) is sent as an argument, which is then
81 read by the remote git-upload-pack exactly as is, so it's effectively
82 an absolute path in the remote filesystem.
84 git clone ssh://
85 |
86 v
87 ssh "git-upload-pack '/project.git'"
89 In a "user@host:path" format URI, its relative to the user's home
90 directory, because the Git client will run:
92 git clone
93 |
94 v
95 ssh "git-upload-pack 'project.git'"
97 The exception is if a '~' is used, in which case
98 we execute it without the leading '/'.
100 ssh://,
101 |
102 v
103 ssh "git-upload-pack '~alice/project.git'"
105 A few things to remember here:
107 - The "command name" is spelled with dash (e.g. git-upload-pack), but
108 this can be overridden by the client;
110 - The repository path is always quoted with single quotes.
112 Fetching Data From a Server
113 ===========================
115 When one Git repository wants to get data that a second repository
116 has, the first can 'fetch' from the second. This operation determines
117 what data the server has that the client does not then streams that
118 data down to the client in packfile format.
121 Reference Discovery
122 -------------------
124 When the client initially connects the server will immediately respond
125 with a listing of each reference it has (all branches and tags) along
126 with the object name that each reference currently points to.
128 $ echo -e -n "0039git-upload-pack /schacon/gitbook.git\\0" |
129 nc -v 9418
130 00887217a7c7e582c46cec22a130adf4b9d7d950fba0 HEAD\0multi_ack thin-pack side-band side-band-64k ofs-delta shallow no-progress include-tag
131 00441d3fcd5ced445d1abc402225c0b8a1299641f497 refs/heads/integration
132 003f7217a7c7e582c46cec22a130adf4b9d7d950fba0 refs/heads/master
133 003cb88d2441cac0977faf98efc80305012112238d9d refs/tags/v0.9
134 003c525128480b96c89e6418b1e40909bf6c5b2d580f refs/tags/v1.0
135 003fe92df48743b7bc7d26bcaabfddde0a1e20cae47c refs/tags/v1.0^{}
136 0000
138 Server SHOULD terminate each non-flush line using LF ("\n") terminator;
139 client MUST NOT complain if there is no terminator.
141 The returned response is a pkt-line stream describing each ref and
142 its current value. The stream MUST be sorted by name according to
143 the C locale ordering.
145 If HEAD is a valid ref, HEAD MUST appear as the first advertised
146 ref. If HEAD is not a valid ref, HEAD MUST NOT appear in the
147 advertisement list at all, but other refs may still appear.
149 The stream MUST include capability declarations behind a NUL on the
150 first ref. The peeled value of a ref (that is "ref^{}") MUST be
151 immediately after the ref itself, if presented. A conforming server
152 MUST peel the ref if its an annotated tag.
154 ----
155 advertised-refs = (no-refs / list-of-refs)
156 flush-pkt
158 no-refs = PKT-LINE(zero-id SP "capabilities^{}"
159 NUL capability-list LF)
161 list-of-refs = first-ref *other-ref
162 first-ref = PKT-LINE(obj-id SP refname
163 NUL capability-list LF)
165 other-ref = PKT-LINE(other-tip / other-peeled)
166 other-tip = obj-id SP refname LF
167 other-peeled = obj-id SP refname "^{}" LF
169 capability-list = capability *(SP capability)
170 capability = 1*(LC_ALPHA / DIGIT / "-" / "_")
171 LC_ALPHA = %x61-7A
172 ----
174 Server and client MUST use lowercase for obj-id, both MUST treat obj-id
175 as case-insensitive.
177 See protocol-capabilities.txt for a list of allowed server capabilities
178 and descriptions.
180 Packfile Negotiation
181 --------------------
182 After reference and capabilities discovery, the client can decide
183 to terminate the connection by sending a flush-pkt, telling the
184 server it can now gracefully terminate (as happens with the ls-remote
185 command) or it can enter the negotiation phase, where the client and
186 server determine what the minimal packfile necessary for transport is.
188 Once the client has the initial list of references that the server
189 has, as well as the list of capabilities, it will begin telling the
190 server what objects it wants and what objects it has, so the server
191 can make a packfile that only contains the objects that the client needs.
192 The client will also send a list of the capabilities it wants to be in
193 effect, out of what the server said it could do with the first 'want' line.
195 ----
196 upload-request = want-list
197 have-list
198 compute-end
200 want-list = first-want
201 *additional-want
202 flush-pkt
204 first-want = PKT-LINE("want" SP obj-id SP capability-list LF)
205 additional-want = PKT-LINE("want" SP obj-id LF)
207 have-list = *have-line
208 have-line = PKT-LINE("have" SP obj-id LF)
209 compute-end = flush-pkt / PKT-LINE("done")
210 ----
212 Clients MUST send all the obj-ids it wants from the reference
213 discovery phase as 'want' lines. Clients MUST send at least one
214 'want' command in the request body. Clients MUST NOT mention an
215 obj-id in a 'want' command which did not appear in the response
216 obtained through ref discovery.
218 If client is requesting a shallow clone, it will now send a 'deepen'
219 line with the depth it is requesting.
221 Once all the "want"s (and optional 'deepen') are transferred,
222 clients MUST send a flush-pkt. If the client has all the references
223 on the server, client flushes and disconnects.
225 TODO: shallow/unshallow response and document the deepen command in the ABNF.
227 Now the client will send a list of the obj-ids it has using 'have'
228 lines. In multi_ack mode, the canonical implementation will send up
229 to 32 of these at a time, then will send a flush-pkt. The canonical
230 implementation will skip ahead and send the next 32 immediately,
231 so that there is always a block of 32 "in-flight on the wire" at a
232 time.
234 If the server reads 'have' lines, it then will respond by ACKing any
235 of the obj-ids the client said it had that the server also has. The
236 server will ACK obj-ids differently depending on which ack mode is
237 chosen by the client.
239 In multi_ack mode:
241 * the server will respond with 'ACK obj-id continue' for any common
242 commits.
244 * once the server has found an acceptable common base commit and is
245 ready to make a packfile, it will blindly ACK all 'have' obj-ids
246 back to the client.
248 * the server will then send a 'NACK' and then wait for another response
249 from the client - either a 'done' or another list of 'have' lines.
251 In multi_ack_detailed mode:
253 * the server will differentiate the ACKs where it is signaling
254 that it is ready to send data with 'ACK obj-id ready' lines, and
255 signals the identified common commits with 'ACK obj-id common' lines.
257 Without either multi_ack or multi_ack_detailed:
259 * upload-pack sends "ACK obj-id" on the first common object it finds.
260 After that it says nothing until the client gives it a "done".
262 * upload-pack sends "NAK" on a flush-pkt if no common object
263 has been found yet. If one has been found, and thus an ACK
264 was already sent, its silent on the flush-pkt.
266 After the client has gotten enough ACK responses that it can determine
267 that the server has enough information to send an efficient packfile
268 (in the canonical implementation, this is determined when it has received
269 enough ACKs that it can color everything left in the --date-order queue
270 as common with the server, or the --date-order queue is empty), or the
271 client determines that it wants to give up (in the canonical implementation,
272 this is determined when the client sends 256 'have' lines without getting
273 any of them ACKed by the server - meaning there is nothing in common and
274 the server should just send all it's objects), then the client will send
275 a 'done' command. The 'done' command signals to the server that the client
276 is ready to receive it's packfile data.
278 However, the 256 limit *only* turns on in the canonical client
279 implementation if we have received at least one "ACK %s continue"
280 during a prior round. This helps to ensure that at least one common
281 ancestor is found before we give up entirely.
283 Once the 'done' line is read from the client, the server will either
284 send a final 'ACK obj-id' or it will send a 'NAK'. The server only sends
285 ACK after 'done' if there is at least one common base and multi_ack or
286 multi_ack_detailed is enabled. The server always sends NAK after 'done'
287 if there is no common base found.
289 Then the server will start sending it's packfile data.
291 ----
292 server-response = *ack_multi ack / nak
293 ack_multi = PKT-LINE("ACK" SP obj-id ack_status LF)
294 ack_status = "continue" / "common" / "ready"
295 ack = PKT-LINE("ACK SP obj-id LF)
296 nak = PKT-LINE("NAK" LF)
297 ----
299 A simple clone may look like this (with no 'have' lines):
301 ----
302 C: 0054want 74730d410fcb6603ace96f1dc55ea6196122532d\0multi_ack \
303 side-band-64k ofs-delta\n
304 C: 0032want 7d1665144a3a975c05f1f43902ddaf084e784dbe\n
305 C: 0032want 5a3f6be755bbb7deae50065988cbfa1ffa9ab68a\n
306 C: 0032want 7e47fe2bd8d01d481f44d7af0531bd93d3b21c01\n
307 C: 0032want 74730d410fcb6603ace96f1dc55ea6196122532d\n
308 C: 0000
309 C: 0009done\n
311 S: 0008NAK\n
313 ----
315 An incremental update (fetch) response might look like this:
317 ----
318 C: 0054want 74730d410fcb6603ace96f1dc55ea6196122532d\0multi_ack \
319 side-band-64k ofs-delta\n
320 C: 0032want 7d1665144a3a975c05f1f43902ddaf084e784dbe\n
321 C: 0032want 5a3f6be755bbb7deae50065988cbfa1ffa9ab68a\n
322 C: 0000
323 C: 0032have 7e47fe2bd8d01d481f44d7af0531bd93d3b21c01\n
324 C: [30 more have lines]
325 C: 0032have 74730d410fcb6603ace96f1dc55ea6196122532d\n
326 C: 0000
328 S: 003aACK 7e47fe2bd8d01d481f44d7af0531bd93d3b21c01 continue\n
329 S: 003aACK 74730d410fcb6603ace96f1dc55ea6196122532d continue\n
330 S: 0008NAK\n
332 C: 0009done\n
334 S: 003aACK 74730d410fcb6603ace96f1dc55ea6196122532d\n
336 ----
339 Packfile Data
340 -------------
342 Now that the client and server have finished negotiation about what
343 the minimal amount of data that needs to be sent to the client is, the server
344 will construct and send the required data in packfile format.
346 See pack-format.txt for what the packfile itself actually looks like.
348 If 'side-band' or 'side-band-64k' capabilities have been specified by
349 the client, the server will send the packfile data multiplexed.
351 Each packet starting with the packet-line length of the amount of data
352 that follows, followed by a single byte specifying the sideband the
353 following data is coming in on.
355 In 'side-band' mode, it will send up to 999 data bytes plus 1 control
356 code, for a total of up to 1000 bytes in a pkt-line. In 'side-band-64k'
357 mode it will send up to 65519 data bytes plus 1 control code, for a
358 total of up to 65520 bytes in a pkt-line.
360 The sideband byte will be a '1', '2' or a '3'. Sideband '1' will contain
361 packfile data, sideband '2' will be used for progress information that the
362 client will generally print to stderr and sideband '3' is used for error
363 information.
365 If no 'side-band' capability was specified, the server will stream the
366 entire packfile without multiplexing.
369 Pushing Data To a Server
370 ========================
372 Pushing data to a server will invoke the 'receive-pack' process on the
373 server, which will allow the client to tell it which references it should
374 update and then send all the data the server will need for those new
375 references to be complete. Once all the data is received and validated,
376 the server will then update its references to what the client specified.
378 Authentication
379 --------------
381 The protocol itself contains no authentication mechanisms. That is to be
382 handled by the transport, such as SSH, before the 'receive-pack' process is
383 invoked. If 'receive-pack' is configured over the Git transport, those
384 repositories will be writable by anyone who can access that port (9418) as
385 that transport is unauthenticated.
387 Reference Discovery
388 -------------------
390 The reference discovery phase is done nearly the same way as it is in the
391 fetching protocol. Each reference obj-id and name on the server is sent
392 in packet-line format to the client, followed by a flush-pkt. The only
393 real difference is that the capability listing is different - the only
394 possible values are 'report-status', 'delete-refs' and 'ofs-delta'.
396 Reference Update Request and Packfile Transfer
397 ----------------------------------------------
399 Once the client knows what references the server is at, it can send a
400 list of reference update requests. For each reference on the server
401 that it wants to update, it sends a line listing the obj-id currently on
402 the server, the obj-id the client would like to update it to and the name
403 of the reference.
405 This list is followed by a flush-pkt and then the packfile that should
406 contain all the objects that the server will need to complete the new
407 references.
409 ----
410 update-request = command-list [pack-file]
412 command-list = PKT-LINE(command NUL capability-list LF)
413 *PKT-LINE(command LF)
414 flush-pkt
416 command = create / delete / update
417 create = zero-id SP new-id SP name
418 delete = old-id SP zero-id SP name
419 update = old-id SP new-id SP name
421 old-id = obj-id
422 new-id = obj-id
424 pack-file = "PACK" 28*(OCTET)
425 ----
427 If the receiving end does not support delete-refs, the sending end MUST
428 NOT ask for delete command.
430 The pack-file MUST NOT be sent if the only command used is 'delete'.
432 A pack-file MUST be sent if either create or update command is used,
433 even if the server already has all the necessary objects. In this
434 case the client MUST send an empty pack-file. The only time this
435 is likely to happen is if the client is creating
436 a new branch or a tag that points to an existing obj-id.
438 The server will receive the packfile, unpack it, then validate each
439 reference that is being updated that it hasn't changed while the request
440 was being processed (the obj-id is still the same as the old-id), and
441 it will run any update hooks to make sure that the update is acceptable.
442 If all of that is fine, the server will then update the references.
444 Report Status
445 -------------
447 After receiving the pack data from the sender, the receiver sends a
448 report if 'report-status' capability is in effect.
449 It is a short listing of what happened in that update. It will first
450 list the status of the packfile unpacking as either 'unpack ok' or
451 'unpack [error]'. Then it will list the status for each of the references
452 that it tried to update. Each line is either 'ok [refname]' if the
453 update was successful, or 'ng [refname] [error]' if the update was not.
455 ----
456 report-status = unpack-status
457 1*(command-status)
458 flush-pkt
460 unpack-status = PKT-LINE("unpack" SP unpack-result LF)
461 unpack-result = "ok" / error-msg
463 command-status = command-ok / command-fail
464 command-ok = PKT-LINE("ok" SP refname LF)
465 command-fail = PKT-LINE("ng" SP refname SP error-msg LF)
467 error-msg = 1*(OCTECT) ; where not "ok"
468 ----
470 Updates can be unsuccessful for a number of reasons. The reference can have
471 changed since the reference discovery phase was originally sent, meaning
472 someone pushed in the meantime. The reference being pushed could be a
473 non-fast-forward reference and the update hooks or configuration could be
474 set to not allow that, etc. Also, some references can be updated while others
475 can be rejected.
477 An example client/server communication might look like this:
479 ----
480 S: 007c74730d410fcb6603ace96f1dc55ea6196122532d refs/heads/local\0report-status delete-refs ofs-delta\n
481 S: 003e7d1665144a3a975c05f1f43902ddaf084e784dbe refs/heads/debug\n
482 S: 003f74730d410fcb6603ace96f1dc55ea6196122532d refs/heads/master\n
483 S: 003f74730d410fcb6603ace96f1dc55ea6196122532d refs/heads/team\n
484 S: 0000
486 C: 003e7d1665144a3a975c05f1f43902ddaf084e784dbe 74730d410fcb6603ace96f1dc55ea6196122532d refs/heads/debug\n
487 C: 003e74730d410fcb6603ace96f1dc55ea6196122532d 5a3f6be755bbb7deae50065988cbfa1ffa9ab68a refs/heads/master\n
488 C: 0000
491 S: 000aunpack ok\n
492 S: 0014ok refs/heads/debug\n
493 S: 0026ng refs/heads/master non-fast-forward\n
494 ----
Something went wrong with that request. Please try again.