Acquire, not clone

Why archive-first defeats hooks

git clone does several things that are individually reasonable and collectively a problem. It negotiates with a remote and transfers objects. Fine. It writes those objects into a .git directory. Fine. It materializes the repository’s configuration and hook directory as live, on-disk state. And it checks out a working tree using path names that the remote controls.

The trouble is that the last two happen before you have looked at anything. By the time clone returns success, executable configuration is resident on your filesystem, under your user, and the next git-adjacent command you run — or the next editor you open — may execute it.

The order is the product. Fetch, strip, inspect, then confer git-ness. Clone confers git-ness first and inspects never.

Fetch as an archive: the content arrives as inert bytes. Strip: hooks are removed, not disabled. Removal is stronger than disabling because disabling is a configuration state and configuration states can be changed. Inspect: scanners run on a tree that is not yet a repository. Materialize: now it becomes a real git repository, indistinguishable from a cloned one.

The knobs that matter on day two

zip-with-history is the default. zip-only / --no-history skips history when you do not need it — a disposable review tree, a CI artifact check. --fail-on defaults to high on acquire. Acquire that always succeeds teaches nothing; acquire that fails on every medium finding teaches people to force.

securegit acquire github:owner/repo
securegit acquire github:owner/repo --no-history -o /tmp/tree-only
securegit acquire https://github.com/owner/repo --fail-on high

What this does not protect you from

• It does not make the code safe to run. If you acquire a repository, read the report, and then run npm install && npm start, you have executed the code.
• It does not detect novel malware. A sophisticated, targeted implant designed to look like ordinary code will not be caught by pattern matching.
• It does not protect against a compromised upstream you already trust. Acquisition works exactly as designed and delivers you the malicious commit — inertly, scanned, with a receipt.