2 .\" Title: gitprotocol-http
3 .\" Author: [FIXME: author] [see http://www.docbook.org/tdg5/en/html/author]
4 .\" Generator: DocBook XSL Stylesheets vsnapshot <http://docbook.sf.net/>
7 .\" Source: Git 2.44.0.53.g0f9d4d28b7
10 .TH "GITPROTOCOL\-HTTP" "5" "2024\-02\-27" "Git 2\&.44\&.0\&.53\&.g0f9d4d2" "Git Manual"
11 .\" -----------------------------------------------------------------
12 .\" * Define some portability stuff
13 .\" -----------------------------------------------------------------
14 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
15 .\" http://bugs.debian.org/507673
16 .\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
17 .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
20 .\" -----------------------------------------------------------------
21 .\" * set default formatting
22 .\" -----------------------------------------------------------------
23 .\" disable hyphenation
25 .\" disable justification (adjust text to left margin only)
27 .\" -----------------------------------------------------------------
28 .\" * MAIN CONTENT STARTS HERE *
29 .\" -----------------------------------------------------------------
31 gitprotocol-http \- Git HTTP\-based protocols
35 <over\-the\-wire\-protocol>
40 Git supports two HTTP based transfer protocols\&. A "dumb" protocol which requires only a standard HTTP server on the server end of the connection, and a "smart" protocol which requires a Git aware CGI (or server module)\&. This document describes both protocols\&.
42 As a design feature smart clients can automatically upgrade "dumb" protocol URLs to smart URLs\&. This permits all users to have the same published URL, and the peers automatically select the most efficient transport available to them\&.
45 URLs for Git repositories accessed by HTTP use the standard HTTP URL syntax documented by RFC 1738, so they are of the form:
51 http://<host>:<port>/<path>?<searchpart>
57 Within this documentation the placeholder \fB$GIT_URL\fR will stand for the http:// repository URL entered by the end\-user\&.
59 Servers SHOULD handle all requests to locations matching \fB$GIT_URL\fR, as both the "smart" and "dumb" HTTP protocols used by Git operate by appending additional path components onto the end of the user supplied \fB$GIT_URL\fR string\&.
61 An example of a dumb client requesting a loose object:
67 $GIT_URL: http://example\&.com:8080/git/repo\&.git
68 URL request: http://example\&.com:8080/git/repo\&.git/objects/d0/49f6c27a2244e12041955e262a404c7faba355
74 An example of a smart request to a catch\-all gateway:
80 $GIT_URL: http://example\&.com/daemon\&.cgi?svc=git&q=
81 URL request: http://example\&.com/daemon\&.cgi?svc=git&q=/info/refs&service=git\-receive\-pack
87 An example of a request to a submodule:
93 $GIT_URL: http://example\&.com/git/repo\&.git/path/submodule\&.git
94 URL request: http://example\&.com/git/repo\&.git/path/submodule\&.git/info/refs
100 Clients MUST strip a trailing \fB/\fR, if present, from the user supplied \fB$GIT_URL\fR string to prevent empty path tokens (\fB//\fR) from appearing in any URL sent to a server\&. Compatible clients MUST expand \fB$GIT_URL/info/refs\fR as \fBfoo/info/refs\fR and not \fBfoo//info/refs\fR\&.
103 Standard HTTP authentication is used if authentication is required to access a repository, and MAY be configured and enforced by the HTTP server software\&.
105 Because Git repositories are accessed by standard path components server administrators MAY use directory based permissions within their HTTP server to control repository access\&.
107 Clients SHOULD support Basic authentication as described by RFC 2617\&. Servers SHOULD support Basic authentication by relying upon the HTTP server placed in front of the Git server software\&.
109 Servers SHOULD NOT require HTTP cookies for the purposes of authentication or access control\&.
111 Clients and servers MAY support other common forms of HTTP based authentication, such as Digest authentication\&.
114 Clients and servers SHOULD support SSL, particularly to protect passwords when relying on Basic HTTP authentication\&.
117 The Git over HTTP protocol (much like HTTP itself) is stateless from the perspective of the HTTP server side\&. All state MUST be retained and managed by the client process\&. This permits simple round\-robin load\-balancing on the server side, without needing to worry about state management\&.
119 Clients MUST NOT require state management on the server side in order to function correctly\&.
121 Servers MUST NOT require HTTP cookies in order to function correctly\&. Clients MAY store and forward HTTP cookies during request processing as described by RFC 2616 (HTTP/1\&.1)\&. Servers SHOULD ignore any cookies sent by a client\&.
122 .SH "GENERAL REQUEST PROCESSING"
124 Except where noted, all standard HTTP behavior SHOULD be assumed by both client and server\&. This includes (but is not necessarily limited to):
126 If there is no repository at \fB$GIT_URL\fR, or the resource pointed to by a location matching \fB$GIT_URL\fR does not exist, the server MUST NOT respond with \fB200 OK\fR response\&. A server SHOULD respond with \fB404 Not Found\fR, \fB410 Gone\fR, or any other suitable HTTP status code which does not imply the resource exists as requested\&.
128 If there is a repository at \fB$GIT_URL\fR, but access is not currently permitted, the server MUST respond with the \fB403 Forbidden\fR HTTP status code\&.
130 Servers SHOULD support both HTTP 1\&.0 and HTTP 1\&.1\&. Servers SHOULD support chunked encoding for both request and response bodies\&.
132 Clients SHOULD support both HTTP 1\&.0 and HTTP 1\&.1\&. Clients SHOULD support chunked encoding for both request and response bodies\&.
134 Servers MAY return ETag and/or Last\-Modified headers\&.
136 Clients MAY revalidate cached entities by including If\-Modified\-Since and/or If\-None\-Match request headers\&.
138 Servers MAY return \fB304 Not Modified\fR if the relevant headers appear in the request and the entity has not changed\&. Clients MUST treat \fB304 Not Modified\fR identical to \fB200 OK\fR by reusing the cached entity\&.
140 Clients MAY reuse a cached entity without revalidation if the Cache\-Control and/or Expires header permits caching\&. Clients and servers MUST follow RFC 2616 for cache controls\&.
141 .SH "DISCOVERING REFERENCES"
143 All HTTP clients MUST begin either a fetch or a push exchange by discovering the references available on the remote repository\&.
146 HTTP clients that only support the "dumb" protocol MUST discover references by making a request for the special info/refs file of the repository\&.
148 Dumb HTTP clients MUST make a \fBGET\fR request to \fB$GIT_URL/info/refs\fR, without any search/query parameters\&.
154 C: GET $GIT_URL/info/refs HTTP/1\&.0
166 S: 95dcfa3633004da0049d3d0fa03f80589cbcaf31 refs/heads/maint
167 S: d049f6c27a2244e12041955e262a404c7faba355 refs/heads/master
168 S: 2cb58b79488a98d2721cea644875a8dd0026b115 refs/tags/v1\&.0
169 S: a3c2e2402b99163d1d59756e5f207ae21cccba4c refs/tags/v1\&.0^{}
175 The Content\-Type of the returned info/refs entity SHOULD be \fBtext/plain; charset=utf\-8\fR, but MAY be any content type\&. Clients MUST NOT attempt to validate the returned Content\-Type\&. Dumb servers MUST NOT return a return type starting with \fBapplication/x\-git\-\fR\&.
177 Cache\-Control headers MAY be returned to disable caching of the returned entity\&.
179 When examining the response clients SHOULD only examine the HTTP status code\&. Valid responses are \fB200 OK\fR, or \fB304 Not Modified\fR\&.
181 The returned content is a UNIX formatted text file describing each ref and its known value\&. The file SHOULD be sorted by name according to the C locale ordering\&. The file SHOULD NOT include the default ref named \fBHEAD\fR\&.
187 info_refs = *( ref_record )
188 ref_record = any_ref / peeled_ref
198 any_ref = obj\-id HTAB refname LF
199 peeled_ref = obj\-id HTAB refname LF
200 obj\-id HTAB refname "^{}" LF
207 HTTP clients that support the "smart" protocol (or both the "smart" and "dumb" protocols) MUST discover references by making a parameterized request for the info/refs file of the repository\&.
209 The request MUST contain exactly one query parameter, \fBservice=$servicename\fR, where \fB$servicename\fR MUST be the service name the client wishes to contact to complete the operation\&. The request MUST NOT contain additional query parameters\&.
215 C: GET $GIT_URL/info/refs?service=git\-upload\-pack HTTP/1\&.0
229 S: 95dcfa3633004da0049d3d0fa03f80589cbcaf31 refs/heads/maint
230 S: d049f6c27a2244e12041955e262a404c7faba355 refs/heads/master
231 S: 2cb58b79488a98d2721cea644875a8dd0026b115 refs/tags/v1\&.0
232 S: a3c2e2402b99163d1d59756e5f207ae21cccba4c refs/tags/v1\&.0^{}
245 S: Content\-Type: application/x\-git\-upload\-pack\-advertisement
246 S: Cache\-Control: no\-cache
248 S: 001e# service=git\-upload\-pack\en
250 S: 004895dcfa3633004da0049d3d0fa03f80589cbcaf31 refs/heads/maint\e0multi_ack\en
251 S: 003fd049f6c27a2244e12041955e262a404c7faba355 refs/heads/master\en
252 S: 003c2cb58b79488a98d2721cea644875a8dd0026b115 refs/tags/v1\&.0\en
253 S: 003fa3c2e2402b99163d1d59756e5f207ae21cccba4c refs/tags/v1\&.0^{}\en
260 The client may send Extra Parameters (see \fBgitprotocol-pack\fR(5)) as a colon\-separated string in the Git\-Protocol HTTP header\&.
262 Uses the \fB\-\-http\-backend\-info\-refs\fR option to \fBgit-upload-pack\fR(1)\&.
265 .nr an-no-space-flag 1
269 \fBDumb Server Response\fR
272 Dumb servers MUST respond with the dumb server reply format\&.
274 See the prior section under dumb clients for a more detailed description of the dumb server response\&.
278 .nr an-no-space-flag 1
282 \fBSmart Server Response\fR
285 If the server does not recognize the requested service name, or the requested service name has been disabled by the server administrator, the server MUST respond with the \fB403 Forbidden\fR HTTP status code\&.
287 Otherwise, smart servers MUST respond with the smart server reply format for the requested service name\&.
289 Cache\-Control headers SHOULD be used to disable caching of the returned entity\&.
291 The Content\-Type MUST be \fBapplication/x\-$servicename\-advertisement\fR\&. Clients SHOULD fall back to the dumb protocol if another content type is returned\&. When falling back to the dumb protocol clients SHOULD NOT make an additional request to \fB$GIT_URL/info/refs\fR, but instead SHOULD use the response already in hand\&. Clients MUST NOT continue if they do not support the dumb protocol\&.
293 Clients MUST validate the status code is either \fB200 OK\fR or \fB304 Not Modified\fR\&.
295 Clients MUST validate the first five bytes of the response entity matches the regex \fB^[0\-9a\-f]{4}#\fR\&. If this test fails, clients MUST NOT continue\&.
297 Clients MUST parse the entire response as a sequence of pkt\-line records\&.
299 Clients MUST verify the first pkt\-line is \fB# service=$servicename\fR\&. Servers MUST set $servicename to be the request parameter value\&. Servers SHOULD include an LF at the end of this line\&. Clients MUST ignore an LF at the end of the line\&.
301 Servers MUST terminate the response with the magic \fB0000\fR end pkt\-line marker\&.
303 The returned response is a pkt\-line stream describing each ref and its known value\&. The stream SHOULD be sorted by name according to the C locale ordering\&. The stream SHOULD include the default ref named \fBHEAD\fR as the first ref\&. The stream MUST include capability declarations behind a NUL on the first ref\&.
305 The returned response contains "version 1" if "version=1" was sent as an Extra Parameter\&.
311 smart_reply = PKT\-LINE("# service=$servicename" LF)
316 ref_list = empty_list / non_empty_list
326 empty_list = PKT\-LINE(zero\-id SP "capabilities^{}" NUL cap\-list LF)
336 non_empty_list = PKT\-LINE(obj\-id SP name NUL cap_list LF)
347 cap\-list = capability *(SP capability)
348 capability = 1*(LC_ALPHA / DIGIT / "\-" / "_")
359 ref_record = any_ref / peeled_ref
360 any_ref = PKT\-LINE(obj\-id SP name LF)
361 peeled_ref = PKT\-LINE(obj\-id SP name LF)
362 PKT\-LINE(obj\-id SP name "^{}" LF
368 .SH "SMART SERVICE GIT\-UPLOAD\-PACK"
370 This service reads from the repository pointed to by \fB$GIT_URL\fR\&.
372 Clients MUST first perform ref discovery with \fB$GIT_URL/info/refs?service=git\-upload\-pack\fR\&.
378 C: POST $GIT_URL/git\-upload\-pack HTTP/1\&.0
379 C: Content\-Type: application/x\-git\-upload\-pack\-request
381 C: 0032want 0a53e9ddeaddad63ad106860237bbf53411d11a7\en
382 C: 0032have 441b40d833fdfa93eb2908e52742248faf0ee993\en
394 S: Content\-Type: application/x\-git\-upload\-pack\-result
395 S: Cache\-Control: no\-cache
397 S: \&.\&.\&.\&.ACK %s, continue
404 Clients MUST NOT reuse or revalidate a cached response\&. Servers MUST include sufficient Cache\-Control headers to prevent caching of the response\&.
406 Servers SHOULD support all capabilities defined here\&.
408 Clients MUST send at least one "want" command in the request body\&. Clients MUST NOT reference an id in a "want" command which did not appear in the response obtained through ref discovery unless the server advertises capability \fBallow\-tip\-sha1\-in\-want\fR or \fBallow\-reachable\-sha1\-in\-want\fR\&.
414 compute_request = want_list
417 request_end = "0000" / "done"
427 want_list = PKT\-LINE(want SP cap_list LF)
429 want_pkt = PKT\-LINE(want LF)
431 cap_list = capability *(SP capability)
441 have_list = *PKT\-LINE("have" SP id LF)
447 TODO: Document this further\&.
448 .SS "The Negotiation Algorithm"
450 The computation to select the minimal pack proceeds as follows (C = client, S = server):
454 C: Use ref discovery to obtain the advertised refs\&.
456 C: Place any object seen into set \fBadvertised\fR\&.
458 C: Build an empty set, \fBcommon\fR, to hold the objects that are later determined to be on both ends\&.
460 C: Build a set, \fBwant\fR, of the objects from \fBadvertised\fR that the client wants to fetch, based on what it saw during ref discovery\&.
462 C: Start a queue, \fBc_pending\fR, ordered by commit time (popping newest first)\&. Add all client refs\&. When a commit is popped from the queue its parents SHOULD be automatically inserted back\&. Commits MUST only enter the queue once\&.
464 \fIone compute step:\fR
466 C: Send one \fB$GIT_URL/git\-upload\-pack\fR request:
472 C: 0032want <want\-#1>\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.
473 C: 0032want <want\-#2>\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.
475 C: 0032have <common\-#1>\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.
476 C: 0032have <common\-#2>\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.
478 C: 0032have <have\-#1>\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.
479 C: 0032have <have\-#2>\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.\&.
487 The stream is organized into "commands", with each command appearing by itself in a pkt\-line\&. Within a command line, the text leading up to the first space is the command name, and the remainder of the line to the first LF is the value\&. Command lines are terminated with an LF as the last byte of the pkt\-line value\&.
489 Commands MUST appear in the following order, if they appear at all in the request stream:
513 The stream is terminated by a pkt\-line flush (\fB0000\fR)\&.
515 A single "want" or "have" command MUST have one hex formatted object name as its value\&. Multiple object names MUST be sent by sending multiple commands\&. Object names MUST be given using the object format negotiated through the \fBobject\-format\fR capability (default SHA\-1)\&.
517 The \fBhave\fR list is created by popping the first 32 commits from \fBc_pending\fR\&. Fewer can be supplied if \fBc_pending\fR empties\&.
519 If the client has sent 256 "have" commits and has not yet received one of those back from \fBs_common\fR, or the client has emptied \fBc_pending\fR it SHOULD include a "done" command to let the server know it won\(cqt proceed:
531 S: Parse the git\-upload\-pack request:
533 Verify all objects in \fBwant\fR are directly reachable from refs\&.
535 The server MAY walk backwards through history or through the reflog to permit slightly stale requests\&.
537 If no "want" objects are received, send an error: TODO: Define error if no "want" lines are requested\&.
539 If any "want" object is not reachable, send an error: TODO: Define error if an invalid "want" is requested\&.
541 Create an empty list, \fBs_common\fR\&.
545 Loop through the objects in the order supplied by the client\&.
547 For each object, if the server has the object reachable from a ref, add it to \fBs_common\fR\&. If a commit is added to \fBs_common\fR, do not add any ancestors, even if they also appear in \fBhave\fR\&.
549 S: Send the git\-upload\-pack response:
551 If the server has found a closed set of objects to pack or the request ends with "done", it replies with the pack\&. TODO: Document the pack based response
563 The returned stream is the side\-band\-64k protocol supported by the git\-upload\-pack service, and the pack is embedded into stream 1\&. Progress messages from the server side MAY appear in stream 2\&.
565 Here a "closed set of objects" is defined to have at least one path from every "want" to at least one "common" object\&.
567 If the server needs more information, it replies with a status continue response: TODO: Document the non\-pack response
569 C: Parse the upload\-pack response: TODO: Document parsing response
571 \fIDo another compute step\&.\fR
572 .SH "SMART SERVICE GIT\-RECEIVE\-PACK"
574 This service reads from the repository pointed to by \fB$GIT_URL\fR\&.
576 Clients MUST first perform ref discovery with \fB$GIT_URL/info/refs?service=git\-receive\-pack\fR\&.
582 C: POST $GIT_URL/git\-receive\-pack HTTP/1\&.0
583 C: Content\-Type: application/x\-git\-receive\-pack\-request
585 C: \&.\&.\&.\&.0a53e9ddeaddad63ad106860237bbf53411d11a7 441b40d833fdfa93eb2908e52742248faf0ee993 refs/heads/maint\e0 report\-status
598 S: Content\-Type: application/x\-git\-receive\-pack\-result
599 S: Cache\-Control: no\-cache
607 Clients MUST NOT reuse or revalidate a cached response\&. Servers MUST include sufficient Cache\-Control headers to prevent caching of the response\&.
609 Servers SHOULD support all capabilities defined here\&.
611 Clients MUST send at least one command in the request body\&. Within the command portion of the request body clients SHOULD send the id obtained through ref discovery as old_id\&.
617 update_request = command_list
618 "PACK" <binary\-data>
628 command_list = PKT\-LINE(command NUL cap_list LF)
630 command_pkt = PKT\-LINE(command LF)
631 cap_list = *(SP capability) SP
641 command = create / delete / update
642 create = zero\-id SP new_id SP name
643 delete = old_id SP zero\-id SP name
644 update = old_id SP new_id SP name
650 TODO: Document this further\&.
653 \m[blue]\fBRFC 1738: Uniform Resource Locators (URL)\fR\m[]\&\s-2\u[1]\d\s+2 \m[blue]\fBRFC 2616: Hypertext Transfer Protocol \(em HTTP/1\&.1\fR\m[]\&\s-2\u[2]\d\s+2
656 \fBgitprotocol-pack\fR(5) \fBgitprotocol-capabilities\fR(5)
659 Part of the \fBgit\fR(1) suite
662 RFC 1738: Uniform Resource Locators (URL)
664 \%https://www.ietf.org/rfc/rfc1738.txt
667 RFC 2616: Hypertext Transfer Protocol \(em HTTP/1.1
669 \%https://www.ietf.org/rfc/rfc2616.txt