GIT-RECEIVE-PACK(1)

📦
version 2.56.0 · 25 versions
, in arch rolling

💅 git-receive-pack — the manual page, but make it iconic

okay so bestie, welcome to git-receive-pack from the git(1) suite — this is the page for the thing that catches what you push. yes, it's a whole vibe. let's get into it ✨

🌸 NAME

git-receive-pack — literally the command that receives what gets pushed into the repository. it's giving "you throw, i catch" 🫶

✨ SYNOPSIS

git receive-pack <git-dir>

🦋 DESCRIPTION

so here's the tea: git send-pack invokes this, and it updates the repository with all the info the remote end feeds it. collaboration, but make it protocol 💅

lowkey important: you, a regular human end user, usually do not invoke this directly. the UI for the whole protocol lives on the git send-pack side — this program pair is meant to be used to push updates to a remote repository. for pull operations tho, go look at git-fetch-pack(1) instead, that's a different main character.

this command allows for the creation and fast-forwarding of sha1 refs (heads/tags) on the remote end. and okay, technically speaking it's the local end where git-receive-pack runs, but to the user sitting at the send-pack end, it's updating the remote. confused? yeah, honestly, same 😭

there are other real-world examples of using update and post-update hooks chillin' in the Documentation/howto directory, if you want receipts.

also git-receive-pack honours the receive.denyNonFastForwards config option, which tells it whether updates to a ref should be denied if they're not fast-forwards. no sneaky rewrites, ok?

and there's a whole bunch of other receive.* config options available to tweak its behavior — peep git-config(1) for the full menu 🎀

🎀 OPTIONS 🎀

  • <git-dir> — the repository to sync into. that's it, that's the destination 👑
  • --http-backend-info-refs — used by git-http-backend(1) to serve up $GIT_URL/info/refs?service=git-receive-pack requests. see --http-backend-info-refs in git-upload-pack(1) for the lore.
  • --skip-connectivity-check — this one bypasses the connectivity checks that validate the existence of all objects in the transitive closure of reachable objects. it's intended for server operators who want to implement their own object connectivity validation outside of Git. super useful in cases where the server-side knows extra info about how Git is being used, so it can rely on certain guarantees to more efficiently compute object connectivity that Git itself can't make.
⚠️ bestie, listen to me: using this option without a reliable external mechanism to ensure full reachable object connectivity risks corrupting the repository, and it should not be used in the general case. like, fr fr, don't. 💀

💖 PRE-RECEIVE HOOK

before any ref is updated — like, before before — if $GIT_DIR/hooks/pre-receive exists and is executable, it gets invoked once with no parameters. and the standard input of the hook will be one line per ref to be updated, looking like this:

sha1-old SP sha1-new SP refname LF

the refname value is relative to $GIT_DIR — e.g. for the master head this is "refs/heads/master". the two sha1 values before each refname are the object names for the refname before and after the update. refs to be created will have sha1-old equal to 0{40}, while refs to be deleted will have sha1-new equal to 0{40} — otherwise sha1-old and sha1-new should be valid objects in the repository ✨

when accepting a signed push (see git-push(1)), the signed push certificate is stored in a blob, and an environment variable GIT_PUSH_CERT can be consulted for its object name. see the description of the post-receive hook for an example. in addition, the certificate is verified using GPG, and the result gets exported with these environment variables:

🌈 the GIT_PUSH_CERT* env vars

  • GIT_PUSH_CERT_SIGNER — the name and the e-mail address of the owner of the key that signed the push certificate.
  • GIT_PUSH_CERT_KEY — the GPG key ID of the key that signed the push certificate.
  • GIT_PUSH_CERT_STATUS — the status of GPG verification of the push certificate, using the same mnemonic as used in %G? format of git log family of commands (see git-log(1)).
  • GIT_PUSH_CERT_NONCE — the nonce string the process asked the signer to include in the push certificate. if this doesn't match the value recorded on the "nonce" header in the push certificate, it may indicate that the certificate is a valid one that's being replayed from a separate "git push" session. 👀
  • GIT_PUSH_CERT_NONCE_STATUS — the status of the nonce, and it can be any of these:
    • UNSOLICITED — "git push --signed" sent a nonce when we did not ask it to send one.
    • MISSING — "git push --signed" did not send any nonce header.
    • BAD — "git push --signed" sent a bogus nonce.
    • OK — "git push --signed" sent the nonce we asked it to send. slay 💅
    • SLOP — "git push --signed" sent a nonce different from what we asked it to send now, but in a previous session. see the GIT_PUSH_CERT_NONCE_SLOP environment variable.
  • GIT_PUSH_CERT_NONCE_SLOP — "git push --signed" sent a nonce different from what we asked it to send now, but in a different session whose starting time is different by this many seconds from the current session. only meaningful when GIT_PUSH_CERT_NONCE_STATUS says SLOP. also read about the receive.certNonceSlop variable in git-config(1).

this hook is called before any refname is updated and before any fast-forward checks are performed. so yeah, it's early early.

if the pre-receive hook exits with a non-zero exit status, no updates will be performed, and the update, post-receive and post-update hooks will not be invoked either. this can be useful to quickly bail out if the update is not to be supported. dramatic exit, honestly iconic.

see the notes on the quarantine environment below 👇

🧚 UPDATE HOOK

before each ref is updated, if $GIT_DIR/hooks/update exists and is executable, it's invoked once per ref, with three parameters:

$GIT_DIR/hooks/update refname sha1-old sha1-new

the refname parameter is relative to $GIT_DIR — e.g. for the master head this is "refs/heads/master". the two sha1 arguments are the object names for the refname before and after the update. note that the hook is called before the refname is updated, so either sha1-old is 0{40} (meaning there is no such ref yet), or it should match what is recorded in refname.

the hook should exit with non-zero status if it wants to disallow updating the named ref. otherwise it should exit with zero. simple as that 🫶

⚠️ okay so real talk: successful execution (a zero exit status) of this hook does not ensure the ref will actually be updated — it's only a prerequisite. so it's not a good idea to send notices (e.g. email) from this hook. consider using the post-receive hook instead, bestie. fr fr.

🌸 POST-RECEIVE HOOK

after all refs were updated (or attempted to be updated), if any ref update was successful, and if $GIT_DIR/hooks/post-receive exists and is executable, it will be invoked once with no parameters. the standard input of the hook will be one line for each successfully updated ref:

sha1-old SP sha1-new SP refname LF

the refname value is relative to $GIT_DIR — e.g. for the master head this is "refs/heads/master". the two sha1 values before each refname are the object names for the refname before and after the update. refs that were created will have sha1-old equal to 0{40}, while refs that were deleted will have sha1-new equal to 0{40} — otherwise sha1-old and sha1-new should be valid objects in the repository.

the GIT_PUSH_CERT* environment variables can be inspected, just as in the pre-receive hook, after accepting a signed push. 🎀

using this hook, it's easy to generate mails describing the updates to the repository. this example script sends one mail message per ref listing the commits pushed to the repository, and logs the push certificates of signed pushes with good signatures to a logger service:

#!/bin/sh
# mail out commit update information.
while read oval nval ref
do
        if expr "$oval" : '0*$' >/dev/null
        then
                echo "Created a new ref, with the following commits:"
                git rev-list --pretty "$nval"
        else
                echo "New commits:"
                git rev-list --pretty "$nval" "^$oval"
        fi |
        mail -s "Changes to ref $ref" commit-list@mydomain
done
# log signed push certificate, if any
if test -n "${GIT_PUSH_CERT-}" && test ${GIT_PUSH_CERT_STATUS} = G
then
        (
                echo expected nonce is ${GIT_PUSH_NONCE}
                git cat-file blob ${GIT_PUSH_CERT}
        ) | mail -s "push certificate from $GIT_PUSH_CERT_SIGNER" push-log@mydomain
fi
exit 0

the exit code from this hook invocation is ignored — however, a non-zero exit code will generate an error message. so it's not fully silent, just mostly 💀

sidenote: it's possible for refname to not have sha1-new when this hook runs. this can easily occur if another user modifies the ref after it was updated by git-receive-pack, but before the hook was able to evaluate it. it's recommended that hooks rely on sha1-new rather than the current value of refname. trust the snapshot, not the live feed, iykyk.

👑 POST-UPDATE HOOK

after all other processing, if at least one ref was updated, and if $GIT_DIR/hooks/post-update exists and is executable, then post-update will be called with the list of refs that have been updated. this can be used to implement any repository wide cleanup tasks. janitor era 🧹

the exit code from this hook invocation is ignored — the only thing left for git-receive-pack to do at that point is to exit itself anyway. like, it's already walking out the door 🚪

this hook can be used, for example, to run git update-server-info if the repository is packed and is served via a dumb transport:

#!/bin/sh
exec git update-server-info

💜 QUARANTINE ENVIRONMENT

when receive-pack takes in objects, they're placed into a temporary "quarantine" directory within the $GIT_DIR/objects directory and migrated into the main object store only after the pre-receive hook has completed. if the push fails before then, the temporary directory is removed entirely. bye bye 👋

this has a few user-visible effects and caveats:

  1. pushes which fail due to problems with the incoming pack, missing objects, or due to the pre-receive hook will not leave any on-disk data. this is usually helpful to prevent repeated failed pushes from filling up your disk, but can make debugging more challenging. 😭 tradeoffs, bestie.
  2. any objects created by the pre-receive hook will be created in the quarantine directory (and migrated only if it succeeds).
  3. the pre-receive hook MUST NOT update any refs to point to quarantined objects. other programs accessing the repository will not be able to see the objects (and if the pre-receive hook fails, those refs would become corrupted). for safety, any ref updates from within pre-receive are automatically rejected. 🔥 not a suggestion, a rule.

🍓 SEE ALSO

⭐ GIT

part of the git(1) suite 🫶

and that's the whole page, bestie — documented by the Git crew, version <rainbow>Git 2.56.0</rainbow>, dated <rainbow>2026-09-27</rainbow>. go forth and push responsibly 💅✨🎀

📦 where this page comes from