vcs: gitconfig: don't execute arbitrary commands from embedded bare repositories

[config/dotfiles.git] / vcs / gitconfig.in

diff --git a/vcs/gitconfig.in b/vcs/gitconfig.in
index aa0ef858a5ff1855519f32dc57331145051914b4..9efa88498075b078b7cdbd84a85667574700419e 100644 (file)
--- a/vcs/gitconfig.in
+++ b/vcs/gitconfig.in
@@ -76,7 +76,7 @@
        ls  = log --stat
        lp  = log --patch
        lpw = log --patch --color-words
-       ld  = show --date=short --no-patch --pretty='format:%h (\"%s\", %ad)' # describe
+       ld  = show --no-patch --date=short --pretty='format:%h (%s, %ad)' # describe, same as --pretty=reference
        a   = add
        ap  = add --patch
        au  = add --update
@@ -102,6 +102,7 @@
        f   = fetch
        t   = tag
        p   = push
+       pf  = push --force-with-lease
        # Parallel git remote update. Also strips unnecessary output.
        ru = "! git remote \
              | xargs -d '\\n' -n1 -P0 git remote update 2>&1 \
@@ -174,6 +175,10 @@
        # Highlight moved code in a different color.
        colorMoved = zebra
 
+       # Highlight whitespace errors (at the end of the line) in all lines of
+       # a diff; the default shows them only in new lines
+       wsErrorHighlight = old,new,context
+
        # Replace "a/" and "b/" prefix in diffs with characters describing the
        # context (e.g. "i/"ndex and "w/"ork tree).
        mnemonicprefix = true
@@ -242,6 +247,17 @@
        # Don't create .git/hooks with any sample hooks. Reduces the clutter
        # in new git repositories.
        templateDir =
+       # Keep the default branch name
+       defaultBranch = master
+
+[tag]
+       # Sort tags as version numbers
+       sort = version:refname
+
+[safe]
+       # Ignore embedded bare repositories to prevent executing arbitrary
+       # commands from untrusted repositories
+       bareRepository = explicit
 
 
 # NON-GIT SETTINGS
@@ -249,5 +265,12 @@
 [annex]
        # My SSH config already uses ControlMaster where appropriate.
        sshcaching = false
+       # Don't upgrade repositories automatically
+       autoupgraderepository = false
+       # Force `git add` to add to git, never to annex
+       gitaddtoannex = false
+       # Consider dotfiles to be `git annex add`able; restrictions of
+       # annex.largefiles (if set) are still applied
+       dotfiles = true
 
 # vim: ft=gitconfig