~/tutorials/014-git-here.md

014: git, here

git is where the source of everything lives. On this site it does one thing, and the reason it does only one thing is the lesson.

The one thing

git clone https://github.com/nmap/nmap

Cloning into 'nmap'...
from github.com/nmap/nmap
archive nmap.tar.gz

The shell knows four forges: github.com, gitlab.com, codeberg.org, git.sr.ht. Anything else is refused with the list, and the list is the whole vocabulary.

What comes back is an archive of the repository, straight from the source. Not a mirror somebody set up, not a copy this site made and now vouches for. The tools shelf runs on this: open source you take from the source, and anything commercial gets a pointer to the official page and no mirror. A download you cannot trace to its origin is a supply chain problem wearing a friendly face.

What does not exist here

git status

status, commit, log, push: none of them exist in this shell, and it says so rather than pretending. This is not a development machine, and a browser shell that could commit would be a strange thing to hand a stranger.

The lesson two caveat applies with one correction: this shell has no network of its own, so git clone does not fetch the bytes itself. What it gives you is the archive's name and a working link. Click it and the download comes through this site, which hands you to the forge rather than copying the file through itself. On your own machine the same command does the whole thing in one step.

Why take from the source

Because a mirror can differ from the thing it mirrors, and the difference is where the trouble lives. A checksum you verify, an archive that comes from the forge that hosts the code, and a short path between author and machine: that is the whole discipline, and it starts with asking where a download actually comes from. The tools shelf says it as a rule. The shell enforces it as a list.

Try it

1. Clone something from the shelf. Read the reply: where does the archive come from?
2. Try to clone from a host that is not a forge this shell knows. Read the refusal.
3. Ask git for anything that is not clone, and read what it says exists.
4. On your own machine, run the same clone for real, and compare what you get.