Skip to main content

repligit

repligit is a Python library that implements the Git transfer protocol. It enables users to query remote repositories, mirror repositories between two locations without storing state locally, and incrementally archive repositories to disk. repligit is used by Hubcast to mirror repositories from GitHub to GitLab for secure CI/CD on local hardware.

Installation

You can install repligit from PyPI using pip:

pip install repligit

Features

  • Query remote Git repositories.
  • Mirror repositories between different Git hosting services.
  • Incrementally archive repositories to disk.
  • Implements Git transfer protocol in pure Python.

Example Usage

from repligit import fetch_pack, ls_remote, send_pack


def main():
    src_remote_url = "https://github.com/spack/spack.git"
    dest_remote_url = "https://gitlab.com/test-org/test-repo.git"

    branch_name = "main"

    target_ref = f"refs/heads/{branch_name}"

    # Authentication credentials
    # Note: Only provide credentials when authentication is required
    # src_username = "<username>"  # Uncomment if source repo requires auth
    # src_password = "<token>"     # Uncomment if source repo requires auth
    dest_username = "<username>"   # For destination repo write access
    dest_password = "<token>"      # For destination repo write access

    # List references from source repository (without authentication)
    gh_refs = ls_remote(src_remote_url)

    # List references from destination repository (with authentication)
    gl_refs = ls_remote(
        dest_remote_url,
        username=dest_username,
        password=dest_password,
    )

    want_sha = gh_refs[target_ref]
    have_shas = set(gl_refs.values())

    from_sha = gl_refs.get(target_ref) or ("0" * 40)

    if from_sha == want_sha:
        print("Everything is up to date")
        return

    # Fetch the packfile from source repository
    packfile = fetch_pack(
        src_remote_url,
        want_sha,
        have_shas,
        # username=src_username,  # Uncomment if source repo requires auth
        # password=src_password,  # Uncomment if source repo requires auth
    )

    # Upload packfile to destination repository
    send_pack(
        dest_remote_url,
        target_ref,
        from_sha,
        want_sha,
        packfile,
        username=dest_username,
        password=dest_password,
    )


if __name__ == "__main__":
    main()

License

Licensed under the Apache License, Version 2.0 w/LLVM Exception (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception

LLNL-CODE-2003682

Metadata

Release files for repligit 0.5.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for repligit 0.5.0
File Size Uploaded Provenance Actions
repligit-0.5.0.tar.gz 20.4 kB With provenance Details for repligit-0.5.0.tar.gz

Built distribution (wheel)

Table of built distributions (wheels) for repligit 0.5.0
File Interpreter ABI Platform Actions
repligit-0.5.0-py3-none-any.whl Python 3 none any Details for repligit-0.5.0-py3-none-any.whl

Total release size: 36.9 kB

Release files / repligit-0.5.0.tar.gz

Download URL repligit-0.5.0.tar.gz
Size 20.4 kB
Tags Source
SHA-256 checksum
How to use checksums
c24fa450ba3a796cd832a7447b75df41fddaca52029271d6dcec535675260f29
BLAKE2b-256 checksum
How to use checksums
1ce86f9d31a9b47de89ff9940d3d3632b3bb6e65566c489520b4968c9d2c86ae
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Sep 1, 2026.

Transparency log

Release files / repligit-0.5.0-py3-none-any.whl

Download URL repligit-0.5.0-py3-none-any.whl
Size 16.5 kB
Tags Python 3
SHA-256 checksum
How to use checksums
db1df049fb08a1d250dea21f59a084459fe2a55f12e210e670a7e19a59edb3bd
BLAKE2b-256 checksum
How to use checksums
af046ea0b3dc80121d853abfd04ffea0364d828d4d5f0130bbe0234d3ac2969e
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Sep 1, 2026.

Transparency log

Security for repligit 0.5.0

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Full provenance

All 2 files in this release have been uploaded with provenance metadata.

Select from 2 files

Attestation for repligit-0.5.0.tar.gz

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Sep 1, 2026.

Transparency log

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page