populate: let git sources keep hooks, refuse them only for git+file:

git sources refused work trees with hooks, but populate's Git doesn't
run hooks, so git-foreign's work tree with a hook is fine to use, as it
expects.  Only Nix's Git runs them, in a git+file: flake, so drawing
inputs refers to a work tree with hooks as path: instead.

3 files changed, 19 insertions, 26 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 730a9d1..23171e4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,11 +8,11 @@
   login directory.
 - Git can't take a `git` source's `url` or `ref`, or a `pass` source's
   `name`, for an option.
-- `git` sources also refuse work trees whose `.git` directory contains
-  hooks, or in which a submodule's `.git` isn't a file naming a repository
-  in `.git/modules`, unless `reclone` is set.
+- `git` sources also refuse work trees in which a submodule's `.git` isn't
+  a file naming a repository in `.git/modules`, unless `reclone` is set.
 - Drawing inputs refers to a source in a Git work tree as `git+file:` only
-  if a `git` source would use its `.git` directory, and else as `path:`.
+  if a `git` source would use its `.git` directory, and it has no hooks,
+  and else as `path:`.
 - `git` sources with a branch or tag as `ref` follow it: populate fetches
   the branch or tag on every run, and resets the work tree to what it
   fetched.
diff --git a/README.md b/README.md
index e2b3418..a95eb24 100644
--- a/README.md
+++ b/README.md
@@ -316,10 +316,9 @@ everything else.  It doesn't change or remove anything outside:
   `git` source as well.
 
 * A `git` source only uses a work tree whose `.git` directory contains no
-  symlinks, no `commondir` file, no linked work trees, and no hooks, and
-  only the configuration that `git clone` and populate write, and in which
-  each `.git` of a submodule is a file naming a repository in
-  `.git/modules`.  Otherwise Git's
+  symlinks, no `commondir` file and no linked work trees, and only the
+  configuration that `git clone` and populate write, and in which each
+  `.git` of a submodule is a file naming a repository in `.git/modules`.  Otherwise Git's
   commands could change what's elsewhere, or run commands, so populating
   fails, telling what's wrong, unless the source's `reclone` is set.  Git
   runs no hooks.
@@ -708,9 +707,9 @@ automatically.
 
 Sources in a Git work tree are referred to as `git+file:` (with submodules if
 there are any), all other sources as `path:`, with symlinks resolved.  Nix
-runs Git in a `git+file:` flake, so that's only for work trees whose `.git`
-directory a `git` source would use, see
-[The target directory](#the-target-directory).  Lock
+runs Git in a `git+file:` flake, with its configuration and hooks, so
+that's only for work trees whose `.git` directory a `git` source would use,
+see [The target directory](#the-target-directory), and has no hooks.  Lock
 files get rewritten or generated on every run, so they match the sources.
 Copies of `flake` and `flake-input` sources get made again only if the
 delivered store path, the patches, or the sources they draw inputs from
diff --git a/pkgs/populate/default.nix b/pkgs/populate/default.nix
index 163f1de..80cbcd3 100644
--- a/pkgs/populate/default.nix
+++ b/pkgs/populate/default.nix
@@ -160,10 +160,10 @@ let
   # Shell code defining git_problems PATH, which prints why populate can't
   # use the .git directory of the Git work tree at PATH, or nothing.  A .git
   # directory that git clone and populate made has no symlinks, no commondir
-  # file, which names another repository, no linked work trees, no hooks,
-  # and only the configuration they write: the repository's format, the
-  # remote, branches, and submodules, whose repositories have their work
-  # tree in the work tree.  And each .git below the work tree, which Git
+  # file, which names another repository, no linked work trees, and only
+  # the configuration they write: the repository's format, the remote,
+  # branches, and submodules, whose repositories have their work tree in
+  # the work tree.  Hooks don't matter: populate's Git doesn't run them.  And each .git below the work tree, which Git
   # uses for a submodule there, is a file naming a repository in
   # .git/modules.
   gitProblems = let
@@ -195,13 +195,6 @@ let
         printf '%s has linked work trees' "$git_dir"
         exit
       fi
-      if test -d "$git_dir"/hooks; then
-        hooks=$(find "$git_dir"/hooks -mindepth 1 ! -name '*.sample' | head -n 3 | paste -s -d ' ' -)
-        if test -n "$hooks"; then
-          printf '%s contains hooks: %s' "$git_dir" "$hooks"
-          exit
-        fi
-      fi
       nested=$(
         find "$path" -path "$git_dir" -prune -o -name .git -exec sh -c '
           modules=$1
@@ -616,9 +609,9 @@ let
 
         ${gitProblems}
         # Prints the flake URL of the source named $1: git+file: if it has a
-        # .git directory git_problems finds nothing wrong with, else path:.
-        # Nix runs Git in a git+file: flake, with the repository's
-        # configuration and hooks.
+        # .git directory git_problems finds nothing wrong with, and that has
+        # no hooks, else path:.  Nix runs Git in a git+file: flake, with the
+        # repository's configuration and hooks.
         flake_url() {
           path=$(readlink -f ${quote target.path}/"$1")
           if ! test -d "$path"; then
@@ -627,7 +620,8 @@ let
           fi
           if ! test -L "$path"/.git && test -d "$path"/.git &&
               problems=$(git_problems "$path" 2>/dev/null) &&
-              test -z "$problems"; then
+              test -z "$problems" &&
+              test -z "$(find "$path"/.git/hooks -mindepth 1 ! -name '*.sample' 2>/dev/null | head -n 1)"; then
             if test -e "$path"/.gitmodules; then
               printf 'git+file:%s?submodules=1' "$(url_path "$path")"
             else