Repository authenticity question

Repository authenticity question

[Kārlis Repsons]

[-- Attachment #1: Type: text/plain, Size: 413 bytes --]

Hi,
It would be good to know what did Linus meant, when he said "and they will 
fail" about people, who would try changing some git projects' history (that 
is, the content, that is added already)? If I loose my repository completely, 
can I still know, that those contributions there are the same after I pull 
and how? What contents can be deleted, while still retaining consistency?

Regards,
Kārlis

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: Repository authenticity question

[Michael J Gruber]

Kārlis Repsons venit, vidit, dixit 13.06.2009 17:26:
> Hi,
> It would be good to know what did Linus meant, when he said "and they will 
> fail" about people, who would try changing some git projects' history (that 
> is, the content, that is added already)? If I loose my repository completely, 
> can I still know, that those contributions there are the same after I pull 
> and how? What contents can be deleted, while still retaining consistency?
> 
> Regards,
> Kārlis

The sha1 ("object name") of a commit depends not only on its contents,
but on all its predecessors. So if you know one commit's sha1 to be
"original" you know for all its ancestors.

Michael

Re: Repository authenticity question

[Kārlis Repsons]

[-- Attachment #1: Type: text/plain, Size: 966 bytes --]

On Saturday 13 June 2009 15:45:04 you wrote:
> Kārlis Repsons venit, vidit, dixit 13.06.2009 17:26:
> > Hi,
> > It would be good to know what did Linus meant, when he said "and they
> > will fail" about people, who would try changing some git projects'
> > history (that is, the content, that is added already)? If I loose my
> > repository completely, can I still know, that those contributions there
> > are the same after I pull and how? What contents can be deleted, while
> > still retaining consistency?
> >
> > Regards,
> > Kārlis
>
> The sha1 ("object name") of a commit depends not only on its contents,
> but on all its predecessors. So if you know one commit's sha1 to be
> "original" you know for all its ancestors.
>
> Michael

So, if I clone someone else's git archive, sha1 of a known commit must be 
compared and what else? How to check if all of archive's sha1-s are identical 
to its contents and every content is included?

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: Repository authenticity question

[Michael J Gruber]

Kārlis Repsons venit, vidit, dixit 17.06.2009 09:57:
> On Saturday 13 June 2009 15:45:04 you wrote:
>> Kārlis Repsons venit, vidit, dixit 13.06.2009 17:26:
>>> Hi,
>>> It would be good to know what did Linus meant, when he said "and they
>>> will fail" about people, who would try changing some git projects'
>>> history (that is, the content, that is added already)? If I loose my
>>> repository completely, can I still know, that those contributions there
>>> are the same after I pull and how? What contents can be deleted, while
>>> still retaining consistency?
>>>
>>> Regards,
>>> Kārlis
>>
>> The sha1 ("object name") of a commit depends not only on its contents,
>> but on all its predecessors. So if you know one commit's sha1 to be
>> "original" you know for all its ancestors.
>>
>> Michael
> 
> So, if I clone someone else's git archive, sha1 of a known commit must be 
> compared and what else? How to check if all of archive's sha1-s are identical 
> to its contents and every content is included?

As I said: if the sha1 of one commit agrees with what what you have or
know then, automatically, all ancestry is "original": commits as well as
contents.

You can check the repo itself using "git fsck", this makes sure that all
referenced content is included.

Michael