From: "brian m. carlson" <sandals@crustytoothpaste.net>
To: <git@vger.kernel.org>
Cc: Junio C Hamano <gitster@pobox.com>,
Elijah Newren <newren@gmail.com>, Jeff King <peff@peff.net>,
Phillip Wood <phillip.wood123@gmail.com>
Subject: [PATCH v2 0/7] Git 3.0: restrict hex object IDs to lowercase only
Date: Mon, 7 Sep 2026 19:59:33 +0000 [thread overview]
Message-ID: <20260907195941.1024289-1-sandals@crustytoothpaste.net> (raw)
In-Reply-To: <20260729233215.398654-1-sandals@crustytoothpaste.net>
As far as I can tell, Git has always emitted hex object IDs in
lowercase, but our object ID parser accepts both uppercase and
lowercase. This leads to much software relying on hex object IDs being
broken because it doesn't handle uppercase object IDs and this can even
lead to security problems when people assume that an object ID has a
unique hex form.
This series removes the ability to use uppercase hex in
object IDs in Git 3.0.
Changes from v1:
* Fix incorrect hex range in comment.
* Update commit messages.
* Move t5324 fixes to a separate commit and expand commit message.
* Restore lowercasing in parse_oid_prefix.
* Possibly other miscellaneous changes which I have forgotten.
brian m. carlson (7):
hex: add functionality for lowercase-only hex
hex: allow specifying hex type with hex2chr
hex: make hex_to_bytes accept kind of hex to use
hex: label usages of hex parsing for object IDs
object-name: use hexval
t5324: adjust tests for corrupt commit-graph
hex: allow only lowercase object IDs in breaking changes mode
Documentation/BreakingChanges.adoc | 5 ++++
builtin/index-pack.c | 2 +-
color.c | 2 +-
diagnose.c | 2 +-
hex-ll.c | 39 ++++++++++++++++++++++++++++--
hex-ll.h | 24 +++++++++++++-----
hex.c | 2 +-
http-push.c | 5 ++--
mailinfo.c | 2 +-
notes.c | 5 ++--
object-file.c | 2 +-
object-name.c | 15 +++---------
pkt-line.c | 8 +++---
ref-filter.c | 2 +-
strbuf.c | 2 +-
t/t1503-rev-parse-verify.sh | 5 ++++
t/t5324-split-commit-graph.sh | 4 +--
url.c | 2 +-
urlmatch.c | 2 +-
19 files changed, 91 insertions(+), 39 deletions(-)
next prev parent reply other threads:[~2026-09-07 19:59 UTC|newest]
Thread overview: 41+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-29 23:32 [RFC PATCH 0/6] Git 3.0: restrict hex object IDs to lowercase only brian m. carlson
2026-07-29 23:32 ` [RFC PATCH 1/6] hex: add functionality for lowercase-only hex brian m. carlson
2026-07-31 7:38 ` Junio C Hamano
2026-08-25 15:39 ` Junio C Hamano
2026-08-25 21:44 ` brian m. carlson
2026-07-29 23:32 ` [RFC PATCH 2/6] hex: allow specifying hex type with hex2chr brian m. carlson
2026-07-29 23:32 ` [RFC PATCH 3/6] hex: make hex_to_bytes accept kind of hex to use brian m. carlson
2026-07-31 7:38 ` Junio C Hamano
2026-08-01 14:35 ` Jeff King
2026-07-29 23:32 ` [RFC PATCH 4/6] hex: label usages of hex parsing for object IDs brian m. carlson
2026-07-31 3:24 ` Junio C Hamano
2026-08-25 16:11 ` Junio C Hamano
2026-07-29 23:32 ` [RFC PATCH 5/6] object-name: use hexval brian m. carlson
2026-08-25 16:19 ` Junio C Hamano
2026-08-25 19:44 ` Elijah Newren
2026-08-25 21:41 ` brian m. carlson
2026-07-29 23:32 ` [RFC PATCH 6/6] hex: allow only lowercase object IDs in breaking changes mode brian m. carlson
2026-07-31 7:48 ` Junio C Hamano
2026-07-31 12:33 ` Junio C Hamano
2026-08-02 22:09 ` brian m. carlson
2026-08-04 19:32 ` Junio C Hamano
2026-08-04 21:46 ` brian m. carlson
2026-08-05 3:09 ` Michael Montalbo
2026-08-25 9:04 ` Phillip Wood
2026-08-25 21:36 ` brian m. carlson
2026-09-07 13:37 ` Phillip Wood
2026-08-25 16:36 ` Junio C Hamano
2026-08-25 19:44 ` Elijah Newren
2026-07-30 8:21 ` [RFC PATCH 0/6] Git 3.0: restrict hex object IDs to lowercase only Junio C Hamano
2026-07-30 21:18 ` brian m. carlson
2026-08-01 14:45 ` Jeff King
2026-08-01 18:22 ` Junio C Hamano
2026-08-02 21:55 ` brian m. carlson
2026-09-07 19:59 ` brian m. carlson [this message]
2026-09-07 19:59 ` [PATCH v2 1/7] hex: add functionality for lowercase-only hex brian m. carlson
2026-09-07 19:59 ` [PATCH v2 2/7] hex: allow specifying hex type with hex2chr brian m. carlson
2026-09-07 19:59 ` [PATCH v2 3/7] hex: make hex_to_bytes accept kind of hex to use brian m. carlson
2026-09-07 19:59 ` [PATCH v2 4/7] hex: label usages of hex parsing for object IDs brian m. carlson
2026-09-07 19:59 ` [PATCH v2 5/7] object-name: use hexval brian m. carlson
2026-09-07 19:59 ` [PATCH v2 6/7] t5324: adjust tests for corrupt commit-graph brian m. carlson
2026-09-07 19:59 ` [PATCH v2 7/7] hex: allow only lowercase object IDs in breaking changes mode brian m. carlson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260907195941.1024289-1-sandals@crustytoothpaste.net \
--to=sandals@crustytoothpaste.net \
--cc=git@vger.kernel.org \
--cc=gitster@pobox.com \
--cc=newren@gmail.com \
--cc=peff@peff.net \
--cc=phillip.wood123@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox