Re: Feature Proposal: Adding Command for Configuration Diff Between Commits

[Taylor Blau <me@ttaylorr.com>]

On Tue, Oct 15, 2024 at 04:29:44PM +0530, Prince Roshan wrote:
> Hi Git Community,
>
> I wanted to propose a new feature for Git that I believe would be
> beneficial for repository maintainers and developers alike. What do
> you think of adding a command like git config diff commit1 commit2 to
> show the configuration differences between two commits?
>
> This command could display differences in repository configurations
> (such as .git/config or submodule configuration) across two specific
> commits. I see this being particularly useful in scenarios like:

Submodule configuration is already diff-able since the state of
submodules is stored in .gitmodules (as you note in your reply to this
email further down in this thread).

But just computing the diff between two commits and focusing on the
.gitmodules file alone doesn't necessarily have all of the information
you're looking for, either. For example, Git's own .gitmodules file has
the following contents:

    $ cat .gitmodules
    [submodule "sha1collisiondetection"]
      path = sha1collisiondetection
      url = https://github.com/cr-marcstevens/sha1collisiondetection.git
      branch = master

Here we're using submodule.<url>.branch to specify the branch that we
want to check out. So it's impossible to reconstruct the exact SHA-1 we
checked out, since it depends on the state of the remote repository as
well as our own .gitmodules file.

On the configuration front, there isn't really a perfect answer either,
because Git configuration is not tracked within the repository. You
could consider a workflow where you store the configuration within the
repository and then automatically "install" that configuration when
updating the working copy.

But that is not without risk, since Git executes arbitrary code based on
certain configuration options (e.g., more esoteric options like
core.sshCommand and core.alternateRefsCommand, as well as more common
ones like core.editor). So you would have to be careful about when you
install arbitrary configuration, who it is coming from, whether you
trust that person, etc.

Thanks,
Taylor