{"thread":{"id":"28565","subject":"[PATCH] request-pull: List the hash that results from merging onto baserev","startedAt":"2011-10-04T01:47:06Z","lastAt":"2011-10-04T03:45:30Z","messageCount":3,"participants":["Chris Ball","Junio C Hamano"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"176801","messageId":"m28vp1msth.fsf@bob.laptop.org","threadId":"28565","inReplyTo":null,"subject":"[PATCH] request-pull: List the hash that results from merging onto baserev","fromName":"Chris Ball","fromEmail":"cjb@laptop.org","sentAt":"2011-10-04T01:47:06Z","receivedAt":"2011-10-04T01:47:06Z","isPatch":true,"sender":{"key":"cjb@laptop.org","avatar":null},"body":"This patch modifies the request-pull message to contain both the base\nhash and the top commit hash that results when the new commits are\nmerged onto that base.\n\nThe motivation for doing this is to turn cryptographically signing a\npull request into an operation that enables detection of commits having\nbeen maliciously altered before being downloaded.  Before this patch, a\npull request contained only a list of commit names and a diffstat; this\nis not sufficient to detect subsequent alteration of the changed files.\n\nAfter this patch, the person merging may choose to rewind to $baserev,\napply the received commits, and check that the resulting hash matches.\n\nSigned-off-by: Chris Ball <cjb@laptop.org>\n---\n git-request-pull.sh |    3 +++\n 1 files changed, 3 insertions(+), 0 deletions(-)\n\ndiff --git a/git-request-pull.sh b/git-request-pull.sh\nindex fc080cc..9a686a5 100755\n--- a/git-request-pull.sh\n+++ b/git-request-pull.sh\n@@ -73,6 +73,9 @@ are available in the git repository at:' $baserev &&\n echo \"  $url $branch\" &&\n echo &&\n \n+echo \"(Applying these commits produces hash $headrev)\" &&\n+echo &&\n+\n git shortlog ^$baserev $headrev &&\n git diff -M --stat --summary $patch $merge_base..$headrev || exit\n exit $status\n-- \nChris Ball   <cjb@laptop.org>   <http://printf.net/>\nOne Laptop Per Child\n"},{"id":"176802","messageId":"7vzkhhcufo.fsf@alter.siamese.dyndns.org","threadId":"28565","inReplyTo":"m28vp1msth.fsf@bob.laptop.org","subject":"Re: [PATCH] request-pull: List the hash that results from merging onto baserev","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2011-10-04T03:22:19Z","receivedAt":"2011-10-04T03:22:19Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Isn't the series leading to 7eb32b8 (request-pull: use the branch\ndescription, 2011-09-20) insufficient?\n"},{"id":"176803","messageId":"m2r52tl8rp.fsf@bob.laptop.org","threadId":"28565","inReplyTo":"7vzkhhcufo.fsf@alter.siamese.dyndns.org","subject":"Re: [PATCH] request-pull: List the hash that results from merging onto baserev","fromName":"Chris Ball","fromEmail":"cjb@laptop.org","sentAt":"2011-10-04T03:45:30Z","receivedAt":"2011-10-04T03:45:30Z","isPatch":true,"sender":{"key":"cjb@laptop.org","avatar":null},"body":"Hi Junio,\n\nOn Mon, Oct 03 2011, Junio C Hamano wrote:\n> Isn't the series leading to 7eb32b8 (request-pull: use the branch\n> description, 2011-09-20) insufficient?\n\nYes, your series is much better; sorry for the noise.  I didn't know\nabout the work in 'pu', but see now that I should have looked there.\n\nThanks,\n\n- Chris.\n-- \nChris Ball   <cjb@laptop.org>   <http://printf.net/>\nOne Laptop Per Child\n"}]}