{"thread":{"id":"37643","subject":"Code changes in merge commits","startedAt":"2014-09-29T09:32:27Z","lastAt":"2014-09-29T12:29:59Z","messageCount":5,"participants":["John Tapsell","Matthieu Moy","Duy Nguyen"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"249985","messageId":"CAHQ6N+p1GqQfTs0H-4ij_QfkWQGfTUbWBzMC4E7LCEynPT78kA@mail.gmail.com","threadId":"37643","inReplyTo":null,"subject":"Code changes in merge commits","fromName":"John Tapsell","fromEmail":"johnflux@gmail.com","sentAt":"2014-09-29T09:32:27Z","receivedAt":"2014-09-29T09:32:27Z","isPatch":false,"sender":{"key":"johnflux@gmail.com","avatar":"https://gravatar.com/avatar/25f70d4c0f96396b84a2e34bcd9bdc233462c7b4be29b5fdca8266fc53f30b0c?d=mp&s=160"},"body":"Hi,\n\n  Our team just struggled with this problem, and I've created a\nsimple, 3 commit large, example git repository to demonstrate the\nproblem:\n\nhttps://github.com/johnflux/ExampleEvilness2\n\nThe code:   Adds a file, adds a security fix commit, then removes the\nfix during a merge.\n\nThis happened by accident in our code during a merge, but nobody\nnoticed, and it was not easy to track down.\n\nIn this example, you can see that the security fix was removed by doing:\n\n$ git log -m -p\n\nHowever the following do NOT show that the security fix was removed:\n\n$ git log -m -p .\n$ git log -m -p tmp.c\n$ git log -c -p tmp.c\n\nAnd so on. In a large code base, this a problem.\n\nJohn\n"},{"id":"249986","messageId":"CAHQ6N+rJDtq_vtfotM+GXLdN_P==oTqGbFZ97ZQea9+mcoRBog@mail.gmail.com","threadId":"37643","inReplyTo":"CAHQ6N+p1GqQfTs0H-4ij_QfkWQGfTUbWBzMC4E7LCEynPT78kA@mail.gmail.com","subject":"Re: Code changes in merge commits","fromName":"John Tapsell","fromEmail":"johnflux@gmail.com","sentAt":"2014-09-29T10:01:30Z","receivedAt":"2014-09-29T10:01:30Z","isPatch":false,"sender":{"key":"johnflux@gmail.com","avatar":"https://gravatar.com/avatar/25f70d4c0f96396b84a2e34bcd9bdc233462c7b4be29b5fdca8266fc53f30b0c?d=mp&s=160"},"body":"Rereading what I wrote, I came across as unintentionally harsh and\nrude.  Sorry about that - I was trying to be concise and terse, and it\nwent a bit wrong :)\n\n\nWhat I was thinking to improve this is two short-term fixes:\n\n1. Can we get   git log -m -p .     in the top level directory to show\nthe same commits as just git log -m -p ?\n2. Can we get   git log -m -p somefile           to show all the\nchanges to that file?  Including when lines are added and then removed\nby the merge somehow?\n\nBut in the longer term, I was thinking about how this could be improved...\n\nWhat if merge commits were forced into being always trivial?   i.e.\nprevent merges with conflicts or code changes?\nThen conflict resolution and code changes are pushed into a second\n\"ordinary\" commit.  That way you can always see what changes have been\nmade to the code.\n\nE.g.  If you have branch \"master\"  and branch \"A\", and there are\nconflicts when you merge, you could end up with:\n\nmerge commit\n   |                  \\\n   |                  preparation changes to fix conflicts with oldmaster\noldmaster           |\n                          A\n\n\nI know this isn't great, but maybe something along these lines?\nIdeally I'd like to see all the code changes to a code base just with\n\"git log -p\".\n\nAny thoughts?\n\nThanks,\n\nJohn Tapsell\n"},{"id":"249988","messageId":"vpq8ul2pu9n.fsf@anie.imag.fr","threadId":"37643","inReplyTo":"CAHQ6N+rJDtq_vtfotM+GXLdN_P==oTqGbFZ97ZQea9+mcoRBog@mail.gmail.com","subject":"Re: Code changes in merge commits","fromName":"Matthieu Moy","fromEmail":"matthieu.moy@grenoble-inp.fr","sentAt":"2014-09-29T10:59:16Z","receivedAt":"2014-09-29T10:59:16Z","isPatch":false,"sender":{"key":"matthieu.moy@grenoble-inp.fr","avatar":"https://gravatar.com/avatar/72c8a2705971a25dfaff23cece15130d405685845d911aedd5667ace277f3fc5?d=mp&s=160"},"body":"John Tapsell <johnflux@gmail.com> writes:\n\n> What if merge commits were forced into being always trivial?\n\nIt would be relatively easy to \"force\" a client to always have trivial\nmerges, but much harder to prevent an attacker to forge a non-trivial\nmerge commit (e.g. modifying his local git command) and push it.\n\n> Ideally I'd like to see all the code changes to a code base just with\n> \"git log -p\".\n\nWhat I'd love to see with \"git log -p\" is the diff between a trivial\nmerge (possibly including conflict markers) and the actual merge commit.\nThat would imply that \"git log\" would redo the merge before computing\nthe diff (rather heavyweight :-( ), but an empty diff would mean \"no\nchange other than merge\", and if any, we would see the conflict\nresolution or additional changes in the diff.\n\n-- \nMatthieu Moy\nhttp://www-verimag.imag.fr/~moy/\n"},{"id":"249989","messageId":"CAHQ6N+qGTubVB7F8LzfX=bODn6jdYtV9fz=RJ2fzS2aqhe5-uw@mail.gmail.com","threadId":"37643","inReplyTo":"vpq8ul2pu9n.fsf@anie.imag.fr","subject":"Re: Code changes in merge commits","fromName":"John Tapsell","fromEmail":"johnflux@gmail.com","sentAt":"2014-09-29T11:02:50Z","receivedAt":"2014-09-29T11:02:50Z","isPatch":false,"sender":{"key":"johnflux@gmail.com","avatar":"https://gravatar.com/avatar/25f70d4c0f96396b84a2e34bcd9bdc233462c7b4be29b5fdca8266fc53f30b0c?d=mp&s=160"},"body":"> What I'd love to see with \"git log -p\" is the diff between a trivial\n> merge (possibly including conflict markers) and the actual merge commit.\n> That would imply that \"git log\" would redo the merge before computing\n> the diff (rather heavyweight :-( ), but an empty diff would mean \"no\n> change other than merge\", and if any, we would see the conflict\n> resolution or additional changes in the diff.\n\nThis would be wonderful.  And I'd rather have git do the heavyweight\nwork than doing it myself :-/\n\nI don't know the git internals at all - would it be possible to \"save\"\nthe results of the diff?  This is what I was aiming for in my idea of\nmaking the merge and conflict-resolution as separate commits.\n\n> --\n> Matthieu Moy\n> http://www-verimag.imag.fr/~moy/\n"},{"id":"249991","messageId":"CACsJy8BFKrgssx+787KOspPRZ7wQfT_187VsgeztOUOXaSEx_Q@mail.gmail.com","threadId":"37643","inReplyTo":"vpq8ul2pu9n.fsf@anie.imag.fr","subject":"Re: Code changes in merge commits","fromName":"Duy Nguyen","fromEmail":"pclouds@gmail.com","sentAt":"2014-09-29T12:29:59Z","receivedAt":"2014-09-29T12:29:59Z","isPatch":false,"sender":{"key":"pclouds@gmail.com","avatar":"https://avatars.githubusercontent.com/u/720?v=4"},"body":"On Mon, Sep 29, 2014 at 5:59 PM, Matthieu Moy\n<Matthieu.Moy@grenoble-inp.fr> wrote:\n>> Ideally I'd like to see all the code changes to a code base just with\n>> \"git log -p\".\n>\n> What I'd love to see with \"git log -p\" is the diff between a trivial\n> merge (possibly including conflict markers) and the actual merge commit.\n> That would imply that \"git log\" would redo the merge before computing\n> the diff (rather heavyweight :-( ), but an empty diff would mean \"no\n> change other than merge\", and if any, we would see the conflict\n> resolution or additional changes in the diff.\n\nTopic tr/remerge-diff in 'pu'? I think --remerge-diff works with\ngit-log, but I'm not sure.\n-- \nDuy\n"}]}