Re: weaning distributions off tarballs: extended verification of git tags

From: Colin Walters <walters@verbum.org>
Date: Jul 8, 2015, 04:00 UTC
Message-ID: <1436328049.1937003.317969577.6CBA24A0@webmail.messagingengine.com>
In-Reply-To: <1425134885.3150003.233627665.2E48E28B@webmail.messagingengine.com>

On Sat, Feb 28, 2015, at 10:48 AM, Colin Walters wrote:

> Hi, 
> 
> TL;DR: Let's define a standard for embedding stronger checksums in tags and commit messages:
> https://github.com/cgwalters/homegit/blob/master/bin/git-evtag

[time passes]

I finally had a bit of time to pick this back up again in:

https://github.com/cgwalters/git-evtag

It should address the core concern here about stability of `git archive`.

I prototyped it out with libgit2 because it was easier, and I'd like actually to be able to use this with older versions of git.

But I think the next steps here are:

- Validate the core design
  * Tree walking order
  * Submodule recursion
  * Use of SHA512
- Standardize it
  (Would like to see at least a stupid slow shell script implementation to cross-validate)
- Add it as an option to `git tag`?

Longer term:
- Support adding `Git-EVTag` as a git note, so I can retroactively add stronger
  checksums to older git repositories
- Anything else?