git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Validation of a commit object?

From
Shawn Pearce <spearce@spearce.org>
Date
Aug 14, 2006, 06:28 UTC
Message-ID
<20060814062830.GF18667@spearce.org>

In looking at fsck-objects.c the only thing it tries to validate about a commit is:

 - the commit has a tree ("tree NNNNNN\n");
 - the commit maybe has parent(s) ("parent NNNNN\n");
 - the commit has "author ".
That's it.

Its OK for an author line to be completely corrupt and have no timestamp, no name, no timezone. Or to have a timestamp such as "bobthetalkingdog".

Its OK for a committer line to just plain not exist or to be equally corrupt.

I'm thinking that can't be right. Shouldn't fsck-objects be doing better checking on commits?

The reason I ask is I'm working on my (bastard) fast-import program for Jon's Mozilla CVS -> GIT conversion effort and I'm taking the author and committer lines blind from the Python code. If the Python code gives me a bad line its going to go into the pack that way, with that possibly resulting in a totally corrupt repository. I hoped to apply the same verification that fsck-objects applies but apparently it doesn't do anything. :-)

I'm willing to write some better validation in fsck-objects.c and submit the patch if folks think we should do stronger checks in there.

-- 
Shawn.
Next: Alex Riesen
Message 1 of 3 in “Validation of a commit object?”
  1. Shawn PearceAug 14, 2006
  2. Alex RiesenAug 14, 2006
  3. Junio C HamanoAug 14, 2006

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.