Re: how to (integrity) verify a whole git repo

From: Jonathan Nieder <jrnieder@gmail.com>
Date: Apr 21, 2020, 06:53 UTC
Message-ID: <20200421065301.GH96152@google.com>
In-Reply-To: <acb9a2da98bce7ea3044cbf37c92163497f7e9e2.camel@scientia.net>

Hi Christoph,

Christoph Anton Mitterer wrote:

> How to cryptographically verify the integrity of a whole git repo (i.e.
> all it's commits/blobs/etc. in the history?

This happens automatically as part of fetch. When you fetch, the objects' content is transfered over the wire but not their names. The name of each object is a hash of its content. Thus, whenever you address an object by its name, you are using its verified identity.

Show 7 quoted lines

> Assume e.g. I have the kernel sources and want to do some bisection.
> One has also retrieved Linus' and GregKH's key via some trusted path
> and assumes that SHA1 is more or less still safe enough ;-)
>
> 1) Of course there is git verify-tag and verify-commit which are signed
> with the GPPG, but these alone check, AFAIU, only the respective
> tag/commit.

Tag and commit object content include the object ids for the objects they reference, so (assuming we are using a strong hash) their name is enough to verify all content reachable from them.

In other words, it's a Merkle tree.

> How to check everything else? Is it enough to git fsck --full?

fsck is helpful for checking that objects are valid --- that they don't reference any objects you don't have, that their format is correct, and so on. So it's good to run (or you can use the transfer.fsckObjects setting to run fsck as part of the clone or fetch operation).

Thanks and hope that helps, Jonathan