Re: Repository authenticity question

From: Michael J Gruber <git@drmicha.warpmail.net>
Date: Jun 17, 2009, 08:07 UTC
Message-ID: <4A38A45C.6080708@drmicha.warpmail.net>
In-Reply-To: <200906170757.59476.Karlis.Repsons@gmail.com>

Kārlis Repsons venit, vidit, dixit 17.06.2009 09:57:

Show 22 quoted lines

> On Saturday 13 June 2009 15:45:04 you wrote:
>> Kārlis Repsons venit, vidit, dixit 13.06.2009 17:26:
>>> Hi,
>>> It would be good to know what did Linus meant, when he said "and they
>>> will fail" about people, who would try changing some git projects'
>>> history (that is, the content, that is added already)? If I loose my
>>> repository completely, can I still know, that those contributions there
>>> are the same after I pull and how? What contents can be deleted, while
>>> still retaining consistency?
>>>
>>> Regards,
>>> Kārlis
>>
>> The sha1 ("object name") of a commit depends not only on its contents,
>> but on all its predecessors. So if you know one commit's sha1 to be
>> "original" you know for all its ancestors.
>>
>> Michael
> 
> So, if I clone someone else's git archive, sha1 of a known commit must be 
> compared and what else? How to check if all of archive's sha1-s are identical 
> to its contents and every content is included?

As I said: if the sha1 of one commit agrees with what what you have or know then, automatically, all ancestry is "original": commits as well as contents.

You can check the repo itself using "git fsck", this makes sure that all referenced content is included.

Michael