Re: SHA256 support not experimental, or?

From: Adam Majer <adamm@zombino.com>
Date: Jun 30, 2023, 11:25 UTC
Message-ID: <5880fe56-aa98-64ce-4d91-ca078d3a7354@zombino.com>
In-Reply-To: <vt3cizczmwbcpgktwrkr3jbiwhee37rt7m243hnkzxik7gt4m2@d2upsqoxtlgc>

On 6/30/23 11:31, Patrick Steinhardt wrote:

Show 5 quoted lines

> Indeed, supporting SHA256 is a major effort on our side at GitLab. Most
> of the work isn't really adapting our production code, but it's rather
> that tons of tests were written with seed repositories and hardcoded
> object hashes. Converting all of that isn't all that hard in the general
> case, but it's a tedious job.

Hi!

This actually reminds me of a funny story from my side.

Earlier this year, I was testing various frontends and how they would handle SHA256 repositories. All of them failed, not surprising. I even managed to lock myself out of Gitlab by importing a SHA256 private repo into my home project -- every time this project became visible, it would result in Error 500 from the UI. Today (few weeks ago), this appears to be fixed -- the UI is just broken, so you can't see anything in sha256 repository, but at least I was able to delete the project.

The repository was correctly imported and I could clone from gitlab, so the problem is mostly "just" UI. :-)

The most likely frontend we'll use for our internal project is Gitea. The sha256 support is in progress

https://github.com/go-gitea/gitea/pull/23894

 From the size of this patch, you can see how ingrained SHA1 assumption 
was. Most of the patch is just to remove the hardcoded elements, 
including hardcoded SHA1 empty-tree hashes and assumption that 20 bytes 
is enough to hold a hash. And I didn't even add sha256 test cases...

But I have to say that in at least one occasion, people are bringing up the experimental nature of git's sha256 support (per current wording) as reason not to make their tools sha256 compliant.

Show 5 quoted lines

> In any case I'm fully supportive of relaxing the current warning. Except
> for the recently discussed edge case where cloning empty repositories
> didn't create a SHA256 repository I have found the SHA256 code to be
> stable and working as advertised. We should caution people that many
> services will not work with SHA256 yet though.

That is exactly true. But this is also chicken-egg problem. Services are not adapted for sha256 repositories because there is simply no demand for them. Only when people will start using sha256 repos, will there be some demand generated.

- Adam