Re: git-daemon on NSLU2
- From
Junio C Hamano <gitster@pobox.com>
- Date
- Aug 26, 2007, 21:22 UTC
- Message-ID
- <7vtzqmng8r.fsf@gitster.siamese.dyndns.org>
- In-Reply-To
- <alpine.LFD.0.999.0708261318140.25853@woody.linux-foundation.org>
Linus Torvalds <torvalds@linux-foundation.org> writes:
Show 9 quoted lines
>> I'm not buying the security argument. If you want something kept hidden >> get it out of the public db. If I know the sha of the hidden object >> can't I just add a head for it and git-deamon will happily send it and >> the chain up to it to me? > > That's a particularly idiotic statement. > > If you know the SHA1, there can *by*definition* not be any hidden objects. > The SHA1 depends on the object chain.
I think what we have is even stronger --- upload-pack does not allow asking for an arbitrary commit. The requesting fetch-pack side needs to pick from what are offerred, and upload-pack makes sure of that.