Re: [PATCH] State what commit to expect in request-pull

From: Shawn Pearce <spearce@spearce.org>
Date: Sep 6, 2011, 21:58 UTC
Message-ID: <CAJo=hJsHsVGm1xo4PP416Ek5M+3cc-VZ9LcDBhePNgahcjzB=A@mail.gmail.com>
In-Reply-To: <7vwrdl749z.fsf@alter.siamese.dyndns.org>

On Tue, Sep 6, 2011 at 14:24, Junio C Hamano <gitster@pobox.com> wrote:

> Interestingly, we did say what commit the requesters based their changes
> on, but did not give the person who performs a fetch & merge to make sure
> he fetched the right branch.

...

Show 7 quoted lines

> diff --git a/git-request-pull.sh b/git-request-pull.sh
> @@ -71,6 +71,7 @@ git show -s --format='The following changes since commit %H:
>
>  are available in the git repository at:' $baserev &&
>  echo "  $url $branch" &&
> +echo "for you to fetch changes up to $headrev"
>  echo &&

Better than what we had before. I was sort of hoping for changing the pull line slightly to include the SHA-1. E.g. suppose instead the line was:

  echo "  $url $headrev"

and git pull passed the $headrev down to git fetch, which then found any reference that points exactly at $headrev and fetches that. The branch name is now lost for the merge summary, but could be guessed from the advertisement similar to how HEAD is guessed. Git pull could also then validate that the commit its merging in FETCH_HEAD is what was passed on the command line.

Then verification of the SHA-1 is automatic by Git, and doesn't require a human. If the pull request was sent by GPG signed email, and the MUA checked the signature, the puller has pretty reasonable assurance over the content they are bringing into their repository.

-- 
Shawn.