From: Shawn Pearce <spearce@spearce.org>
Date: Tue, 16 Oct 2012 02:09:52 GMT
Subject: Re: push race
Message-ID: <CAJo=hJu=eqgUhJvvpMLJ05AT6o+nVUDcm+tHV8en8OCX2-2qgA@mail.gmail.com>
In-Reply-To: <20121015185608.GC31658@sigill.intra.peff.net>

On Mon, Oct 15, 2012 at 11:56 AM, Jeff King <peff@peff.net> wrote:
> Right. The only thing that needs locking is the refs, because the object
> database is add-only for normal operations, and by definition collisions
> mean you have the same content (or are astronomically unlucky, but your
> consolation prize is that you can write a paper on how you found a sha1
> collision).

Its worth nothing that a SHA-1 collision can be identified at the
server because the server performs a byte-for-byte compare of both
copies of the object to make sure they match exactly in every way. Its
not fast, but its safe. :-)