Re: About git and the use of SHA-1

From: Nicolas Pitre <nico@cam.org>
Date: Apr 29, 2008, 15:42 UTC
Message-ID: <alpine.LFD.1.10.0804291132060.23581@xanadu.home>
In-Reply-To: <481733A3.4010802@op5.se>

On Tue, 29 Apr 2008, Andreas Ericsson wrote:

Show 5 quoted lines

> But they won't, because it's impossible to add two objects with the same
> SHA1 hash key to a git repository, since it will lazily re-use the
> existing one. In practice, this means that in the case of an "innocent"
> hash-collision, git will actually break by refusing to store the new
> content.

I'd also like to point out that Git usually receive "untrusted" new objects via the Git protocol through 'git index-pack'. If you look at sha1_object() in index-pack.c, you'll see that active verification against hash collision is performed, and the fetch will abruptly be aborted if ever that happens.

Yes, writing a test case for this was tricky.  :-)

Nicolas