git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Verifiable git archives?

From
Junio C Hamano <gitster@pobox.com>
Date
Jan 9, 2014, 22:46 UTC
Message-ID
<xmqq38kwai3v.fsf@gitster.dls.corp.google.com>
In-Reply-To
<CALCETrXTbvHQAWm2z13OwyHCmBZZNDSqyWCdiu6maHRp2mi-Pw@mail.gmail.com>
Andy Lutomirski <luto@amacapital.net> writes:
Show 7 quoted lines
>> You only need the object name of the top-level tree.  After "untar"
>> the archive into an empty directory, make it a new repository and
>> "git add . && git write-tree"---the result should match the
>> top-level tree the archive was supposed to contain.
>
> Hmm.  I didn't realize that there was enough metadata in the 'git
> archive' output to reproduce the final tree.

We do record the commit object name in the extended header when writing a tar archive already, but you have to grab the commit object from somewhere in order to read the top-level tree object name, which we do not record.

Also, if you used keyword substitution and such when creating an archive, then the filesystem entities resulting from expanding it would not match the original.

Previous: Andy LutomirskiNext: Andy Lutomirski
Message 5 of 9 in “Verifiable git archives?”
  1. Andy LutomirskiJan 9, 2014
  2. Stefan BellerJan 9, 2014
  3. Junio C HamanoJan 9, 2014
  4. Andy LutomirskiJan 9, 2014
  5. Junio C HamanoJan 9, 2014
  6. Andy LutomirskiJan 9, 2014
  7. Michael HaggertyJan 19, 2014
  8. Junio C HamanoJan 21, 2014
  9. Andy LutomirskiJan 25, 2014

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.