threads / discuss / 19803

Repository authenticity question

Subject: Repository authenticity question

## tl;dr

4 messages between Jun 13, 2009 and Jun 17, 2009.

replies: 3people: 2as markdown or json

Kārlis Repsons· Jun 13, 2009, 15:26 UTC · lore

Hi, It would be good to know what did Linus meant, when he said "and they will fail" about people, who would try changing some git projects' history (that is, the content, that is added already)? If I loose my repository completely, can I still know, that those contributions there are the same after I pull and how? What contents can be deleted, while still retaining consistency?

Regards, Kārlis

Michael J Gruber· Jun 13, 2009, 15:45 UTC · re: Kārlis Repsons · lore

Re: Repository authenticity question

Kārlis Repsons venit, vidit, dixit 13.06.2009 17:26:

Show 9 quoted lines

> Hi,
> It would be good to know what did Linus meant, when he said "and they will 
> fail" about people, who would try changing some git projects' history (that 
> is, the content, that is added already)? If I loose my repository completely, 
> can I still know, that those contributions there are the same after I pull 
> and how? What contents can be deleted, while still retaining consistency?
> 
> Regards,
> Kārlis

The sha1 ("object name") of a commit depends not only on its contents, but on all its predecessors. So if you know one commit's sha1 to be "original" you know for all its ancestors.

Michael

Kārlis Repsons· Jun 17, 2009, 07:57 UTC · re: Michael J Gruber · lore

Re: Repository authenticity question

On Saturday 13 June 2009 15:45:04 you wrote:

Show 17 quoted lines

> Kārlis Repsons venit, vidit, dixit 13.06.2009 17:26:
> > Hi,
> > It would be good to know what did Linus meant, when he said "and they
> > will fail" about people, who would try changing some git projects'
> > history (that is, the content, that is added already)? If I loose my
> > repository completely, can I still know, that those contributions there
> > are the same after I pull and how? What contents can be deleted, while
> > still retaining consistency?
> >
> > Regards,
> > Kārlis
>
> The sha1 ("object name") of a commit depends not only on its contents,
> but on all its predecessors. So if you know one commit's sha1 to be
> "original" you know for all its ancestors.
>
> Michael

So, if I clone someone else's git archive, sha1 of a known commit must be compared and what else? How to check if all of archive's sha1-s are identical to its contents and every content is included?

Michael J Gruber· Jun 17, 2009, 08:07 UTC · re: Kārlis Repsons · lore

Re: Repository authenticity question

Kārlis Repsons venit, vidit, dixit 17.06.2009 09:57:

Show 22 quoted lines

> On Saturday 13 June 2009 15:45:04 you wrote:
>> Kārlis Repsons venit, vidit, dixit 13.06.2009 17:26:
>>> Hi,
>>> It would be good to know what did Linus meant, when he said "and they
>>> will fail" about people, who would try changing some git projects'
>>> history (that is, the content, that is added already)? If I loose my
>>> repository completely, can I still know, that those contributions there
>>> are the same after I pull and how? What contents can be deleted, while
>>> still retaining consistency?
>>>
>>> Regards,
>>> Kārlis
>>
>> The sha1 ("object name") of a commit depends not only on its contents,
>> but on all its predecessors. So if you know one commit's sha1 to be
>> "original" you know for all its ancestors.
>>
>> Michael
> 
> So, if I clone someone else's git archive, sha1 of a known commit must be 
> compared and what else? How to check if all of archive's sha1-s are identical 
> to its contents and every content is included?

As I said: if the sha1 of one commit agrees with what what you have or know then, automatically, all ancestry is "original": commits as well as contents.

You can check the repo itself using "git fsck", this makes sure that all referenced content is included.

Michael