‹ BackHN Continuity

Thread

Git 3.0's upcoming SHA-256 default will be a costly mistake

570 points · 536 comments · chmaynard

  1. purpleidea · · focus · HN ↗
    This means, if you migrate your repo, every single commit message that contains text like: "please see commit <sha1>" will now be broken.

    This will be a train wreck. I hope they don't release before adding compatibility modes to keep the existing sha1's around in the database.

    1. oasisaimlessly · · focus · HN ↗
      Tools like git-filter-repo[1] support rewriting commit hashes in commit messages. git-filter-repo actually does it by default; see `--preserve-commit-hashes` in the manual[2].

      [1]: <a href="https:&#x2F;&#x2F;github.com&#x2F;newren&#x2F;git-filter-repo" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;newren&#x2F;git-filter-repo

      [2]: <a href="https:&#x2F;&#x2F;htmlpreview.github.io&#x2F;?https:&#x2F;&#x2F;github.com&#x2F;newren&#x2F;git-filter-repo&#x2F;blob&#x2F;docs&#x2F;html&#x2F;git-filter-repo.html" rel="nofollow">https:&#x2F;&#x2F;htmlpreview.github.io&#x2F;?https:&#x2F;&#x2F;github.com&#x2F;newren&#x2F;git...

      1. donatj · · focus · HN ↗
        Sure, but that&#x27;s not going to rewrite Slack messages, emails, GitHub links, docs
        1. diegocg · · focus · HN ↗
          ... do not migrate old repos? I&#x27;m not sure why people would do that. Or, if they do, why would they replace the current repo name instead of creating a different one and keeping the old one closed to make the references work.

          I don&#x27;t think this is going to be a problem at all.

          1. beart · · focus · HN ↗
            Hmm. If this is a security issue that matters, would you not be expected to migrate?

            Not talking about archived code, but active projects that pre-date git 3.0

            1. cylemons · · focus · HN ↗
              His point is keep an archived sha1 version of the repo and an active sha256 version.

              That way an old commit with a message having a sha1 can reference the archived version, and new commits reference the active version.

          2. krupan · · focus · HN ↗
            If we don&#x27;t need to migrate repos to sha256 them why do we need to change git to use sha256?
            1. samus · · focus · HN ↗
              You keep the old repo for archival purposes and work with the new one.
          3. hinkley · · focus · HN ↗
            Some companies survive longer than five years. So old repos are also active ones.
Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.