@@ -94,7 +94,7 @@ Overview
94
94
--------
95
95
We introduce a new repository format extension. Repositories with this
96
96
extension enabled use SHA-256 instead of SHA-1 to name their objects.
97
- This affects both object names and object content --- both the names
97
+ This affects both object names and object content -- both the names
98
98
of objects and all references to other objects within an object are
99
99
switched to the new hash function.
100
100
@@ -191,59 +191,58 @@ hash functions. They have the following format (all integers are in
191
191
network byte order):
192
192
193
193
- A header appears at the beginning and consists of the following:
194
- - The 4-byte pack index signature: '\377t0c'
195
- - 4-byte version number: 3
196
- - 4-byte length of the header section, including the signature and
194
+ * The 4-byte pack index signature: '\377t0c'
195
+ * 4-byte version number: 3
196
+ * 4-byte length of the header section, including the signature and
197
197
version number
198
- - 4-byte number of objects contained in the pack
199
- - 4-byte number of object formats in this pack index: 2
200
- - For each object format:
201
- - 4-byte format identifier (e.g., 'sha1' for SHA-1)
202
- - 4-byte length in bytes of shortened object names. This is the
198
+ * 4-byte number of objects contained in the pack
199
+ * 4-byte number of object formats in this pack index: 2
200
+ * For each object format:
201
+ ** 4-byte format identifier (e.g., 'sha1' for SHA-1)
202
+ ** 4-byte length in bytes of shortened object names. This is the
203
203
shortest possible length needed to make names in the shortened
204
204
object name table unambiguous.
205
- - 4-byte integer, recording where tables relating to this format
205
+ ** 4-byte integer, recording where tables relating to this format
206
206
are stored in this index file, as an offset from the beginning.
207
- - 4-byte offset to the trailer from the beginning of this file.
208
- - Zero or more additional key/value pairs (4-byte key, 4-byte
207
+ * 4-byte offset to the trailer from the beginning of this file.
208
+ * Zero or more additional key/value pairs (4-byte key, 4-byte
209
209
value). Only one key is supported: 'PSRC'. See the "Loose objects
210
210
and unreachable objects" section for supported values and how this
211
211
is used. All other keys are reserved. Readers must ignore
212
212
unrecognized keys.
213
213
- Zero or more NUL bytes. This can optionally be used to improve the
214
214
alignment of the full object name table below.
215
215
- Tables for the first object format:
216
- - A sorted table of shortened object names. These are prefixes of
216
+ * A sorted table of shortened object names. These are prefixes of
217
217
the names of all objects in this pack file, packed together
218
218
without offset values to reduce the cache footprint of the binary
219
219
search for a specific object name.
220
220
221
- - A table of full object names in pack order. This allows resolving
221
+ * A table of full object names in pack order. This allows resolving
222
222
a reference to "the nth object in the pack file" (from a
223
223
reachability bitmap or from the next table of another object
224
224
format) to its object name.
225
225
226
- - A table of 4-byte values mapping object name order to pack order.
226
+ * A table of 4-byte values mapping object name order to pack order.
227
227
For an object in the table of sorted shortened object names, the
228
228
value at the corresponding index in this table is the index in the
229
229
previous table for that same object.
230
-
231
230
This can be used to look up the object in reachability bitmaps or
232
231
to look up its name in another object format.
233
232
234
- - A table of 4-byte CRC32 values of the packed object data, in the
233
+ * A table of 4-byte CRC32 values of the packed object data, in the
235
234
order that the objects appear in the pack file. This is to allow
236
235
compressed data to be copied directly from pack to pack during
237
236
repacking without undetected data corruption.
238
237
239
- - A table of 4-byte offset values. For an object in the table of
238
+ * A table of 4-byte offset values. For an object in the table of
240
239
sorted shortened object names, the value at the corresponding
241
240
index in this table indicates where that object can be found in
242
241
the pack file. These are usually 31-bit pack file offsets, but
243
242
large offsets are encoded as an index into the next table with the
244
243
most significant bit set.
245
244
246
- - A table of 8-byte offset entries (empty for pack files less than
245
+ * A table of 8-byte offset entries (empty for pack files less than
247
246
2 GiB). Pack files are organized with heavily used objects toward
248
247
the front, so most object references should not need to refer to
249
248
this table.
@@ -252,10 +251,10 @@ network byte order):
252
251
up to and not including the table of CRC32 values.
253
252
- Zero or more NUL bytes.
254
253
- The trailer consists of the following:
255
- - A copy of the 20-byte SHA-256 checksum at the end of the
254
+ * A copy of the 20-byte SHA-256 checksum at the end of the
256
255
corresponding packfile.
257
256
258
- - 20-byte SHA-256 checksum of all of the above.
257
+ * 20-byte SHA-256 checksum of all of the above.
259
258
260
259
Loose object index
261
260
~~~~~~~~~~~~~~~~~~
@@ -351,7 +350,7 @@ the following steps:
351
350
3. convert to sha256: open a new (sha256) packfile. Read the topologically
352
351
sorted list just generated. For each object, inflate its
353
352
sha1-content, convert to sha256-content, and write it to the sha256
354
- pack. Record the new sha1<->sha256 mapping entry for use in the idx.
353
+ pack. Record the new sha1<-- >sha256 mapping entry for use in the idx.
355
354
4. sort: reorder entries in the new pack to match the order of objects
356
355
in the pack the server generated and include blobs. Write a sha256 idx
357
356
file
@@ -391,6 +390,7 @@ existing "gpgsig" field. Its signed payload is the sha256-content of the
391
390
commit object with any "gpgsig" and "gpgsig-sha256" fields removed.
392
391
393
392
This means commits can be signed
393
+
394
394
1. using SHA-1 only, as in existing signed commit objects
395
395
2. using both SHA-1 and SHA-256, by using both gpgsig-sha256 and gpgsig
396
396
fields.
@@ -408,6 +408,7 @@ sha256-content of the tag with its gpgsig-sha256 field and "-----BEGIN PGP
408
408
SIGNATURE-----" delimited in-body signature removed.
409
409
410
410
This means tags can be signed
411
+
411
412
1. using SHA-1 only, as in existing signed tag objects
412
413
2. using both SHA-1 and SHA-256, by using gpgsig-sha256 and an in-body
413
414
signature.
@@ -598,7 +599,7 @@ The user can also explicitly specify which format to use for a
598
599
particular revision specifier and for output, overriding the mode. For
599
600
example:
600
601
601
- git --output-format=sha1 log abac87a^{sha1}..f787cac^{sha256}
602
+ git --output-format=sha1 log abac87a^{sha1}..f787cac^{sha256}
602
603
603
604
Choice of Hash
604
605
--------------
@@ -636,6 +637,7 @@ We choose SHA-256.
636
637
Transition plan
637
638
---------------
638
639
Some initial steps can be implemented independently of one another:
640
+
639
641
- adding a hash function API (vtable)
640
642
- teaching fsck to tolerate the gpgsig-sha256 field
641
643
- excluding gpgsig-* from the fields copied by "git commit --amend"
@@ -647,16 +649,17 @@ Some initial steps can be implemented independently of one another:
647
649
- introducing index v3
648
650
- adding support for the PSRC field and safer object pruning
649
651
650
-
651
652
The first user-visible change is the introduction of the objectFormat
652
653
extension (without compatObjectFormat). This requires:
654
+
653
655
- teaching fsck about this mode of operation
654
656
- using the hash function API (vtable) when computing object names
655
657
- signing objects and verifying signatures
656
658
- rejecting attempts to fetch from or push to an incompatible
657
659
repository
658
660
659
661
Next comes introduction of compatObjectFormat:
662
+
660
663
- implementing the loose-object-idx
661
664
- translating object names between object formats
662
665
- translating object content between object formats
@@ -669,6 +672,7 @@ Next comes introduction of compatObjectFormat:
669
672
"Object names on the command line" above)
670
673
671
674
The next step is supporting fetches and pushes to SHA-1 repositories:
675
+
672
676
- allow pushes to a repository using the compat format
673
677
- generate a topologically sorted list of the SHA-1 names of fetched
674
678
objects
@@ -734,6 +738,7 @@ Using hash functions in parallel
734
738
Objects newly created would be addressed by the new hash, but inside
735
739
such an object (e.g. commit) it is still possible to address objects
736
740
using the old hash function.
741
+
737
742
* You cannot trust its history (needed for bisectability) in the
738
743
future without further work
739
744
* Maintenance burden as the number of supported hash functions grows
@@ -749,13 +754,15 @@ sha1-content based signatures.
749
754
750
755
In other words, a single signature was used to attest to the object
751
756
content using both hash functions. This had some advantages:
757
+
752
758
* Using one signature instead of two speeds up the signing process.
753
759
* Having one signed payload with both hashes allows the signer to
754
760
attest to the sha1-name and sha256-name referring to the same object.
755
761
* All users consume the same signature. Broken signatures are likely
756
762
to be detected quickly using current versions of git.
757
763
758
764
However, it also came with disadvantages:
765
+
759
766
* Verifying a signed object requires access to the sha1-names of all
760
767
objects it references, even after the transition is complete and
761
768
translation table is no longer needed for anything else. To support
@@ -782,16 +789,17 @@ Document History
782
789
783
790
784
791
785
- Initial version sent to
786
- http://lore.kernel.org/git/
[email protected]
792
+ * Initial version sent to http://lore.kernel.org/git/
[email protected]
787
793
788
794
789
795
Incorporated suggestions from jonathantanmy and sbeller:
796
+
790
797
* describe purpose of signed objects with each hash type
791
798
* redefine signed object verification using object content under the
792
799
first hash function
793
800
794
801
802
+
795
803
* Use SHA3-256 instead of SHA2 (thanks, Linus and brian m. carlson).[1][2]
796
804
* Make sha3-based signatures a separate field, avoiding the need for
797
805
"hash" and "nohash" fields (thanks to peff[3]).
@@ -805,6 +813,7 @@ Incorporated suggestions from jonathantanmy and sbeller:
805
813
especially Junio).
806
814
807
815
816
+
808
817
* use placeholder NewHash instead of SHA3-256
809
818
* describe criteria for picking a hash function.
810
819
* include a transition plan (thanks especially to Brandon Williams
@@ -816,12 +825,14 @@ Incorporated suggestions from jonathantanmy and sbeller:
816
825
817
826
Later history:
818
827
819
- See the history of this file in git.git for the history of subsequent
820
- edits. This document history is no longer being maintained as it
821
- would now be superfluous to the commit log
828
+ * See the history of this file in git.git for the history of subsequent
829
+ edits. This document history is no longer being maintained as it
830
+ would now be superfluous to the commit log
831
+
832
+ References:
822
833
823
- [1] http://lore.kernel.org/git/CA+55aFzJtejiCjV0e43+9oR3QuJK2PiFiLQemytoLpyJWe6P9w@mail.gmail.com/
824
- [2] http://lore.kernel.org/git/CA+55aFz+gkAsDZ24zmePQuEs1XPS9BP_s8O7Q4wQ7LV7X5-oDA@mail.gmail.com/
825
- [3] http://lore.kernel.org/git/
[email protected] /
826
- [4] http://lore.kernel.org/git/
[email protected]
827
- [5] https://lore.kernel.org/git/CAJo=hJtoX9=AyLHHpUJS7fueV9ciZ_MNpnEPHUz8Whui6g9F0A@mail.gmail.com/
834
+ [1] http://lore.kernel.org/git/CA+55aFzJtejiCjV0e43+9oR3QuJK2PiFiLQemytoLpyJWe6P9w@mail.gmail.com/
835
+ [2] http://lore.kernel.org/git/CA+55aFz+gkAsDZ24zmePQuEs1XPS9BP_s8O7Q4wQ7LV7X5-oDA@mail.gmail.com/
836
+ [3] http://lore.kernel.org/git/
[email protected] /
837
+ [4] http://lore.kernel.org/git/
[email protected]
838
+ [5] https://lore.kernel.org/git/CAJo=hJtoX9=AyLHHpUJS7fueV9ciZ_MNpnEPHUz8Whui6g9F0A@mail.gmail.com/
0 commit comments