On Mon, 23 Oct 2006, Jakub Narebski wrote:
>
> The place for timestamp and commiter info is in the revision metadata
> (in commit object in git). Not in revision id. Unless you think that
> "accidentally the same" doesn't happen...
Well, git and bzr really do share the same "stable" revision naming,
although in git it's more indirect, and thus "covers" more.
In git, the revision name indirectly includes the commit comments too (and
git obviously also distinguishes between "committer" and "author", and
those end up being indirectly credited in the name of the commit too). But
in a very real sense, the bzr stable ("real") revision name does
effectively contain the same things as a git ID: it's just that it's a
small subset (only committer+date+random number) of what git includes in
its names.
So you could more easily _fake_ a commit name in bzr, and depending on how
things are done it might be more open to malicious attacks for that reason
(or unintentionally - if two people apply the exact same patch from an
email, and take the author/date info from the email like hit does, you
might have clashes. But with a 64-bit random number, that's probably
unlikely, unless you also hit some other bad luck like having the
pseudo-random sequence seeded by "time()", and people just _happen_ to
apply the email at the exact same second).
The git use of hashes and parenthood information make any accidental
clashes like that a non-issue: if you have exactly the same information,
it really _is_ the same commit, since the hash includes the parenthood
too. So you're left with just malicious attacks, and those currently look
practically impossible too, of course.
So I don't think bzr and git differ in this respect. I think you can
_trust_ stable git names a lot more, but that's a separate issue.
Linus
-
To unsubscribe from this list: send the line "unsubscribe git" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html