On 6/30/23 11:31, Patrick Steinhardt wrote:
Indeed, supporting SHA256 is a major effort on our side at GitLab. Most
of the work isn't really adapting our production code, but it's rather
that tons of tests were written with seed repositories and hardcoded
object hashes. Converting all of that isn't all that hard in the general
case, but it's a tedious job.
Hi!
This actually reminds me of a funny story from my side.
Earlier this year, I was testing various frontends and how they would
handle SHA256 repositories. All of them failed, not surprising. I even
managed to lock myself out of Gitlab by importing a SHA256 private repo
into my home project -- every time this project became visible, it would
result in Error 500 from the UI. Today (few weeks ago), this appears to
be fixed -- the UI is just broken, so you can't see anything in sha256
repository, but at least I was able to delete the project.
The repository was correctly imported and I could clone from gitlab, so
the problem is mostly "just" UI. :-)
The most likely frontend we'll use for our internal project is Gitea.
The sha256 support is in progress
https://github.com/go-gitea/gitea/pull/23894
From the size of this patch, you can see how ingrained SHA1 assumption
was. Most of the patch is just to remove the hardcoded elements,
including hardcoded SHA1 empty-tree hashes and assumption that 20 bytes
is enough to hold a hash. And I didn't even add sha256 test cases...
But I have to say that in at least one occasion, people are bringing up
the experimental nature of git's sha256 support (per current wording) as
reason not to make their tools sha256 compliant.
In any case I'm fully supportive of relaxing the current warning. Except
for the recently discussed edge case where cloning empty repositories
didn't create a SHA256 repository I have found the SHA256 code to be
stable and working as advertised. We should caution people that many
services will not work with SHA256 yet though.
That is exactly true. But this is also chicken-egg problem. Services are
not adapted for sha256 repositories because there is simply no demand
for them. Only when people will start using sha256 repos, will there be
some demand generated.
- Adam
