Subject: Re: [3/4] What's not in 1.5.2 (new topics)

From: Johannes Sixt <[email-masked]>
Date: Fri, 18 May 2007 12:16:26 +0200

Andy Parkins wrote:
> On Friday 2007 May 18, Michael S. Tsirkin wrote:
> > I wouldn't be happy: I have just cloned both project and superproject,
> > but to re-publish the superproject using my clone of subproject, I have
> > to create a new commit, which would have a different hash from the origin.
> > So how do people know they can trust my tree?
> 
> That problem exists regardless of the method of changing URL - in your method
> though the change is entirely unrecorded because you've changed something
> that upstream supplied in an out-of-band manner.

And it doesn't matter: Once you trust the superproject with its
.gitmodules (versioned or not), the trust is based on the SHA1 of the
gitlink entry. Where the so named subproject commit came from is
secondary.

-- Hannes