Subject: Re: Verifiable git archives?

From: Junio C Hamano <[email-masked]>
Date: Thu, 09 Jan 2014 14:46:44 -0800

Andy Lutomirski <[email-masked]> writes:

>> You only need the object name of the top-level tree.  After "untar"
>> the archive into an empty directory, make it a new repository and
>> "git add . && git write-tree"---the result should match the
>> top-level tree the archive was supposed to contain.
>
> Hmm.  I didn't realize that there was enough metadata in the 'git
> archive' output to reproduce the final tree.

We do record the commit object name in the extended header when
writing a tar archive already, but you have to grab the commit
object from somewhere in order to read the top-level tree object
name, which we do not record.

Also, if you used keyword substitution and such when creating an
archive, then the filesystem entities resulting from expanding it
would not match the original.