Re: [PATCH] fsck: return non-zero status on missing ref tips

[Jeff King <peff@peff.net>]

On Thu, Sep 11, 2014 at 09:58:45PM -0700, Junio C Hamano wrote:

> On Thu, Sep 11, 2014 at 9:29 PM, Jeff King <peff@peff.net> wrote:
> > [+cc mhagger for packed-refs wisdom]
> >
> > If we only have a packed copy of "refs/heads/master" and it is broken,
> > then deleting any _other_ unrelated ref will cause refs/heads/master to
> > be dropped from the packed-refs file entirely. We get an error message,
> > but that's easy to miss, and the pointer to master's sha1 is lost
> > forever.
> 
> Hmph, and the significance of losing a random 20-byte object name that
> is useless in your repository is? You could of course ask around other
> repositories (i.e. your origin, others that fork from the same origin,
> etc.), and having the name might make it easier to locate the exact
> object.

Because your repository is corrupted and broken, and we then forget that
fact. I.e., it is not a random 20-byte object name. It is the thing that
your branch is pointing at, and that is valuable in itself. If you can
restore the object (e.g., from another repository), you need to know
which object to restore.

But I also think corrupting a repository and not noticing is quite bad
in itself.

> But in such a case, either they have it at the tip (in which case you
> can just fetch the branch you lost), or they have it reachable from
> one of their tips of branches you had shown interest in (that is why
> you had that lost object in the first place). Either way, you would be
> running "git fetch" or asking them to send "git bundle" output to be
> unbundled at your end, and the way you ask would be by refname, not
> the object name, so I am not sure if the loss is that grave.

Yes, but after you get the objects from the other person, what do you
set your ref to? If I know my tip was at commit X, I can get any set of
objects from another untrusted person that includes X, verify what they
sent me cryptographically, and restore my tip to X.

If I do not know X, they can send me any random set of objects. I can
verify that the sha1s are OK and the graph is complete, but I cannot
verify that the contents are sane. I am effectively just picking their
"master" as my new starting point, and trusting that it has not been
tampered with.

-Peff