linux-kernel - Re: project wide: git config entry for [diff] renames=true

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <xmqq61gbbkxc.fsf@gitster.dls.corp.google.com>
Date:	Thu, 25 Sep 2014 11:43:27 -0700
From:	Junio C Hamano <gitster@...ox.com>
To:	Joe Perches <joe@...ches.com>
Cc:	Jeff King <peff@...f.net>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Michal Sojka <sojka@...ica.cz>, linux-usb@...r.kernel.org,
	Alan Stern <stern@...land.harvard.edu>,
	Bryan Wu <cooloney@...il.com>, Felipe Balbi <balbi@...com>,
	Linux LED Subsystem <linux-leds@...r.kernel.org>,
	linux-kernel@...r.kernel.org, michal.vokac@...ap.cz,
	git <git@...r.kernel.org>
Subject: Re: project wide: git config entry for [diff] renames=true

Joe Perches <joe@...ches.com> writes:

> On Thu, 2014-09-25 at 14:00 -0400, Jeff King wrote:
> ...
>> diff.renames is probably safe, but any config-sharing mechanism would
>> have to deal with either whitelisting, or providing some mechanism for
>> the puller to review changes before blindly following them.
>
> Another mechanism might be to add a repository
> top level .gitconfig and add whatever to that.

That could be smaller half of an implementation detail of one of the
two possibilities Jeff mentioned i.e. "mechanism for the puller to
review changes before blindly following".  It gives the transfer
part.  You still need a new mechanism to make that file that is
tracked in the repository to be used as part of your configuration
variable set after letting the puller to review and approve.

A puller who blindly trust the project could use the "include"
mechanism from your .git/config to include a file with a well-known
name that is tracked by the project _without_ review or approval.  I
doubt we would recommend that in an open source setting, though.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/