HEADS UP: hashes changing for the freebsd-ports repo on Sunday

[Warner Losh]

On Sun, Feb 7, 2021, 2:59 PM Shawn Webb <shawn.webb at hardenedbsd.org> wrote:

> On Sun, Feb 07, 2021 at 08:48:38PM +0100, Ulrich Spörlein wrote:
> > On Sun, 2021-02-07 at 12:46:48 -0500, Shawn Webb wrote:
> > > On Sun, Feb 07, 2021 at 06:21:10PM +0100, Ulrich Spörlein wrote:
> > > > On Sun, 2021-02-07 at 11:34:37 -0500, Shawn Webb wrote:
> > > > > On Sun, Feb 07, 2021 at 05:24:33PM +0100, Ulrich Spörlein wrote:
> > > > > > On Wed, 2021-02-03 at 13:54:56 +0100, Ulrich Spörlein wrote:
> > > > > > > Hi folks,
> > > > > > >
> > > > > > > It's another one of those instances where the hashes will
> change
> > > > > > > (starting with all commits from Jan 5th 2021 forward).
> > > > > > >
> > > > > > > Our latest ports committers were not added to the authormap
> file in time
> > > > > > > _and_ this stopped being a fatal issue in the converter a
> while ago :/
> > > > > > >
> > > > > > > Please bear with us a while longer.
> > > > > > > Thanks
> > > > > > > Uli
> > > > > > >
> > > > > > > PS: This also affects the src and doc repos, but they will
> obviuously
> > > > > > > not be changed again, see the errata notes at
> > > > > > > https://github.com/freebsd/git_conv/tree/next
> > > > > >
> > > > > > This has now been pushed and the new hashes (and missing
> authornames!) are
> > > > > > live.
> > > > >
> > > > > Sorry for what may seem like dumb questions, but I just wanted to
> make
> > > > > sure:
> > > > >
> > > > > 1. For downstream projects that have already switched to
> > > > >   git.freebsd.org for src, do we need to deal with changed hashes
> > > > >   again? (ie, git merge --allow-unrelated-histories)
> > > >
> > > > Nothing changed for src.
> > > >
> > > > > 2. Do I now need to merge unrelated histories on ports if I use
> ports
> > > > >   from github?
> > > >
> > > > Depends a bit. There is shared history, but it forkes off way in the
> past,
> > > > so if you have work on custom branch, it might indeed be easiest to
> merge
> > > > with --allow-unrelated-histories.
> > > >
> > > > (I personally would probably write out the merge commit manually
> myself,
> > > > it's much easier than figuring out what sort of flags one needs on
> the `git
> > > > merge`.)
> > > >
> > > > Of course, if you're using rebase-based workflows, this all will be
> rather
> > > > trivial to rebase.
> > >
> > > Thanks for the info! HardenedBSD uses a merge-based workflow since we
> > > plan to be around a while. Switching to rebased-based would have
> > > negative consequences to our downstream vendors.
> > >
> > > One more question: when ports is officially switched over to git, are
> > > we likely to see hash more hash changes?
> >
> > No, of course not. Once the conversion has been finalized, none of the
> > history or metadata will be touched retroactively. We'll then have to
> live
> > with errors basically forever.
>
> I worded that horrifically wrong. I blame the lack of caffeine. ;)
>
> I meant to ask: is there any possibility that the hashes will change
> again before the official switch to git?
>

Yes. Given the src experience, it can't be ruled out and is likely.

Warner

Sorry for the miscommunication.
>
> Thanks,
>
> --
> Shawn Webb
> Cofounder / Security Engineer
> HardenedBSD
>
> GPG Key ID:          0xFF2E67A277F8E1FA
> GPG Key Fingerprint: D206 BB45 15E0 9C49 0CF9  3633 C85B 0AF8 AB23 0FB2
>
> https://git-01.md.hardenedbsd.org/HardenedBSD/pubkeys/src/branch/master/Shawn_Webb/03A4CBEBB82EA5A67D9F3853FF2E67A277F8E1FA.pub.asc
>