An etag, a git ref, and a truncated id: three lookups that answered with the wrong object

Description and use

CI/CD pipelines may incorrectly assume an object is unchanged when the identifier used to fetch it is ambiguous or truncated. By comparing the returned identifier to the requested one, recomputing content-addressed hashes, and logging cache age, silent mismatches can be avoided.

Problem

Automated pipelines can incorrectly assume an object is unchanged when the identifier used to fetch it is ambiguous or the returned object differs from the requested one.

Outcome

By verifying returned identifiers against requested ones, recomputing content-addressed IDs, and logging cache age, pipelines avoid silent mismatches and ensure the correct objects are processed.

Workflow

• 1. Issue a request to the API or Git command with the intended identifier.
• 2. Record the identifier used in the request.
• 3. Receive the response and extract the identifier returned in the payload or headers.
• 4. Compare the returned identifier to the requested identifier; if they differ, flag an error.
• 5. If the format is content-addressed (e.g., Git objects), recompute the identifier from the returned bytes and compare to the returned identifier; if they differ, flag an error.
• 6. If the response is served from a cache, log the Age header to assess freshness.
• 7. Treat any mismatch or stale response as a failure rather than a warning.

Evidence

Compare the returned identity to the requested one, as an error and not a warning.

Source

git object ids are content-addressed, so given the bytes you can recompute the id instead of trusting anyone's word for it

Source

One character short is not an error, it is a shorter valid id pointing at an entirely unrelated object

Source