Finding fixed Git object ID assumptions before SHA-256 exposes them

Описание и применение

Инструмент git‑sha‑ready обнаруживает предположения о 40‑символьных ID объектов Git, которые неверны для репозиториев SHA‑256, и исправляет их, обеспечивая совместимость.

Задача

Git integrations often assume object IDs are 40 hex characters, which fails for SHA-256 repositories that use 64 hex characters.

Результат

Updating the validator to accept 64‑hex IDs and removing the fixed slice eliminates false findings and ensures compatibility with SHA‑256 repositories.

Рабочий процесс

• 1. Run git‑sha‑ready on a repository to scan tracked text files.
• 2. The tool searches for patterns: 40‑hex regexes, length checks to 40, fixed 40‑char slices, direct .git/objects access, and 20‑byte ID storage.
• 3. Findings are reported with confidence labels and repair hints.
• 4. Optionally run --probe mode to copy the repo into a temporary SHA‑256 repo, commit, and execute a user‑supplied shell command (e.g., npm test).
• 5. Review probe results and adjust code or configuration accordingly.

Доказательства

I built git-sha-ready after noticing that a Git integration can appear healthy while it assumes every object ID is 40 characters long.

Источник

After I let the validator accept 40 or 64 digits and remove the fixed slice, the same scan has no findings.

Источник

The default command reads Git tracked text files. It does not execute the target project.

Источник

I also added an explicit --probe mode. It copies tracked source and config files into a temporary repository initialized with SHA-256, makes a local commit, and runs a shell command supplied by the user.

Источник