Re: [PATCH] Receive-pack: include entire SHA1 in nonce

On Sep 25, 2014, at 1:54 PM, Junio C Hamano [off-list ref] wrote:

Junio C Hamano [off-list ref] writes:

quoted

I am not happy with this version, either, though, because now we
have an uninitialized piece of memory at the end of sha1[20] of the
caller, which is given to sha1_to_hex() to produce garbage.  It is
discarded by %.*s format so there is no negative net effect, but I
suspect that the compiler would not see that through.

... and if we want to fix that, we would end up with a set of
changes, somewhat ugly like this.

Which might be an improvement, but let's start with your "sizeof(arg)
is the size of a pointer, even when the definition of arg[] is
spelled with bra-ket, a dummy maintainer!" fix.

I'd like to have your sign-off.  I'd also prefer to retitle it as
something like "hmac_sha1: copy the entire SHA-1 hash out", as it is
deliberate that we do not include the entire SHA-1 in nonce.

It's been long enough since I've done any crypto, so I didn't really know what the algorithm should look like.  Mostly I remember "doing it right is hard", so don't feel too bad.  Making the commit message accurate is perfectly fine, and all the patches you've posted look right at first glance (and to make test as well), so I'm fine with a 

Signed-off-by: Brian Gernhardt <redacted>

attached to whatever commit is actually appropriate instead of the minimum to make my compiler happy.  :-)

~~ Brian