On Tue, Jul 07, 2026 at 01:09:52AM -0400, Jeff King wrote:

It only makes sense to call git_hash_update(), etc, on a hash context
that has been initialized but not yet finalized or discarded. This is an
unlikely error to make, but it's easy for us to catch it and complain.

It's especially important because it would quietly "work" for many hash
backends (like sha1dc, which is just manipulating some bytes) but would
cause undefined behavior with others (like OpenSSL, which puts the
context onto the heap). Checking the flag lets us catch problems
consistently on every build.

Note that we can't do the same for git_init_hash(). Even though it would

You probably mean `git_hash_init()`?

cause a leak to call it twice (without an intervening final/discard),
the point of the function is that the contents of the struct are
undefined before the call. But calling it twice is an even less likely
error to make, so not covering it is OK.

Right. We could of course enforce that the structure must be zeroed
before calling this function. But I agree that this would become quite
awkward.

Patrick