Glimpse: Why has the commit history been rewritten?

[unascribed]

I noticed the hashes of previous commits in the history do not match upstream. Why is this? Rebasing all these commits means it's no longer easily verifiable that this is truly a fork of upstream and there could be malicious code or commits hidden somewhere in the plethora of rebased commits.

I've verified Glimpse commit d42db44c387b05a3473616a5d175e9279802d38c matches upstream commit 3d8535b55fdafffd5a46b57ae3779333e7fe3ac6, minus a series of strange changes (reverts?) in gimpfilloptions.c, gimppaintoptions.h, gimppaintoptions-gui.c, gimptagpopup.c, and gimptagpopup.h, but this had to be done by using diff -r on clones of both repos checked out to the relevant commits. If the commits had matching hashes it would've been certified this was true without having to check.

This makes it difficult to cherry-pick or merge upstream commits, and is kinda sketchy.

[TrechNex]

This would be because the first commit for this repo was from the 2.10.12 tag (not master branch) onwards. Then @BrainBlasted made the case for us including all the previous history, so I did a rebase on the upstream commits (I believe he's since changed his mind! 😂).

Unfortunately this caused conflicts as Git has to dynamically recreate the entire hashmap when you do that, and I spent the better part of a day going through fixing them commit by commit (always choosing the latest change each time).

As you seem to be quite knowledgable on this we would welcome your suggestions about how to fix this problem. My guess is we'd need a totally clean branch with upstream changes, then a separate branch on which we'd do a git rebase and cherrypick all the Glimpse changes to merge into it?

[unascribed]

...You did an interactive rebase with conflicts on an entire 42k commit repo?

Jesus.

I'll see what I can do to whack the history; it'll require a force-push to fix though and will break everyone's clones.

[unascribed]

Here's the repository's current state rebased onto upstream without any loss of commit information. Confirmed to match dev-g210 via diff -r.

I'll warn you again: if you decide to use my fixed history branch, you will need to force-push and it will break all existing clones of Glimpse. Everyone will need to run git fetch && git reset --hard origin/dev-g210 to update their clones; git pull will reject the changes as there are no common commits.

[LunaTheFoxgirl]

imo this is a non-issue. We’re going to hard fork relatively soon as well. Not worth breaking clones about.

The code is open so anybody can verify that there isn’t malicious code there, build scripts are open as well. And I believe that our CI scripts are too.

[TrechNex]

Feedback we've had from the community on Matrix is that not everyone is experiencing the same issue. Others have also said that the niche benefit gained is not worth the level of disruption.

For those concerned about this we recommend running diffs against the trees or files instead of comparing hashes. That will achieve the same objective without massively disrupting our project not long before our first binary release!

[unascribed]

Fair enough; I only did the fixed rebase since you suggested it.

[jamierocks]

I think you'll should reconsider this - I know its a huge PITA, but given the low number of existing commits you've made and the low number of active pull requests here - I think being at a level place as GIMP would be helpful.

Though if the rest of the community doesn't want this, then so be it.

[TrechNex]

Currently looking into this issue, seeing as we changed plans to stick with 2.10.x base for longer than anticipated and we still need to merge upstream changes for 2.10.14 in next release.

[TrechNex]

To preview, I've done a rebase, then created a branch from it called "refork-test". If the project still builds and works as expected I'll do a force push on dev-g210, then notify open PRs they need to rebase. (Although it might be Github will do this for them after we approve changes anyway)

[TrechNex]

Build succeeded, and branch has been force-pushed. Now updating PRs

[TrechNex]

Now fixed