git - 我需要哪些信息来证明我的整个 Git 存储库的完整性？

Question

每个分支末端的哈希值是否足以证明我的整个存储库的完整性？为了便于讨论，假设您必须将整个存储库提供给某人，让他们为所欲为，并确定他们是否更改了哪怕是 1 位数据。你会怎么做？

如果我要推送到上游的裸存储库，这是我需要保证的所有数据吗我可以在以后验证整个存储库的完整性？

git ls-remote --heads origin

fcce961b46784fae13be8a30c2622ddd34d970ec        refs/heads/develop
9da7bb692a72235451706f24790a3f7a100a64e2        refs/heads/feature-netty-testing
86020c50d86691caecff4a55d3b1f2f588f6291d        refs/heads/javafx-testing
871d715e5c072b1fbfacecc986f678214fa0b585        refs/heads/master
7ed641c96d910542edeced5fc470d63b8b4734f0        refs/heads/orphan-branch

那是我经常使用的沙盒存储库。 orphan-branch 是我故意孤立的分支，如 here 所述.一切对我来说似乎都是正确的。列出了我期望的所有分支，但我不确定是否我只需要每个分支提示的 SHA。我错过了什么吗？

标签呢？那些没有被 merge 到任何东西中而被删除的分支呢？

已更新

正如一些评论中指出的，除了 heads 之外，可能还有其他 refs 需要考虑。例如，tags 和 notes 可能有用，具体取决于它们对您是否重要或您是否在标记上签名。对于我自己，我主要对提交的内容感兴趣，这就是为什么我接受了 VonC 的回答。

Answer 1

就完整性而言，这似乎足够了。
标记引用提交，因此如果提交更改，git fsck 将检测标记与其不存在的提交之间的不一致。

请注意，完整性不同于信任(即为内容担保)
为此，“A Git Horror Story: Repository Integrity With Signed Commits ”很有启发性。

首先，其“Commit History”部分详细介绍了 SHA-1 完整性背后的理论(也出现在“Git and Data integrity”中，并以:

That said, it is important to understand that the integrity of your repository guaranteed only if a hash collision cannot be created — that is, if an attacker were able to create the same SHA-1 hash with different data, then the child commit(s) would still be valid and the repository would have been successfully compromised.
Vulnerabilities have been known in SHA-1 since 2005 that allow hashes to be computed faster than brute force, although they are not cheap to exploit.
Given that, while your repository may be safe for now, there will come some point in the future where SHA-1 will be considered as crippled as MD5 is today.