Re:How to publish Git repos that cannot be republished to Gi...
by _ikke_ on Tuesday November 03, 2020 @04:17AM
(#24977900)
Note that it's only a _reference_ to a commit, not the commit object itself. So from a a github point of view, it would not even make sense to scan / trigger on this. As long as there are no commit objects with that hash, any reference is harmless.
A git repo is fundamentally composed of 3 object types:
* Blob (effectively a file)
* Tree (which refers to collection of Blobs and Trees, effectively a dir)
* Commit (comment/ author info and various other metadata, a Tree, and a previous Commit)
This is what the git tools are used to dealing with. However git submodules changed things. With submodules, a Tree object can also contain a commit object! Together with the .gitmodules metadata file, this allows you to include another git repo inside your repo.
Joey leveraged that ability to add the youtube-dl latest master commit into his repo as a submodule, but deleted the .gitmodules file so that git wouldn't be verbose about it.
And that's how you sneak a commit into a repo.
This additionally leverages GitHub's data model (which is really the git data model), where they just have this huge DB of all the objects of all the repos on GitHub. So effectively by including this commit in a repo on GH, you're making it refer to the the entire (buried) youtube-dl repo, but you need to be sneaky to be able to see it.