Post #753838

2026-03-19 10:48 UTC

What&#39;s if you could ~$ git clone SWHID? &quot;You’d end up with git clone as a content-addressed fetch primitive rather than just a URL fetch, which is an interesting building block for reproducible builds and supply chain verification.&quot; A nice write-up by @andrewnez on git remote helpers 👉 https://nesbitt.io/2026/03/18/git-remote-helpers.html #Git #SWHID #ReproducibleBuilds

Replies (6)

@schubotz@mathstodon.xyz 2026-03-19 16:33

@bzg @andrewnez Thank you for the analysis. If there was a form of SWHID that used a CID instead of SHA1 it would also help for load balancing, caching and retrieval without access to a SWH mirror, censorship etc. Here also the concept of a shallow SWH mirror might be an attempt to solve the problem with poor connections to git remotes.

Open ##1055836
@raito@nixos.paris 2026-03-19 19:22

@bzg SWHID built-in in Git when

Open ##1055841
@zacchiro@mastodon.xyz 2026-03-25 09:48

@bzg @andrewnez BTW, I think we can do better than "fetch one git object at at a time". For instance, for everything already cooked in the SWH Vault cache https://archive.softwareheritage.org/api/1/#batch-download , we could return a larger bundle, possibly even as a packfile.

Open ##1055842
@nat@social.fogcloud.org 2026-03-25 17:29

@bzg @andrewnez Git needs to use a secure hash algorithm before it's safe for any sort of clever content-addressable store stuff.

Open ##1055843
@khinsen@scholar.social 2026-03-25 17:32

@bzg Here's a tool that does roughly that: https://github.com/khinsen/swh-checkout More proof-of-concept than for wide-scale use, if only because it has Guix as a dependency. But I do use it from time to time. @andrewnez

Open ##1055847
@khinsen@scholar.social 2026-03-26 07:32

@csantosb@sigmoid.social Indeed. The code that handles this fallback is exactly what my little Guile script exposes for other uses. That's why Guix is a dependency. @bzg@floss.social @andrewnez@mastodon.social

Open ##2960487