logoalt Hacker News

limonkufu • yesterday at 11:41 PM • 0 replies • view on HN

It seems people are missing the point: it's not even the submodule incompatibility that's going to become an issue majorly (like python2 --> python3 but worse), the main issue is the loss of traceability for repos that changes in place (which I assume many will do). Imagine what will happen to these:

- SLSA and Provenance or SBOM data in the supply chain security that uses commit hash. All the previous images are now pointing to a non-existing commit

- All the documentation and tooling as the article calls out

- All your traceability links from your project tool to your git repo, they will lose all the past data as it will be dead links

So I hope there IS NOT a migration path for in-place replacement!