source mgt. requirements solicitation

[Jack Lloyd]

On Mon, 9 Dec 2002, Zack Weinberg wrote:

> > 0aa. Checksums stored in the repository format for all file
> > revisions, deltas, log messages etc., with an easy way to verify
> > them - to detect corruption early.)
>
> Worth pointing out that subversion doesn't do as much checksumming as
> we'd like, either.

OpenCM (opencm.org) does really good checksumming; everything is based off
of strong hashes (and RSA signatures where needed). In particular you're 0d
requirement is met in a way that no other CM system (that I've heard about)
can do. Nobody (even root) can substitute one file for another or similiar
nastiness. Well, unless they can break SHA-1 in a real serious way.

I'll mention I work on OpenCM (it's my day job), and additionally I promise
I won't go endlessly promoting it on the list. I'd be happy to answer any
questions off list if you like, but this is the first and last time I'll
bring it up here.

-Jack