SitePointSep 22, 202617 min readtutorialintermediate

Migrating Repositories to Git 3.0: Moving to SHA-256 and Reftables

Summary

The article outlines a step‑by‑step workflow for migrating existing Git repositories to the new SHA‑256 object format and reftable reference backend, including an audit script, conversion commands, and rollback guidance. Following the guide lets teams modernize their repos, improve scalability and address SHA‑1 security concerns.

Run the provided Python audit script to detect object format, ref backend, and hard‑coded SHA‑1 patterns across all repos.
Migrate ref storage first with `git refs migrate --ref-format=reftable` and validate using `git fsck` and `git for-each-ref`.
Reinitialize a SHA‑256 repository and replay history via `git fast-export` / `git fast-import`.
Update all hooks, CI pipelines, and tooling to handle 64‑character SHA‑256 hashes.

Large teams and monorepos should care because SHA‑256 mitigates known collision attacks and reftables dramatically improve ref lookup performance at scale.

6/10

devops ci git sha 256 reftable

Related reading

Reinventing issue tracking: Local-first and Git-native manganin.dev
A devlog describing how Manganin’s issue tracker stores issues in a dedicated Git repo as plain files, after rejecting earlier approaches that tried to embed issue data in the code tree or Git refs. The author explains the pitfalls of using refs for issue storage, shows the low‑level Git commands needed for that approach, and then outlines the final design: a hidden sister repository where each i…
Lobstersmanganin.dev6d6 minHN1 lobste.rs27
You can run Git on object storage if you re-make packfiles tigrisdata.com
The author built a Git server on object storage (objgit) and found standard Git packfiles inefficient due to random‑access and round‑trip latency. By designing a columnar, object‑storage‑native packfile format that can be accessed via HTTP range requests, they achieved acceptable performance for large repositories without client‑side changes.
Hacker News front pagetigrisdata.com6d18 minHN14635
Not In My Git Yard: Catching Backdoors at Commit and Release Time arxiv.org
Lobstersarxiv.org5dHN41 lobste.rs5
Securing AI Pull Requests: Building a Deterministic AST Audit Harness in GitHub Actions sitepoint.com
A step‑by‑step tutorial for building a deterministic AST‑based security scanner that runs in GitHub Actions to catch prototype‑pollution, high‑entropy secrets, and unauthorized network egress in AI‑generated pull requests.
SitePointsitepoint.com3d19 min
Inside ZCode: Silently uploading your Git history to the cloud ferstar.org
ZCode (Zhipu’s AI coding desktop) silently archives your entire workspace—including full .git history, LFS cache, and config—encrypts it with a server‑supplied RSA public key, and uploads the ciphertext directly to Aliyun OSS. The upload runs unconditionally for any logged‑in user, cannot be disabled via UI, and the decryption key lives only on the server, giving Zhipu full read access to your co…
Hacker News front pageferstar.orgferstar5d6 minpostmortemHN336113
Migrating the GitHub Copilot runtime to Rust, using Copilot github.blog
The Copilot agent runtime was rewritten from a 130‑k‑line TypeScript/Node.js codebase into a native Rust library (~830 k lines of Rust) to reduce startup latency, memory use, and improve reliability. The migration was done incrementally (in‑place) across 128 PRs, with AI‑generated code handling most of the work. The new runtime exposes a C ABI for in‑process embedding by all six Copilot SDK langu…
GitHub Oldgithub.blogStephen Toub6d65 minHN188

Migrating Repositories to Git 3.0: Moving to SHA-256 and Reftables

Summary

Related reading

Reinventing issue tracking: Local-first and Git-nativemanganin.dev

You can run Git on object storage if you re-make packfilestigrisdata.com

Not In My Git Yard: Catching Backdoors at Commit and Release Timearxiv.org

Securing AI Pull Requests: Building a Deterministic AST Audit Harness in GitHub Actionssitepoint.com

Inside ZCode: Silently uploading your Git history to the cloudferstar.org

Migrating the GitHub Copilot runtime to Rust, using Copilotgithub.blog

Reinventing issue tracking: Local-first and Git-native manganin.dev

You can run Git on object storage if you re-make packfiles tigrisdata.com

Not In My Git Yard: Catching Backdoors at Commit and Release Time arxiv.org

Securing AI Pull Requests: Building a Deterministic AST Audit Harness in GitHub Actions sitepoint.com

Inside ZCode: Silently uploading your Git history to the cloud ferstar.org

Migrating the GitHub Copilot runtime to Rust, using Copilot github.blog