Should git-apply or git-am come up with the same hash?

Question

I think I'm missing something. I was under the impression that git's usage of a SHA-1 hash commit identifier meant that one could be certain that patch obtained from someone else for that commit had not been altered.

Take this test I did on my machine (name and email changed, obviously):

cd dogcatcher
dogcatcher> git log
commit 926f347567a9da6f7692aca0e23d13f094d9e3a6
Author: Joe User <joe@test.com>
Date:   Sat Dec 17 15:28:55 2011 -0600

    3rd branch commit

commit 11e8055aa5e8f0d323c48b4f691adced7a8a9762
Author: Joe User <joe@test.com>
Date:   Sat Dec 17 15:10:44 2011 -0600

    second branch commit

commit 23deb7093a8565479092ef84142a0e2e7282d213
Author: Joe User <joe@test.com>

dogcatcher> git format-patch 23de  (format a patch containing everything since 23de)

dogcatcher> cd ..
~> cp -r dogcatcher catcatcher
cd catcatcher

catcatcher> git reset --hard 23de  (reset HEAD to 23de)
catcatcher> git am 00* (apply the two patch files)
catcatcher> git log

commit 2548980811d1875971ce1a018df98374950e0059
Author: Joe User <joe@test.com>
Date:   Sat Dec 17 15:28:55 2011 -0600

    3rd branch commit

commit 7d651d05344ba6e2cd18d8e24c0c350d0c7dec66
Author: Joe User <joe@test.com>
Date:   Sat Dec 17 15:10:44 2011 -0600

    second branch commit

commit 23deb7093a8565479092ef84142a0e2e7282d213
Author: Joe User <joe@test.com>

As you can see, the hashes are different on the last two commits, which were created by the patch. Now, perhaps that makes sense. Certainly the timestamps on the files created by the patch were different. (I'm not sure what set of information is included in the hash)

However, if that's the case, how can I verify that the patches I just applied contain exactly the same code? How do I know the person that sent me the patch files didn't make nefarious changes?

Or did I make a mistake that caused the different hash, and had I done it correctly, I would have come out with the same hash?

Answer 1

By default, git am sets the Committer Date to the current time. You can use the --committer-date-is-author-date flag to avoid that, though it may still set you as the committer (in fact, it probably will). You can verify this by using git log --format=fuller instead which shows the Committer information as well.