How to verify a git merge contains no extra changes?

问题

In git, how do I verify that a merge upstream master commit does not contain any additional diffs? Say I want to verify that the person didn't do anything 'sneaky' besides actually merge the changes from the upstream master branch.

I want to verify that the only diffs come from the other commits they made; that they did not perform an 'evil merge'.

Is there a way to verify that no additional changes were made during the merge step?
Or better yet: show me the potential 'evil merge' diffs so I can see for myself what extra work might have been done?

Example scenario:

          P1---P2   P3---P4---P5---P6
         /       \  /        /       \
    A---B---C---D--E--------F---------G master
                    \      /
                     C1---C2

P1..P2: First pull request
C1..C2: My working branch
P3..P4: More work done inbetween
P5: The commit that merges in master branch changes
P6: More regular work

1. Someone sends a pull request to my repo (P1..P2)
2. The pull request is fantastic, and I merge it (E)
3. I do some further development (C1..C2), integrate my own branch to master (F), and publish
4. The other person has done more work in the meantime (P3..P4)
5. They merge upstream changes into their local repo (P5), makes more changes (P6), and send a second pull request
6. Can I verify that they didn't sneak in any extra diffs during the merge (P5)?

回答1:

You can check whether a git merge commit contains any other changes by doing a diff of diffs. Here's one way.

          P1---P2   P3---P4---P5---P6
         /       \  /        /       \
    A---B---C---D--E--------F---------G master
                    \      /
                     C1---C2

1. Calculate the diff of all changes in the master branch between the original common parent E and the master branch commit just before the merge, F:

   git diff E F > master_changes_to_merge.txt

2. Calculate a diff of everything changed in the 'merge in master' commit, P5

   git diff P4 P5 > master_changes_actually_merged.txt

3. Diff those:

   diff master_changes_to_merge.txt master_changes_actually_merged.txt

If step 3 shows no output, there should be no evil merge changes.

来源：https://stackoverflow.com/questions/27183534/how-to-verify-a-git-merge-contains-no-extra-changes