{"thread":{"id":"57652","subject":"any real-world SHA-256 repo users out there?","startedAt":"2022-04-03T08:48:50Z","lastAt":"2022-04-03T22:40:16Z","messageCount":4,"participants":["Eric Wong","brian m. carlson","rsbecker@nexbridge.com","Junio C Hamano"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"452972","messageId":"20220403084258.GA27999@dcvr","threadId":"57652","inReplyTo":null,"subject":"any real-world SHA-256 repo users out there?","fromName":"Eric Wong","fromEmail":"e@80x24.org","sentAt":"2022-04-03T08:42:58Z","receivedAt":"2022-04-03T08:48:50Z","isPatch":false,"sender":{"key":"e@80x24.org","avatar":null},"body":"Hey all, just wondering if it's something I should prioritize\nadding support for in some git-using project I hack on...\n\nOf course, I'm not dropping SHA-1 support.  So I'm wondering if\nI should wait for (or hack on :P) git to handle both SHA-256 and\nSHA-1 in one process; or if it's something I'd be better off\nmanaging via multiple (git cat-file --batch) processes.  No OIDs\nare abbreviated, so it's just 20/40 vs 32/64.\n\nI actually started an entirely new project in May 2021 using\nSHA-256 and the only problem I've encountered (now fixed) was\nwith HTTP(S) clones.  I still haven't publicized that new\nproject, yet (I keep getting brain farts and side-tracked with\nother stuff...)\n"},{"id":"452997","messageId":"Ykna7sJP8ktvNLor@camp.crustytoothpaste.net","threadId":"57652","inReplyTo":"20220403084258.GA27999@dcvr","subject":"Re: any real-world SHA-256 repo users out there?","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2022-04-03T17:35:42Z","receivedAt":"2022-04-03T17:35:50Z","isPatch":false,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On 2022-04-03 at 08:42:58, Eric Wong wrote:\n> Hey all, just wondering if it's something I should prioritize\n> adding support for in some git-using project I hack on...\n> \n> Of course, I'm not dropping SHA-1 support.  So I'm wondering if\n> I should wait for (or hack on :P) git to handle both SHA-256 and\n> SHA-1 in one process; or if it's something I'd be better off\n> managing via multiple (git cat-file --batch) processes.  No OIDs\n> are abbreviated, so it's just 20/40 vs 32/64.\n\nGit can already use one binary to handle SHA-1 and SHA-256 repositories\nand has been able to since Git 2.29 (although 2.30 has some fixes you\nshould use). It just doesn't provide interop at this point, and I'm only\nworking on it as I find time, so I wouldn't hold your breath for it.\n\nI have some indefinite plans to improve the support for SHA-1/SHA-256\ninterop in the future, as well as port SHA-256 support to libgit2, but\nthose are dependent on some things which are not certain (but very\nlikely) to occur.\n\nI strongly encourage folks to add SHA-256 repository support to tooling\nsince it's likely going to become more popular in the future.  I have\nsome local SHA-256 repositories on my systems and they appear to work\nfine.\n-- \nbrian m. carlson (he/him or they/them)\nToronto, Ontario, CA\n"},{"id":"452998","messageId":"02b501d84784$0e904260$2bb0c720$@nexbridge.com","threadId":"57652","inReplyTo":"Ykna7sJP8ktvNLor@camp.crustytoothpaste.net","subject":"RE: any real-world SHA-256 repo users out there?","fromName":"","fromEmail":"rsbecker@nexbridge.com","sentAt":"2022-04-03T17:55:45Z","receivedAt":"2022-04-03T17:56:29Z","isPatch":false,"sender":{"key":"randall.becker@nexbridge.ca","avatar":"https://avatars.githubusercontent.com/u/28956764?v=4"},"body":"On April 3, 2022 1:36 PM, brian m. carlson wrote:\n>On 2022-04-03 at 08:42:58, Eric Wong wrote:\n>> Hey all, just wondering if it's something I should prioritize adding\n>> support for in some git-using project I hack on...\n>>\n>> Of course, I'm not dropping SHA-1 support.  So I'm wondering if I\n>> should wait for (or hack on :P) git to handle both SHA-256 and\n>> SHA-1 in one process; or if it's something I'd be better off managing\n>> via multiple (git cat-file --batch) processes.  No OIDs are\n>> abbreviated, so it's just 20/40 vs 32/64.\n>\n>Git can already use one binary to handle SHA-1 and SHA-256 repositories and has\n>been able to since Git 2.29 (although 2.30 has some fixes you should use). It just\n>doesn't provide interop at this point, and I'm only working on it as I find time, so I\n>wouldn't hold your breath for it.\n>\n>I have some indefinite plans to improve the support for SHA-1/SHA-256 interop in\n>the future, as well as port SHA-256 support to libgit2, but those are dependent on\n>some things which are not certain (but very\n>likely) to occur.\n>\n>I strongly encourage folks to add SHA-256 repository support to tooling since it's\n>likely going to become more popular in the future.  I have some local SHA-256\n>repositories on my systems and they appear to work fine.\n\nOur tooling works correctly regardless of the choice of SHA-256, but have been waiting for GitHub et. al., to provide capabilities. I would welcome interoperability. What help do you need?\n\nRegards,\nRandall\n\n"},{"id":"453011","messageId":"xmqqa6d1u6yg.fsf@gitster.g","threadId":"57652","inReplyTo":"02b501d84784$0e904260$2bb0c720$@nexbridge.com","subject":"Re: any real-world SHA-256 repo users out there?","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2022-04-03T22:40:07Z","receivedAt":"2022-04-03T22:40:16Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"<rsbecker@nexbridge.com> writes:\n\n>>I have some indefinite plans to improve the support for\n>>SHA-1/SHA-256 interop in the future, as well as port SHA-256\n>>support to libgit2, but those are dependent on some things which\n>>are not certain (but very likely) to occur.\n\nThat is encouraging to hear.\n\nSHA-256 interop is one of the things I want to see appear sooner\nrather than later (it would be what I would answer to the popular\n\"Git Rev News\" question, if I were interviewed).  I certainly would\nwant it to materialize before I retire ;-)\n\n>>I strongly encourage folks to add SHA-256 repository support to\n>>tooling since it's likely going to become more popular in the\n>>future.  I have some local SHA-256 repositories on my systems and\n>>they appear to work fine.\n>\n> Our tooling works correctly regardless of the choice of SHA-256,\n> but have been waiting for GitHub et. al., to provide\n> capabilities. I would welcome interoperability. What help do you\n> need?\n"}]}