git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: How safe are signed git tags? Only as safe as SHA-1 or somehow safer?

From
brian m. carlson <sandals@crustytoothpaste.net>
Date
Nov 25, 2014, 11:07 UTC
Message-ID
<20141125110711.GF28310@vauxhall.crustytoothpaste.net>
In-Reply-To
<CACsJy8BMNXUinfK=YcJPkx98tYv_e40N0_mqqnzMLxDN6hkruA@mail.gmail.com>
On Tue, Nov 25, 2014 at 08:16:15AM +0700, Duy Nguyen wrote:
Show 12 quoted lines
> On Tue, Nov 25, 2014 at 1:14 AM, Nico Williams <nico@cryptonector.com> wrote:
> > Is there a plan for upgrading to a better hash function in the future?
> >  (E.g., should it become an urgent need.)
> >
> > What are the roadblocks to adoption of a replacement hash function?
> > Just documenting this would go a long way towards making it possible
> > to upgrade some day.
> 
> The biggest obstacle is the assumption of SHA-1 everywhere in the
> source code (e.g. assume the object name always takes 20 bytes). Brian
> started on cleaning that up [1] but I think it's stalled. Then we need
> to deal with upgrade path for SHA-1 repos.

Yes, it is stalled. It ended up being a Herculean task, so when I pick up the patch series again, I'll probably submit changes in chunks to avoid the huge amount of code churn required. I feel the list and Junio in particular will appreciate that more.

-- 
brian m. carlson / brian with sandals: Houston, Texas, US
+1 832 623 2791 | http://www.crustytoothpaste.net/~bmc | My opinion only
OpenPGP: RSA v4 4096b: 88AC E9B2 9196 305B A994 7552 F1BA 225C 0223 B187
Previous: Junio C Hamano
Message 21 of 21 in “How safe are signed git tags? Only as safe as SHA-1 or somehow safer?”
  1. Patrick SchleizerNov 16, 2014
  2. Jeff KingNov 17, 2014
  3. Patrick SchleizerNov 21, 2014
  4. Jason PyeronNov 21, 2014
  5. Jeff KingNov 22, 2014
  6. Jeff KingNov 22, 2014
  7. Fedor BrunnerNov 25, 2014
  8. Duy NguyenNov 24, 2014
  9. Michael J GruberNov 24, 2014
  10. Duy NguyenNov 24, 2014
  11. Duy NguyenNov 25, 2014
  12. Jeff KingNov 24, 2014
  13. Nico WilliamsNov 24, 2014
  14. Duy NguyenNov 25, 2014
  15. Jonathan NiederNov 25, 2014
  16. Duy NguyenNov 25, 2014
  17. Stefan BellerNov 25, 2014
  18. Jeff KingNov 25, 2014
  19. Duy NguyenNov 25, 2014
  20. Junio C HamanoNov 25, 2014
  21. brian m. carlsonNov 25, 2014

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.