git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Migrating away from SHA-1?

From
Jeff King <peff@peff.net>
Date
Apr 12, 2016, 23:44 UTC
Message-ID
<20160412234406.GC2210@sigill.intra.peff.net>
In-Reply-To
<1460502934.5540.71.camel@twopensource.com>
On Tue, Apr 12, 2016 at 07:15:34PM -0400, David Turner wrote:
> It would be possible, of course, to GPG-sign the entire commit's
> transitive data (rather than just the SHA1s of same).  But as far as I
> know, that is not ever what is done.

There is a project called git-evtag which does this, and you can find mention on the list. The problem is just that it's not very efficient. That's maybe OK for tag-signing, which is relatively rare. It wouldn't really work for commit-signing.

-Peff
Previous: David TurnerNext: Theodore Ts'o
Message 6 of 21 in “Migrating away from SHA-1?”
  1. H. Peter AnvinApr 12, 2016
  2. Stefan BellerApr 12, 2016
  3. H. Peter AnvinApr 12, 2016
  4. Jeff KingApr 12, 2016
  5. David TurnerApr 12, 2016
  6. Jeff KingApr 12, 2016
  7. Theodore Ts'oApr 14, 2016
  8. Joey HessApr 14, 2016
  9. David TurnerApr 14, 2016
  10. H. Peter AnvinApr 14, 2016
  11. Theodore Ts'oApr 14, 2016
  12. Jeff KingApr 15, 2016
  13. Junio C HamanoApr 15, 2016
  14. Jeff KingApr 15, 2016
  15. Jeff KingApr 12, 2016
  16. Junio C HamanoApr 13, 2016
  17. Jeff KingApr 13, 2016
  18. H. Peter AnvinApr 13, 2016
  19. Duy NguyenApr 13, 2016
  20. H. Peter AnvinApr 13, 2016
  21. brian m. carlsonApr 15, 2016

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.