Re: Git and SHA-1 security (again)

On Sat, Jul 16, 2016 at 11:46:06PM +0200, Herczeg Zsolt wrote:

There's been some recent discussion on the list about it. It is less on the Git project's list and more on my personal list. It's my hope that Junio and other contributors will decide to accept my patches when they are ready. Also, the plan is to keep SHA-1 available, probably as the default, for backwards compatibility.

The major work at this point is turning instances of unsigned char [20] into struct object_id, as well as converting hardcoded 20 and 40 (and derivative values) to GIT_SHA1_RAWSZ and GIT_SHA1_HEXSZ. This work allows us to make as little code as possible know about the size of the hash, as well as generally being easier to maintain.

You can look at the bc/cocci branch which was recently merged into next. (It doesn't exist independently outside of next, so you'll have to search through the history). That work is what in my branches is called object-id-part4. I'm currently working on getting to the point of converting get_tree_entry to use struct object_id, which is what will become my object-id-part5.

I recommend if you're planning on doing some of this work that you try to avoid areas which are under work by other developers, especially the refs code, which is undergoing massive changes. Other people will appreciate it.