Re: SHA-256 transition

From: Ævar Arnfjörð Bjarmason <avarab@gmail.com>
Date: Jun 24, 2022, 01:19 UTC
Message-ID: <220624.867d56kg04.gmgdl@evledraar.gmail.com>
In-Reply-To: <12140906.O9o76ZdvQC@thunderbird>

On Thu, Jun 23 2022, Stephen Smith wrote:

Show 8 quoted lines

> On Thursday, June 23, 2022 3:21:05 PM MST Ævar Arnfjörð Bjarmason wrote:
>> Finally, I'd really like to thank you for all your work on SHA-256 so
>> far, and really hope that none of what I've said here is discouraging in
>> any way. This thread has received some attention outside this ML (on
>> LWN), so I wanted to clarify some of the points above. Thanks!
>
> I had looked on LWN before I started the thread to see if anything was being 
> discussed and it wasn't.

It wouldn't have helped, as I'm referring to LWN having written an article about this thread that you started :)

It's part of an ongoing series they've had about Git's SHA-256 transition.

Given how LWN makes money I don't know if it's OK to link to it, but it's easy enough to find and/or subscribe to LWN.

> I tend to be an early adopter.   I hadn't seen any new commits in the main git 
> repository in a while and was beginning to wonder if it had been abandoned.   
> This thread has convinced me that isn't the case, but the main person doing 
> the developing being busy.

It was a good discussion, and I'm happy you started it.

I think I've mentioned in some past discussions that it would be nice to have some "gitsecurity" user-facing documentation, and one thing such a thing could include is information that helped users to make an informed decision about how much (if at all) they should be worrying about issues arising from what hash they're using Git with.

But some documentation on the questions raised here would also be good, i.e. "should I use the new hash?", which we could keep somewhat up-to-date, and e.g. talk about the approximate state of major third-party software, such as the forges.

Currently the closest thing we have to that is the rather sparse and scary "THIS OPTION IS EXPERIMENTAL" in git-init(1) when talking about --object-format=sha256.

> I too want to say thank you (Brian) for your hard work.

And thank you for using & being interested in git, and contributing to the ML!