From: Duy Nguyen Date: Tue, 25 Nov 2014 01:16:15 GMT Subject: Re: How safe are signed git tags? Only as safe as SHA-1 or somehow safer? Message-ID: In-Reply-To: On Tue, Nov 25, 2014 at 1:14 AM, Nico Williams wrote: > Is there a plan for upgrading to a better hash function in the future? > (E.g., should it become an urgent need.) > > What are the roadblocks to adoption of a replacement hash function? > Just documenting this would go a long way towards making it possible > to upgrade some day. The biggest obstacle is the assumption of SHA-1 everywhere in the source code (e.g. assume the object name always takes 20 bytes). Brian started on cleaning that up [1] but I think it's stalled. Then we need to deal with upgrade path for SHA-1 repos. [1] http://thread.gmane.org/gmane.comp.version-control.git/248054 -- Duy