From: Duy Nguyen Date: Mon, 24 Nov 2014 01:23:27 GMT Subject: Re: How safe are signed git tags? Only as safe as SHA-1 or somehow safer? Message-ID: In-Reply-To: <20141117212657.GC15880@peff.net> On Tue, Nov 18, 2014 at 4:26 AM, Jeff King wrote: > Yes, it is only as "safe as SHA-1" in the sense that you have GPG-signed > only a SHA-1 hash. If somebody can find a collision with a hash you have > signed, they can substitute the colliding data for the data you signed. I wonder if we can have an option to sign all blob content of the tree associated to a commit, and the content of parent commit(s). It's more expensive than signing just commit/tag content. But it's also safer without completely ditching SHA-1. -- Duy