Re: [PATCH 10/10] Enable SHA-256 by default in breaking changes mode

From: Patrick Steinhardt <ps@pks.im>
Date: Jul 1, 2025, 11:35 UTC
Message-ID: <aGPIEHG8e0i9nzxV@pks.im>
In-Reply-To: <20250620011943.586596-11-sandals@crustytoothpaste.net>

On Fri, Jun 20, 2025 at 01:19:42AM +0000, brian m. carlson wrote:

Show 7 quoted lines

> Our document on breaking changes indicates that we intend to default to
> SHA-256 in Git 3.0.  Since most people choose the default option, this
> is an important security upgrade to our defaults.
> 
> To allow people to test this case, when WITH_BREAKING_CHANGES is set in
> the configuration, build Git with SHA-256 as the default hash.  Update
> the testsuite to reflect this configuration so that the tests pass.

Awesome. Thanks for advancing our migration towards SHA256!

Show 15 quoted lines

> diff --git a/t/test-lib.sh b/t/test-lib.sh
> index ef3759ec80..bb18dd0606 100644
> --- a/t/test-lib.sh
> +++ b/t/test-lib.sh
> @@ -536,7 +536,12 @@ export GIT_COMMITTER_EMAIL GIT_COMMITTER_NAME
>  export GIT_COMMITTER_DATE GIT_AUTHOR_DATE
>  export EDITOR
>  
> -GIT_TEST_BUILTIN_HASH=sha1
> +if test -n "$WITH_BREAKING_CHANGES"
> +then
> +	GIT_TEST_BUILTIN_HASH=sha256
> +else
> +	GIT_TEST_BUILTIN_HASH=sha1
> +fi

There should probably be an option somewhere in Git to ask it what its current builtin hash is. If so, you wouldn't have to hardcode the hash over here but could ask for example `git version --builtin-hash`.

Patrick