From: Michal Suchánek <msuchanek@suse.de>
Date: Tue, 07 Oct 2025 10:36:47 GMT
Subject: Re: When should we release Git 3.0?
Message-ID: <aOTtPxsdzJLPCruk@kitsune.suse.cz>
In-Reply-To: <aOTrC8CRZm5hERgr@pks.im>

On Tue, Oct 07, 2025 at 12:27:23PM +0200, Patrick Steinhardt wrote:
> On Thu, Oct 02, 2025 at 06:10:22PM +0200, Michal Suchánek wrote:
> > On Thu, Oct 02, 2025 at 08:32:38AM -0700, Junio C Hamano wrote:
> > > Patrick Steinhardt <ps@pks.im> writes:
> > > 
> > > > Once we have roadmaps, we should set a strict deadline that takes them
> > > > into account. Any hosting provider or implementation of Git that doesn't
> > > > provide a roadmap will not be taken into account in our planning.
> > > 
> > > Works fine as long as we assume everybody that matters will
> > > eventually want to move away from SHA-1.
> > > 
> > >  - If a stakeholder gives a roadmap that has no SHA-256 in their
> > >    future, in other words, if they are content to serve only the
> > >    SHA-1 projects, what's the impact to them?  We are not dropping
> > >    the support for SHA-1 in the sense that if you clone from an
> > >    existing SHA-1 repository you'll get an SHA-1 repository and you
> > >    can push and fetch between them just fine, so presumably that is
> > >    fine as well.
> > > 
> > >  - If a stakeholder gives a roadmap with SHA-256 so far into the
> > >    future that we cannot wait, what's the impact to them?  Their
> > >    customers that want SHA-256 earlier than they can supply could
> > >    move to other hosting or implementation, but not really.  Both
> > 
> > I suppose that's already the case to some extent. git does support
> > sha256, some forges do as well, and some people want it to the point
> > that they install such forge, and create the sha256 repositories
> > although it is not the default.
> > 
> > There is some tradeoff here. When it's nice to have but not required
> > people will use it when convenient. When it's really required people
> > will use even an obscure implementation to get the requested feature.
> 
> True. In any case, I think that for now we should just wait how such
> roadmaps would look like and then discuss based on the findings.
> 
> The question of course is how to get such roadmaps. The easiest way to
> do it is probably to gather a list of known projects that would be
> impacted and just shoot maintainers or representatives of those an
> email? From the top of my head, that would include:
> 
>   - Implementations
>       - libgit2
          - pygit2
>       - JGit
>       - Gitoxide
>       - go-git
>   - Forges
>       - GitHub
>       - GitLab
>       - Bitbucket
>       - Forgejo
        - Gitea
>       - SourceHut

Thanks

Michal