From: Johannes Schindelin <johannes.schindelin@gmx.de>
Date: Mon, 18 Jul 2016 07:12:29 GMT
Subject: Re: Git and SHA-1 security (again)
Message-ID: <alpine.DEB.2.20.1607180905320.28832@virtualbox>
In-Reply-To: <1468804249.2037.0@smtp.gmail.com>

Hi Zsolt,

On Mon, 18 Jul 2016, Herczeg Zsolt wrote:

> I think converting is a much better option. Use a single-hash storage, and
> convert everything to that on import/clone/pull.

That ignores two very important issues that I already had mentioned:

- existing references, both in-repository, e.g. in commit messages
  referring to earlier commits, as well as out-of-repository, e.g.
  referring to commits in mails, blog posts, etc

- GPG-signed commits

Those issues cannot just be hand-waved away.

The "convert everything" strategy also ignores the problem of interacting
with servers and collaborators. Think of hosting repositories,
rediscovering forgotten work trees, and of the "D" in DSCM.

Ciao,
Johannes