Re: Git and SHA-1 security (again)

From: Johannes Schindelin <johannes.schindelin@gmx.de>
Date: Jul 18, 2016, 15:57 UTC
Message-ID: <alpine.DEB.2.20.1607181750470.3472@virtualbox>
In-Reply-To: <CAPp-Vran2GZFTyJHb2qxgh3uRpM0ar7K2+VbbLcBK74_7aaxVw@mail.gmail.com>

Hi Zsolt,

On Mon, 18 Jul 2016, Herczeg Zsolt wrote:

Show 13 quoted lines

> >> I think converting is a much better option. Use a single-hash
> >> storage, and convert everything to that on import/clone/pull.
> >
> > That ignores two very important issues that I already had mentioned:
> 
> That's not true. If you double-check the next part of my message, you I
> just showed that an automatic two-way mapping could solve these
> problems! (I even give briefs explanation how to handle referencing and
> signature verification in those cases.)
> 
> My point is not to throw out old hashes and break signatures. My point
> is to convert the data storage, and use mapping to resolve problems
> with those old hashes and signatures.

If you convert the data storage, then the SHA-1s listed in the commit objects will have to be rewritten, and then the GPG signature will not match anymore.

Call e.g. `git cat-file commit 44cc742a8ca17b9c279be4cc195a93a6ef7a320e` to see the anatomy of a gpg-signed commit object.

Ciao, Johannes