Re: [RFC PATCH 0/4] sign a SHA-256 digest of the tree in commits and tags
- From
Patrick Steinhardt <ps@pks.im>
- Date
- Oct 5, 2026, 12:41 UTC
- Message-ID
- <asOa6dgpj0qV5QAU@pks.im>
- In-Reply-To
- <CAP2yMaKF4CRvtfTQDVe51SqEm_DnoVOmED5kcUSg7UvLkBp4Xg@mail.gmail.com>
On Mon, Oct 05, 2026 at 11:32:54AM +0200, Scott Chacon wrote:
> On Fri, Oct 2, 2026 at 9:06 PM brian m. carlson > <sandals@crustytoothpaste.net> wrote: > > On 2026-10-02 at 08:18:42, Scott Chacon wrote:
[snip]
Show 28 quoted lines
> > Every major forge has support > > for SHA-256, whether publicly or in preview, > > Nobody has access to this for GitHub, which is where almost all usage > is and where the kinks could theoretically have been ironed out. If > 3.0 comes out in March, there will have been no time for anyone to > give feedback or make substantial changes before everyone is forced > into real usage of this highly incompatible change. > > So Bitbucket doesn't, Gerrit doesn't, GitHub doesn't in any practical > sense (I'm curious if anyone on even this mailing list has access to > it's "preview"). GitLab has it under "experimental". I'm hesitant to > agree that Codeberg or whatever constitutes "every major forge". > > If anything, this is one of my biggest problems with this breaking > change proposal - it has not been tested in a real way by nearly > _anyone_, nor are major parts of the transistion plan > (compatObjectFormat, pack index v3, fetch/push compatibility, compat > sig verification, etc) fully implemented even a few months out from > the cutover. > > As one small but interesting example, I'm honestly fascinated that > there is only now a thread here about the GitHub specific usability > issues [2] with mixed odb repos (between several GitHub-y people, > nonetheless) that hasn't been previously considered (the "limbo" > idea). This is the kind of thing (among many others, I'm sure) that > would come up if people had time to use this at all before a default > switch.
The biggest problem I have is that the ecosystem has been entirely unwilling to do anything about the SHA-256 move before we announced that this is going to become mandatory. Only then were developers even able to convince anybody (especially those paying the wages) to get the time to implement support for it.
So there is some kind of ossification happening in the space. But things are finally moving now that the due-date is drawing closer. I would be extremely hesitant to change course again and drop this breaking change now that there finally is some movement. Because the only consequence of that would be that the ecosystem will stop working on it again. And even more so, I would even expect that this will make the next time we want to do a breaking change exponentially harder as the lesson learned is that nobody needs to do anything.
Maybe I'm too pessimistic about this, but I don't think so. We've been working on this whole transition for almost a decade by now, and only now where we're forcing the ecosystem to adapt are large players like GitHub even moving.
Patrick