git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: About git and the use of SHA-1

From
Russ Dill <russ.dill@gmail.com>
Date
Apr 29, 2008, 16:21 UTC
Message-ID
<f9d2a5e10804290921y5c961fc5g88d718c40a5ff037@mail.gmail.com>
In-Reply-To
<481718AF.8090000@docte.hr>

On Tue, Apr 29, 2008 at 5:46 AM, Jurko Gospodnetić <jurko.gospodnetic@docte.hr> wrote:

Show 13 quoted lines
>
> > I think you are missing the point. One of the pluses behind originally
> > using SHA-1 and the signed tags is that the system as a whole is
> > cryptographically secure. You can verify from the public key of
> > whoever made the tag that yes, this really is the source and history
> > they tagged.
> >
>
>   I am not really sure I follow this.... how can you 'verify from the public
> key of whoever made the tag' that the SHA-1 hash is correct!? SHA-1 does not
> have anything do with any externally provided keys or have I managed to get
> something confused here?
>

Sorry for the confusion, its about using the signed tag and the SHA-1 of the parent commits, along with their associated trees and blobs to verify the source and history. If you can't trust the signed tag, or all of the SHA-1's, you can't trust the source and history.

However, as many said, I don't think there is any reason to not trust SHA-1 is the context of source control.

Previous: Jurko GospodnetićNext: Geoffrey Irving
Message 15 of 38 in “About git and the use of SHA-1”
  1. Henrik AustadApr 28, 2008
  2. Daniel BarkalowApr 28, 2008
  3. Henrik AustadApr 28, 2008
  4. Daniel BarkalowApr 28, 2008
  5. Andreas EricssonApr 29, 2008
  6. Russ DillApr 29, 2008
  7. Andreas EricssonApr 29, 2008
  8. Sverre RabbelierApr 29, 2008
  9. Andreas EricssonApr 29, 2008
  10. Paolo BonziniApr 29, 2008
  11. Andreas EricssonApr 29, 2008
  12. Paolo BonziniApr 29, 2008
  13. Russ DillApr 29, 2008
  14. Jurko GospodnetićApr 29, 2008
  15. Russ DillApr 29, 2008
  16. Geoffrey IrvingApr 29, 2008
  17. Daniel BarkalowApr 29, 2008
  18. Dmitry PotapovApr 29, 2008
  19. Andreas EricssonApr 29, 2008
  20. Nicolas PitreApr 29, 2008
  21. Geoffrey IrvingApr 29, 2008
  22. Nicolas PitreApr 29, 2008
  23. Geoffrey IrvingApr 29, 2008
  24. Nicolas PitreApr 29, 2008
  25. Geoffrey IrvingApr 29, 2008
  26. Daniel BarkalowApr 29, 2008
  27. Geoffrey IrvingApr 29, 2008
  28. Fredrik SkolmliApr 29, 2008
  29. Geoffrey IrvingApr 29, 2008
  30. Fredrik SkolmliApr 29, 2008
  31. Martin LanghoffApr 30, 2008
  32. Geoffrey IrvingApr 30, 2008
  33. David BrownApr 30, 2008
  34. Martin LanghoffApr 30, 2008
  35. Matthieu MoyApr 29, 2008
  36. Fredrik SkolmliApr 29, 2008
  37. Tom WidmerApr 29, 2008
  38. Tom WidmerApr 29, 2008

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.