Re: [PATCH v2 1/2] help: include SHA implementation in version info

From: Justin Tobler <jltobler@gmail.com>
Date: Apr 2, 2025, 14:56 UTC
Message-ID: <rqytnnncju5pezkfidhd7u7vtaaop5fga7f5nyzwa74eiksezs@4t46ypevaiga>
In-Reply-To: <CAP8UFD2UpEpqBYxqeo=vkDHwWdoO9v2RPVtnUBSOUS5MOK6n0Q@mail.gmail.com>

On 25/04/02 01:26PM, Christian Couder wrote:

Show 32 quoted lines

> On Wed, Apr 2, 2025 at 9:38 AM Patrick Steinhardt <ps@pks.im> wrote:
> >
> > On Tue, Apr 01, 2025 at 03:36:29PM -0500, Justin Tobler wrote:
> > > diff --git a/Documentation/git-version.adoc b/Documentation/git-version.adoc
> > > index 80fa7754a6..f06758a7cf 100644
> > > --- a/Documentation/git-version.adoc
> > > +++ b/Documentation/git-version.adoc
> > > @@ -22,6 +22,9 @@ OPTIONS
> > >  --build-options::
> > >       Include additional information about how git was built for diagnostic
> > >       purposes.
> > > ++
> > > +Note that the SHA1 options `SHA1_APPLE`, `SHA1_OPENSSL`, and `SHA1_BLK` do not
> > > +have collision detection.
> >
> > I think this note is somewhat funny for an unsuspecting reader. On the
> > one hand they're going to be puzzled why you're talking about SHA1 in
> > the first place because it isn't mentioned at all beforehand. And on the
> > other hand they will wonder what collision detection even is in the
> > first place.
> >
> > So I would either drop this paragraph completely or expand it to give a
> > bit more context.
> 
> Yeah, I think it's worth giving more information, like perhaps:
> 
> "For the libraries used to implement the SHA-1 and SHA-2 algorithms
> only symbolic information, like `SHA-1: SHA1_APPLE` or `SHA-256:
> SHA256_NETTLE` is displayed. Note that the SHA1 options `SHA1_APPLE`,
> `SHA1_OPENSSL`, and `SHA1_BLK` mean that no collision detection
> algorithm is used, so known SHA-1 attacks might be possible, see
> https://en.wikipedia.org/wiki/SHA-1."

Ya the documentation here should be expanded to provide some more context. I'll adapt in my next version to something like this:

"The libraries used to implement the SHA-1 and SHA-256 algorithms are displayed in the form `SHA-1: <option>` and `SHA-256: <option>` respectively. Note that the SHA-1 options `SHA1_APPLE`, `SHA1_OPENSSL`, and `SHA1_BLK` do not use a collision detection algorithm and thus may be vulnerable to known SHA-1 collision attacks."

-Justin