Re: Gitorious should use CRC128 / 256 / 512 instead of SHA-1

From: Junio C Hamano <gitster@pobox.com>
Date: Jan 16, 2023, 15:06 UTC
Message-ID: <xmqqbkmyecym.fsf@gitster.g>
In-Reply-To: <85788356-14b1-6afb-c78c-0ab889bbbb59@selasky.org>

Hans Petter Selasky <hps@selasky.org> writes:

> From what I've read the GPLv3 goes pretty far to also provide flashing
> rights for software, but what use is that, when flashing the unsigned
> software on your Samsung phone, for example, some fuse breaks in the
> hardware, and then you can no longer use certain apps on your phone?

It smells that you are conflating the signing of source material and the sealing of tivoized hardware that use cryptographic signature to tell what binaries are allowed to run on it.

The signing implemented by the software we the Git development community build is not about the latter. The source used to build binaries for your tivoized hardware can come from a VCS that is deliberately designed to allow object name collisions, and your build would just be locked out the same unless you have the signing key that pleases the hardware. Use of Git there would not make the story any different, I am afraid.