Re: [PATCH v5 2/4] BreakingChanges: document upcoming change from "sha1" to "sha256"

> Starting with 8e42eb0e9a (doc: sha256 is no longer experimental,
> 2023-07-31), the "sha256" object format is no longer considered to be
> experimental. Furthermore, the SHA-1 hash function is actively
> recommended against by for example NIST and FIPS 140-2, and attacks
> against it are becoming more practical both due to new weaknesses
> (SHAppening, SHAttered, Shambles) and due to the ever-increasing
> computing power. It is only a matter of time before it can be considered
> to be broken completely.
>
> Let's plan for this event by being active instead of waiting for it to
> happend and announce that the default object format is going to change
> from "sha1" to "sha256" with Git 3.0.
>
> All major Git implementations (libgit2, JGit, go-git) support the
> "sha256" object format and are thus prepared for this change. The most
> important missing piece in the puzzle is support in forges. But while
> GitLab recently gained experimental support for the "sha256" object
> format though, to the best of my knowledge GitHub doesn't support it
> yet. Ideally, announcing this upcoming change will encourage forges to
> start building that support.
>
> Signed-off-by: Patrick Steinhardt <ps@pks.im>
> ---
>  Documentation/BreakingChanges.txt | 24 ++++++++++++++++++++++++
>  1 file changed, 24 insertions(+)
>
> diff --git a/Documentation/BreakingChanges.txt b/Documentation/BreakingChanges.txt
> index ddce7cc301..904857a636 100644
> --- a/Documentation/BreakingChanges.txt
> +++ b/Documentation/BreakingChanges.txt
> @@ -61,6 +61,30 @@ be changed to or replaced in case the alternative was implemented already.
>  
>  === Changes
>  
> +* The default hash function for new repositories will be changed from "sha1"
> +  to "sha256". SHA-1 has been deprecated by NIST in 2011 and is nowadays
> +  recommended against in FIPS 140-2 and similar certifications. Furthermore,
> +  there are practical attacks on SHA-1 that weaken its cryptographic properties:
> ++
> +  ** The SHAppening (2015). The first demonstration of a practical attack
> +     against SHA-1 with 2^57 operations.
> +  ** SHAttered (2017). Generation of two valid PDF files with 2^63 operations.
> +  ** Birthday-Near-Collision (2019). This attack allows for chosen prefix
> +     attacks with 2^68 operations.
> +  ** Shambles (2020). This attack allows for chosen prefix attacks with 2^63
> +     operations.
> ++
> +While we have protections in place against known attacks, it is expected
> +that more attacks against SHA-1 will be found by future research. Paired
> +with the ever-growing capability of hardware, it is only a matter of time
> +before SHA-1 will be considered broken completely. We want to be prepared
> +and will thus change the default hash algorithm to "sha256" for newly
> +initialized repositories.
> ++
> +Cf. <2f5de416-04ba-c23d-1e0b-83bb655829a7@zombino.com>,
> +<20170223155046.e7nxivfwqqoprsqj@LykOS.localdomain>,
> +<CA+EOSBncr=4a4d8n9xS4FNehyebpmX8JiUwCsXD47EQDE+DiUQ@mail.gmail.com>.