git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: [PATCH 0/5] core: update our SHA-1 docs, use sha1collisiondetection on OSX too

From
Junio C Hamano <gitster@pobox.com>
Date
Apr 22, 2022, 18:56 UTC
Message-ID
<xmqqv8v17xrl.fsf@gitster.g>
In-Reply-To
<cover-0.5-00000000000-20220422T094624Z-avarab@gmail.com>
Ævar Arnfjörð Bjarmason  <avarab@gmail.com> writes:
Show 23 quoted lines
> I wasn't able to find any on-list references to it being intentional,
> but it appears that while we made the sha1collisiondetection variant
> of SHA-1 the default in early 2017 we've never updated the OSX builds
> to do likewise.
>
> I don't know what various git packages for OSX to, but our vanilla OSX
> distribution definitely uses Apple Common Crypto, and won't detect the
> https://shattered.io attack.
>
> This series changes that, and while doing so in 2/5 updates our
> documentation and Makefile interface for the SHA-1 selection. Our
> INSTALL file was still claiming we used OpenSSL's SHA-1 by default.
>
> Then since we'd made sha1collisiondetection the default we hadn't
> changed the code's default fallback to be that, it was still
> block-sha1. Now our fallback behavior is "error" instead, which makes
> it less likely that we'll get some foot-gun like the "OSX not using
> sha1collisiondetection" again.
>
> The 4/5 and 5/5 then remove the PPC_SHA1 implementation. I submitted
> this before as [1], and the range-diff is to that submission (it
> wasn't picked up). I think it makes sense as part of this general
> SHA-1 cleanup.
Thanks for this effort.

I'd like to see somebody with "building Git for distributing to macOS" background to comment (I am assuming that the mailing list git-packagers@googlegroups.com is the way to reach them).

Previous: Ævar Arnfjörð BjarmasonNext: Ævar Arnfjörð Bjarmason
Message 7 of 55 in “core: update our SHA-1 docs, use sha1collisiondetection on OSX too”
  1. 0/5 core: update our SHA-1 docs, use sha1collisiondetection on OSX tooÆvar Arnfjörð Bjarmason, Apr 22, 2022
  2. 1/5 Makefile: create and use sections for "define" flag listingÆvar Arnfjörð Bjarmason, Apr 22, 2022
  3. 3/5 Makefile: rephrase the discussion of *_SHA1 knobsÆvar Arnfjörð Bjarmason, Apr 22, 2022
  4. 5/5 Makefile: use $(OBJECTS) instead of $(C_OBJ)Ævar Arnfjörð Bjarmason, Apr 22, 2022
  5. 2/5 Makefile: really use and document sha1collisiondetection by defaultÆvar Arnfjörð Bjarmason, Apr 22, 2022
  6. 4/5 Makefile + hash.h: remove PPC_SHA1 implementationÆvar Arnfjörð Bjarmason, Apr 22, 2022
  7. Junio C HamanoApr 22, 2022
  8. Ævar Arnfjörð BjarmasonMay 19, 2022
  9. Ævar Arnfjörð BjarmasonMay 26, 2022
  10. 0/4 core: update our SHA-1 docs, use sha1collisiondetection on OSX tooÆvar Arnfjörð Bjarmason, Oct 19, 2022
  11. 1/4 fsmonitor OSX: compile with DC_SHA1=YesPleaseÆvar Arnfjörð Bjarmason, Oct 19, 2022
  12. 3/4 Makefile: really use and document sha1collisiondetection by defaultÆvar Arnfjörð Bjarmason, Oct 19, 2022
  13. Eric SunshineOct 19, 2022
  14. Junio C HamanoOct 19, 2022
  15. Ævar Arnfjörð BjarmasonOct 19, 2022
  16. Junio C HamanoOct 19, 2022
  17. Junio C HamanoOct 19, 2022
  18. Junio C HamanoOct 19, 2022
  19. brian m. carlsonOct 20, 2022
  20. 4/4 Makefile: rephrase the discussion of *_SHA1 knobsÆvar Arnfjörð Bjarmason, Oct 19, 2022
  21. 2/4 Makefile: create and use sections for "define" flag listingÆvar Arnfjörð Bjarmason, Oct 19, 2022
  22. 0/9 Makefile & docs: document SHA-{1,256} behavior, fix bugÆvar Arnfjörð Bjarmason, Oct 20, 2022
  23. 1/9 Makefile: always (re)set DC_SHA1 on fallbackÆvar Arnfjörð Bjarmason, Oct 20, 2022
  24. 2/9 INSTALL: remove discussion of SHA-1 backendsÆvar Arnfjörð Bjarmason, Oct 20, 2022
  25. 3/9 Makefile: correct DC_SHA1 documentationÆvar Arnfjörð Bjarmason, Oct 20, 2022
  26. 5/9 Makefile: rephrase the discussion of *_SHA1 knobsÆvar Arnfjörð Bjarmason, Oct 20, 2022
  27. 6/9 Makefile: document default SHA-256 backendÆvar Arnfjörð Bjarmason, Oct 20, 2022
  28. 7/9 Makefile: document SHA-1 and SHA-256 default and selection orderÆvar Arnfjörð Bjarmason, Oct 20, 2022
  29. Eric SunshineOct 20, 2022
  30. 4/9 Makefile: create and use sections for "define" flag listingÆvar Arnfjörð Bjarmason, Oct 20, 2022
  31. 8/9 Makefile: document default SHA-1 backend on OSXÆvar Arnfjörð Bjarmason, Oct 20, 2022
  32. Eric SunshineOct 20, 2022
  33. 9/9 Makefile: discuss SHAttered in *_SHA{1,256} discussionÆvar Arnfjörð Bjarmason, Oct 20, 2022
  34. 0/9 Makefile & docs: document SHA-{1,256} behavior, fix bugÆvar Arnfjörð Bjarmason, Oct 26, 2022
  35. 1/9 Makefile: always (re)set DC_SHA1 on fallbackÆvar Arnfjörð Bjarmason, Oct 26, 2022
  36. 2/9 INSTALL: remove discussion of SHA-1 backendsÆvar Arnfjörð Bjarmason, Oct 26, 2022
  37. 3/9 Makefile: correct DC_SHA1 documentationÆvar Arnfjörð Bjarmason, Oct 26, 2022
  38. 5/9 Makefile: rephrase the discussion of *_SHA1 knobsÆvar Arnfjörð Bjarmason, Oct 26, 2022
  39. 6/9 Makefile: document default SHA-256 backendÆvar Arnfjörð Bjarmason, Oct 26, 2022
  40. 7/9 Makefile: document SHA-1 and SHA-256 default and selection orderÆvar Arnfjörð Bjarmason, Oct 26, 2022
  41. Junio C HamanoOct 26, 2022
  42. 4/9 Makefile: create and use sections for "define" flag listingÆvar Arnfjörð Bjarmason, Oct 26, 2022
  43. 8/9 Makefile: document default SHA-1 backend on OSXÆvar Arnfjörð Bjarmason, Oct 26, 2022
  44. 9/9 Makefile: discuss SHAttered in *_SHA{1,256} discussionÆvar Arnfjörð Bjarmason, Oct 26, 2022
  45. 00/10 Makefile, docs & code: document & fix SHA-{1,256} selection behaviorÆvar Arnfjörð Bjarmason, Nov 7, 2022
  46. 01/10 Makefile: always (re)set DC_SHA1 on fallbackÆvar Arnfjörð Bjarmason, Nov 7, 2022
  47. 02/10 INSTALL: remove discussion of SHA-1 backendsÆvar Arnfjörð Bjarmason, Nov 7, 2022
  48. 03/10 Makefile: correct DC_SHA1 documentationÆvar Arnfjörð Bjarmason, Nov 7, 2022
  49. 06/10 Makefile: document default SHA-256 backendÆvar Arnfjörð Bjarmason, Nov 7, 2022
  50. 05/10 Makefile: rephrase the discussion of *_SHA1 knobsÆvar Arnfjörð Bjarmason, Nov 7, 2022
  51. 07/10 Makefile: document SHA-1 and SHA-256 default and selection orderÆvar Arnfjörð Bjarmason, Nov 7, 2022
  52. 04/10 Makefile: create and use sections for "define" flag listingÆvar Arnfjörð Bjarmason, Nov 7, 2022
  53. 08/10 Makefile & test-tool: replace "DC_SHA1" variable with a "define"Ævar Arnfjörð Bjarmason, Nov 7, 2022
  54. 09/10 Makefile: document default SHA-1 backend on OSXÆvar Arnfjörð Bjarmason, Nov 7, 2022
  55. 10/10 Makefile: discuss SHAttered in *_SHA{1,256} discussionÆvar Arnfjörð Bjarmason, Nov 7, 2022

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.