3 ms·
GPG does not require SHA1 so you can enfore SHA-2 for example.
by acveilleux 11y ago
GPG does not require SHA1 so you can enfore SHA-2 for example.
- agwa 11y agoGPG can use SHA-2, but the way that GPG signing works in Git is that you essentially GPG-sign the SHA-1 hash of a Git object. So even if GPG is using SHA-2 for its signature, it's no protection against a collision in one of the underlying Git object IDs. Edit: this is only true of tag signing - with commit signing you GPG-sign the whole commit object.