4 ms·

Thanks, I forgot that git got that wrong :/ Edit: Actually, looking at the code (do_sign_commit), git appears to gpg sign the whole commit object. I think it'

by joeyh 11y ago

Thanks, I forgot that git got that wrong :/ Edit: Actually, looking at the code (do_sign_commit), git appears to gpg sign the whole commit object. I think it's in signed tags where git only signs the sha1 being tagged.

agwa 11y ago
Yeah, I just emerged from the Git code myself ;-) So you're correct that GPG-signing commits (but not tags) prevents collisions in commit objects. The problem though is that a commit ultimately contains a SHA-1 hash of a tree object, so now the concern is someone generating colliding tree objects. Edit: fortunately, the format of tree objects looks pretty rigid. I feel somewhat reassured, but only somewhat.
- joeyh 11y ago
  http://joeyh.name/blog/entry/size_of_the_git_sha1_collision_attack_surface/ http://joeyh.name/blog/entry/size_of_the_git_sha1_collision_... has some discussion of colliding tree objects.