3 ms·
Because while its difficult, I don't think its impossible to force a hash collision, making it theoretically possible to push malicious code that would look as
by jon-wood 11y ago
Because while its difficult, I don't think its impossible to force a hash collision, making it theoretically possible to push malicious code that would look as if it was the trusted version you want to use.
- pflanze 11y agoSigned Git tags reference the same hash (commit id) that you could pin against directly.