4 ms·
>b. A SHA256 repository can communicate with SHA-1 Git servers and clients (push/fetch). Wouldn't fetching from a sha-1 repository degrade security? I think it
by snakeanus 10y ago
>b. A SHA256 repository can communicate with SHA-1 Git servers and clients (push/fetch).
Wouldn't fetching from a sha-1 repository degrade security? I think it would be better to show a warning (similar to how openssh does with 1024 bit dsa keys) every time you try to fetch from a SHA-1 git repo.
Same for pushing a signed commit to a sha-1 repository.
- bhhaskin 10y agoThe sha1 hash isn't used for security. You should be signing your commits if security is a concern.
- nshepperd 10y agoUh, even a signed commit does still rely on the sha1 hash of the actual tree object and any parent commits. It won't stop something bad from happening if you fetch from a sha1 repo.