3 ms·
But commit signatures are actually just signing the SHA1 hash. So you still have the problem that you could just reuse the signature for the valid commit with t
by cyphar 10y ago
But commit signatures are actually just signing the SHA1 hash. So you still have the problem that you could just reuse the signature for the valid commit with the malicious one.
- BrailleHunting 10y agoThen git also needs to change, but the process as above for github and others is still correct. 0. Upgrade to SHA3/Keccak, eventually make SHA1 a read-only legacy feature. 1. Upgrade signing to sign blobs and sign signatures for non-blobs instead of signing refs.