4 ms·

I really feel like git having a secure package identifier built in is the right answer. I haven't heard any news of git moving to SHA3-256. Why shouldn't this

• craftyguy 9y ago
  > I really feel like git having a secure package identifier built in is the right answer. git commits can be gpg signed: https://git-scm.com/book/id/v2/Git-Tools-Signing-Your-Work https://git-scm.com/book/id/v2/Git-Tools-Signing-Your-Work
  • Zamicol 9y ago
    I would never use that. It uses SHA1. The problem is the hash, not the signing. A secure package identifier doesn't necessarily need to be signed. Conversely, you must have a decent hash algorithm. Your mentioned method signs the git commit hash. A signature is only as good as the hash you use, and SHA1 is not suitable. https://blog.thoughtram.io/git/2014/11/18/the-anatomy-of-a-git-commit.html https://blog.thoughtram.io/git/2014/11/18/the-anatomy-of-a-g... Also see https://github.com/git/git/commit/721cc4314cb593e799213ad5f926a1e9fc5779b0 https://github.com/git/git/commit/721cc4314cb593e799213ad5f9...
    • Shoothe 9y ago
      What do you mean by "secure package identifier"? Do you mean commit hash using strong hashing function or something else?