2 ms·
> I really feel like git having a secure package identifier built in is the right answer. git commits can be gpg signed: https://git-scm.com/book/id/v2/Git-Too
by craftyguy 9y ago
> I really feel like git having a secure package identifier built in is the right answer.
git commits can be gpg signed: https://git-scm.com/book/id/v2/Git-Tools-Signing-Your-Work https://git-scm.com/book/id/v2/Git-Tools-Signing-Your-Work
- Zamicol 9y agoI would never use that. It uses SHA1. The problem is the hash, not the signing. A secure package identifier doesn't necessarily need to be signed. Conversely, you must have a decent hash algorithm. Your mentioned method signs the git commit hash. A signature is only as good as the hash you use, and SHA1 is not suitable. https://blog.thoughtram.io/git/2014/11/18/the-anatomy-of-a-git-commit.html https://blog.thoughtram.io/git/2014/11/18/the-anatomy-of-a-g... Also see https://github.com/git/git/commit/721cc4314cb593e799213ad5f926a1e9fc5779b0 https://github.com/git/git/commit/721cc4314cb593e799213ad5f9...
- Shoothe 9y agoWhat do you mean by "secure package identifier"? Do you mean commit hash using strong hashing function or something else?