4 ms·
Unless I'm missing something, why not just allow repositories to be upgraded to SHA2 hashes? The only problem is ensuring everyone's tooling supports it.
by velox_io 7y ago
Unless I'm missing something, why not just allow repositories to be upgraded to SHA2 hashes? The only problem is ensuring everyone's tooling supports it.
- majewsky 7y agoThis question is exactly what a major portion of the article covers.
- velox_io 7y agoIt isn't the easiest article to read, plus they over complicate things by talking about things such as truncating SHA2 hashes. I don't see why changing the hashing algorithm is so problematic, hence the reason why I asked the question. Converting a repository to SHA2 should be straight forward (the only issue is everyone's tooling), you could also run the repositories side-by-side. I'm genuinely interested as I think Git & Bittorrent are quite elegant solutions to complex problems.
- majewsky 7y ago> the only issue is everyone's tooling Exactly! If you've ever worked in a corporate environment, you know the fun of having to support 10-year-old versions of your favorite cutting-edge software.
- londons_explore 7y agoI don't think it's that unreasonable to release git binaries today with sha256 support, then wait 5 years, then make all new commits use sha256. Anyone who tries to use a git client more than 5 years old wouldn't be able to pull+push to a new repo. Sounds reasonable to me. Git clients more than a few years old are pretty broken already due to TLS changes. Keeping around a dual hash system forever sounds like baggage and complexity that outweighs the benefits.