3 ms·

I can't seem to use minisign with git, which is my main use for gpg.

• dependenttypes 6y ago
  Signing git commits is broken anyway as you are basically signing the commit hash (which is a sha1, whose collision resistance is broken).
  • cordite 6y ago
    I recall hearing github is planning on Sha-256 some time
    • some_furry 6y ago
      They're more likely to employ counter-cryptanalysis [1] in the meantime. [1] https://github.com/cr-marcstevens/sha1collisiondetection https://github.com/cr-marcstevens/sha1collisiondetection