4 ms·
Regarding the collision attack replacement check, do you know if that is carried over into other git implementations (e.g. libgit2)?
by mvkg 4y ago
Regarding the collision attack replacement check, do you know if that is carried over into other git implementations (e.g. libgit2)?
- avar 4y agoI had to look, but in the case of libgit2 yes they have. Like git they have a way to select SHA-1 backends, and the default is the SHA1DC library. But, even supposing a libgit2 that didn't use SHA1DC I think most users would be protected in practice if the "git" they use used SHA1DC. Hosting providers, local editors etc. use libgit2 for a lot of things, but I think in most cases (certainly in the case of the popular hosting providers) it's some version of "/usr/bin/git" that's handling your push, and actually propagating your objects. For stopping a colliding hash it's enough that any part of the chain of propagation is able to stop it.