You're right. Git really isn't crypto, and this news blurb does sound a bit odd. Hopefully this is just a misunderstanding in the reporting. Matching hashes is

You're right. Git really isn't crypto, and this news blurb does sound a bit odd. Hopefully this is just a misunderstanding in the reporting. Matching hashes is probably a pretty good sanity check, but it isn't the kind of solid guarantee that a project like OpenSSL needs. Fortunately, one great thing about decentralized source control systems is that everyone has a copy of everything. Hopefully someone has simply located a repository which hasn't been updated since before the breach, and done some direct comparisons.