2 comments

  • KolmogorovComp59 minutes ago
    Does it mean that when switching trop sha1 to sha256 you need to forcepush and rewrite all history? Wouldn’t that be a massive source of potential vulnerabilities?
    • em-bee17 minutes ago
      i guess that for now only the default will change for new repositories. support for sha1 is not going to be dropped, so most existing repositories won't switch any time soon. if you want to switch then yes, it sounds like a force push might be needed, although it could also be that simply switching is not possible, but that instead you have to create a new repo and import the history from the old repo, forcing everyone to clone the new repo intentionally.
    • nomel57 minutes ago
      I don't know much about this. How does that enable vulnerabilities exactly?
      • jayd1654 minutes ago
        Trusting a forced push w/o any other verification means nefarious history changes can be slipped in.
        • wtfwhateven1 minute ago
          Semi-relevant-ish: <a href="https:&#x2F;&#x2F;blog.citp.princeton.edu&#x2F;2013&#x2F;10&#x2F;09&#x2F;the-linux-backdoor-attempt-of-2003&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.citp.princeton.edu&#x2F;2013&#x2F;10&#x2F;09&#x2F;the-linux-backdoo...</a>
  • WCSTombs1 hour ago
    `git add --resolved` is a wonderful idea, and definitely something I would start using.