News for hackers. Stuff that matters.

A comment on Linus' reply on Git and SHA-1 collision. Parent comment

Re:Linus' reply on Git and SHA-1 collision by perlgeek on Friday February 24, 2017 @12:30AM (#13721275)
> 1) Git doesn't rely on SHA-1 for security. It relies on HTTPS, and a web of trust.

I thought that if you signed your git commits or tags with GPG, you implicitly relied on the commit checksum, and thus on SHA1.

Is that right?

[ Parent | on HN ]
Re:Linus' reply on Git and SHA-1 collision by rocqua on Friday February 24, 2017 @04:03AM (#13722158)
That's what I read in the thread about the collision that was found.
[ Parent | on HN ]