News for hackers. Stuff that matters.

A comment on Linus' reply on Git and SHA-1 collision. Parent comment

Re:Linus' reply on Git and SHA-1 collision by lmm on Friday February 24, 2017 @05:02AM (#13722406)
Git has tag signing, surely there's a way to clone a specific tag and check the signature against a specific GPG key fingerprint?
[ Parent | on HN ]
Re:Linus' reply on Git and SHA-1 collision by nhaehnle on Friday February 24, 2017 @06:22AM (#13722689)
Tag signatures only cover the mapping from tag name to commit hash. In other words, specifying a manually-verified commit hash is actually more secure.

Tag signatures are mostly worthless now from a crypto point of view -- with the caveat that you can still get some value from them if you still trust sha1 to be secure against second-preimage attacks.

[ Parent | on HN ]
Re:Linus' reply on Git and SHA-1 collision by heartsucker on Friday February 24, 2017 @06:19AM (#13722678) 

    git checkout 0.1.0
    git tag -v 0.1.0
[ Parent | on HN ]