Re:SHA1 collisions make Git vulnerable to attacks
by baby on Monday February 27, 2017 @02:44PM
(#13747252)
Yeah, but in your case you would just get the binary, verify it and push it yourself.
If you're using some weird way of getting a binary that you have already verified, but that could somehow differ, and you're hopping that git will catch the difference, you're doing it wrong to begin with.
If you're using some weird way of getting a binary that you have already verified, but that could somehow differ, and you're hopping that git will catch the difference, you're doing it wrong to begin with.