What does a PGP signature on a Git commit prove?

Re:What does a PGP signature on a Git commit prove? by gavindean90 on Wednesday March 31, 2021 @12:27AM (#26643524)

SHA1 wasn’t meant to be a security measure but as far as I know no one has been able to generate a collision that could fool a code review.

> Just replacing an object in a repository is not enough; the attacker would have to find a way to distribute that object to other repositories around the world, which is not an easy task. The colliding object would have to function as C source (if the kernel were the target of attack here), and would have to stand up to a casual inspection — it would have to look like proper kernel source. https://lwn.net/Articles/715716/

[ Parent | on HN ]

Re:What does a PGP signature on a Git commit prove? by petertodd on Wednesday March 31, 2021 @05:00AM (#26644990)

Regardless of whether or not SHA1 was meant to be a security measure, it should have been. Linus's original thinking re: git security is much less useful than just having a secure hash function that you can rely on.

[ Parent | on HN ]

Re:What does a PGP signature on a Git commit prove? by ganafagol on Wednesday March 31, 2021 @03:28AM (#26644425)

> SHA1 wasn’t meant to be a security measure

It literally stands for Secure Hashing Algorithm.

[ Parent | on HN ]

Re:What does a PGP signature on a Git commit prove? by detaro on Wednesday March 31, 2021 @03:29AM (#26644433)

presumably the mean that the use of SHA1 in git wasn't meant to be a security measure.

[ Parent | on HN ]