Re:SHA-1 'fully and practically broken' by new collision (2020)
by sverhagen on Tuesday October 12, 2021 @06:37PM
(#28845972)
If you can force push, why would you then not push a different commit before pushing your updated commit with the same, original hash, or does that also not work?
Re:SHA-1 'fully and practically broken' by new collision (2020)
by DSMan195276 on Tuesday October 12, 2021 @07:06PM
(#28846211)
I wouldn't expect that to work reliably because git doesn't actively remove unused objects from the store, hence why you can do `git reflog` to go find stuff that's not actually referenced anywhere anymore. `git gc` is necessary to make them actually go away, and whether that ever happens and how often is up to the server. I know for example that Github practically never does it, and even if it did happen it would be hard to reliably ensure no references to the relevant object still exist anywhere on the server. For example, you would have to force push every branch on the server that references the object, and if the git server creates branches for internal use you might not be able to touch those or convince the server the object is unused. And even if all the references are gone if the object is never actually deleted from the server then it should just get used again if you try to do a `git push`.
What you could do however is just host it yourself somewhere else, say put it on a fork. Or if you have access to the actual repository hosting the original version, you could just manually replace it yourself. git clients aren't going to just automatically pull the "new" version though so you'll have some combo of people with the old and people with the new, and it gets a little messier from there.