Re:Git 3.0's upcoming SHA-256 default will be a costly mistake
by kazinator on Thursday October 01, 2026 @06:35PM
(#49927876)
I understand that if we sign a commit with the help of some arbitrarily strong hash, it doesn't protect the parent commit(s). The integrity of the SHA-1 hash references to the parent commits is not in question, but the authenticity of those commits themselves.
[ Parent
| on HN ]
Re:Git 3.0's upcoming SHA-256 default will be a costly mistake
by orf on Thursday October 01, 2026 @06:50PM
(#49927974)
No, not the abstract tree formed by a series of commits.
The actual git ‘tree’ object, which is the thing a commit actually points to, referenced by a hash in the commit. That is signed by the GPG signature.
Re:Git 3.0's upcoming SHA-256 default will be a costly mistake
by Borealid on Friday October 02, 2026 @03:51AM
(#49930942)
Correct. The content of the git `tree` is partially controlled by the attacker because filenames in the repository are part of it. So if it's feasible to manufacture a generic hash collision it MAY (not MUST) be feasible to generate two colliding `tree` objects.