News for hackers. Stuff that matters.

A comment on Git 3.0's upcoming SHA-256 default will be a costly mistake. Parent comment

Re:Git 3.0's upcoming SHA-256 default will be a costly mistake by orf on Thursday October 01, 2026 @06:50PM (#49927974)
No, not the abstract tree formed by a series of commits.

The actual git ‘tree’ object, which is the thing a commit actually points to, referenced by a hash in the commit. That is signed by the GPG signature.

[ Parent | on HN ]
Re:Git 3.0's upcoming SHA-256 default will be a costly mistake by Borealid on Friday October 02, 2026 @03:51AM (#49930942)
Correct. The content of the git `tree` is partially controlled by the attacker because filenames in the repository are part of it. So if it's feasible to manufacture a generic hash collision it MAY (not MUST) be feasible to generate two colliding `tree` objects.
[ Parent | on HN ]