Re:Git 3.0's upcoming SHA-256 default will be a costly mistake
by hinkley on Friday October 02, 2026 @04:50AM
(#49931300)
You do understand that most code signing is just PKI over the top of SHA hashes, right?
The only substantial difference is that the author vouched for these particular snapshots of code, in a way where nobody else can intercept the communication and substitute a completely different hash than one the author previously signed.
In fact if you can find a SHA collision, you can peal the signature off of the legitimate payload and slap it on the colliding one.
The only substantial difference is that the author vouched for these particular snapshots of code, in a way where nobody else can intercept the communication and substitute a completely different hash than one the author previously signed.
In fact if you can find a SHA collision, you can peal the signature off of the legitimate payload and slap it on the colliding one.