Git 3.0's upcoming SHA-256 default will be a costly mistake

Re:Git 3.0's upcoming SHA-256 default will be a costly mistake by knorker on Friday October 02, 2026 @09:58AM (#49933606)

Supposed to be or not, it is.

Package managers even use it. E.g. you can have a cargo dependency pointing to GitHub at a specific commit. It's definitely intended to provide end to end security without depending on GitHub being secure.

Also git submodules.

[ Parent | on HN ]

Re:Git 3.0's upcoming SHA-256 default will be a costly mistake by knorker on Friday October 02, 2026 @02:34PM (#49936949)

And I should add: not just github compromise, but supply chain / original author replacing the contents.

Absolutely the SHA-1 is treated as "authenticating". Cargo.lock (for regular crates.io dependencies) are confirmed using SHA-256.

[ Parent | on HN ]