Hello, On Sat 30 Mar 2024 at 12:19pm +01, Simon Josefsson wrote:
> Relying on signed git tags is not reliable because git is primarily > SHA1-based which in 2019 cost $45K to do a collission attack for. We did some analysis on the SHA1 vulnerabilities and determined that they did not meaningfully affect dgit & tag2upload's design. -- Sean Whitton
signature.asc
Description: PGP signature
