On Sat, Sep 20, 2014 at 4:40 PM, Ulrich Mueller <[email protected]> wrote: >>>>>> On Sat, 20 Sep 2014, hasufell wrote: > >>> Have these plans been abandoned, and are we now planning to >>> distribute the tree to users via Git, where everything goes through >>> the bottleneck of a SHA-1 sum, which was never intended as a >>> security feature? > >> This is a bug in git. Do you want us to wait until it is resolved? > > Not a bug. There are VCSs (like Subversion or Bazaar) that use simple > revision numbers to identify their commits. Git happens to use a hash, > which is perfectly fine as long as accidental collisions are unlikely. > Neither has to do anything with security, though. >
Sure, but in that case why add gpg signatures to git at all? I think that just like Gentoo this is just the nature of FOSS - everybody has their opinion of what everything is supposed to do, and the only thing that really matters is what it can actually do and who writes code to get it to do something different. If Linus felt that git needed gpg signatures he'd have added them back in the beginning (for commits, not tags). Somebody else felt differently, and added them later, but did not address the hash issue. Maybe sometime down the road we'll see support for a different hash functions added, or some other workaround. All it would take is for somebody to write the code and support it seriously (either as part of git or a fork). But, I doubt anybody here wants to maintain that fork, so we're left with what we have now, which is a git which accepts signatures, but those signatures are only bound to code by sha1. With FOSS what is and isn't a bug is up to whoever wants to write the code to fix it, or pay somebody else to write it for them. -- Rich
