Tag Info

New answers tagged

4

There is no contradiction. Linus himself sais in that same talk: If I have those 20 bytes, I can download a git repository from a completely untrusted source and I can guarantee that they did not do anything bad to it. I'd interpret the "Git uses SHA-1 not for security" as "SHA-1 hasn't been added to git for security reasons, but for reliability ...


3

Signed git tag is just a signed SHA1 checksum. Very simply said, every git commit is SHA1 checksum of the previous commit (which also contains SHA1 of its previous commit which also contains SHA1 checksum of its previous commit and so...). If you find a way, how to change something in a repository, keeping the SHA1 unchanged (you find a collision), then you ...



Top 50 recent answers are included