Re: General Resolution to deploy tag2upload

On Fri, Jul 05, 2024 at 07:30:50AM +0800, Sean Whitton wrote: > > I hereby withdraw this General Resolution, given: Hi, The 24 hour period has passed, so I now consider this withdrawn. Kurt

Re: Sha1 is not exactly secure

Adam Majer writes: > On the other hand, if you are going to put any sort of trust into the > system, it's impossible to trust SHA1. It's being phased out in all > forms[1]. Currently, it takes about $50k to get a collision AFAIK. Is that a collision against generic SHA1, or a collision against S

Sha1 is not exactly secure

Hi, I admittedly did not go so far as to track down test objects with the same SHA-1 hash and construct an experiment. But I couldn't see any way where git fsck could *not* detect this problem unless I'm wrong that it recalculates all the hashes, and I'm fairly sure I'm not wrong about that.