l
Shared in Technology@lemmy.world 22 days ago
Git 3.0's upcoming SHA-256 default will be a costly mistake - gitbutler.com
Linked to https://blog.gitbutler.com/git-3-sha-256
0/2000
M
Mihies@programming.dev 22 days ago
The root problem is that there is no backward compatibility - you can’t mix the two. Why is that is beyond me.
exu@feditown.com 22 days ago
There’s apparently work going on to have on the fly translations between SHA-1 and SHA-256 as necessary
D
DomeGuy@lemmy.world 22 days ago
I read that whole article, and aside from an unsourced statement that GitHub et al will need “new and distinct servers” exactly zero of that seemed to support the thesis that a SHA-256 default was going to be “expensive”.
Submodules are not the preferred way to incorporate third-party code for any environment I know. And while web-exposed URLs for management tools like Jira or AzureDevOps will need to adapt before the new default can be used, doing so even with a wholesale re-hashing of every commit isn’t technically difficult.
What would be terrible and dangerous would be if git 3.0 entirely dropped SHA-1 support. But just as you’re free to keep on using “master” instead of “main”, i expect that extant projects will still be supported until a version after every major project has converted to SHA-256 or what have you.
M
Mihies@programming.dev 22 days ago
Submodules are not the preferred way to incorporate third-party code for any environment I know. And while web-exposed URLs for management tools like Jira or AzureDevOps will need to adapt before the new default can be used, doing so even with a wholesale re-hashing of every commit isn’t technically difficult.
Well, like it or not, they are used. And not so rarely. Now, rehashing will probably work, but it will require every project to do that. If you use more than one submodule which is not under your control, you have again mixed hashes that you can’t fix easily.
D
DomeGuy@lemmy.world 22 days ago
Further reading that casts doubt on even submodules breaking:
deployhq.com/…/git-3-0-on-the-horizon-what-git-us…
It sounds like the new default is specifically to push GitHub et al to support SHA-256. Which they either will, or they will fork git and continue on with SHA-1 forever.