Gentoo Archives: gentoo-dev

From: Duy Nguyen <pclouds@×××××.com>
To: gentoo-dev@l.g.o
Subject: Re: [gentoo-dev] git security (SHA-1)
Date: Mon, 15 Sep 2014 22:52:58
Message-Id: CACsJy8B0QT9oJ9Kg=eUSGtJw62xT+SumdyV+KRrzfVPht4Srmg@mail.gmail.com
In Reply to: Re: [gentoo-dev] git security (SHA-1) by Duy Nguyen
1 On Tue, Sep 16, 2014 at 5:41 AM, Duy Nguyen <pclouds@×××××.com> wrote:
2 >> Even if you wanted to burn the money to find that magical collision that
3 >> actually contains working code, you've still got to somehow propagate that
4 >> to other repositories, since they'll just ignore it for having the same hash
5 >> as an already-existing object.
6 >
7 > In the fetch/pull case, if you receive the "same" object that you
8 > already have, git performs byte-to-byte comparison and warns loudly if
9 > the "new"object does not match yours.
10
11 Correction, in the push case as well. You have to find another way to
12 inject this collided object (perhaps via a server that is not C Git).
13 --
14 Duy