Re: [gentoo-dev] Re: git security (SHA-1)

[Rich Freeman]

On Sat, Sep 20, 2014 at 4:40 PM, Ulrich Mueller <ulm@g.o> wrote:
>>>>>> On Sat, 20 Sep 2014, hasufell  wrote:
>
>>> Have these plans been abandoned, and are we now planning to
>>> distribute the tree to users via Git, where everything goes through
>>> the bottleneck of a SHA-1 sum, which was never intended as a
>>> security feature?
>
>> This is a bug in git. Do you want us to wait until it is resolved?
>
> Not a bug. There are VCSs (like Subversion or Bazaar) that use simple
> revision numbers to identify their commits. Git happens to use a hash,
> which is perfectly fine as long as accidental collisions are unlikely.
> Neither has to do anything with security, though.
>

Sure, but in that case why add gpg signatures to git at all?  I think
that just like Gentoo this is just the nature of FOSS - everybody has
their opinion of what everything is supposed to do, and the only thing
that really matters is what it can actually do and who writes code to
get it to do something different.

If Linus felt that git needed gpg signatures he'd have added them back
in the beginning (for commits, not tags).  Somebody else felt
differently, and added them later, but did not address the hash issue.
Maybe sometime down the road we'll see support for a different hash
functions added, or some other workaround.  All it would take is for
somebody to write the code and support it seriously (either as part of
git or a fork).

But, I doubt anybody here wants to maintain that fork, so we're left
with what we have now, which is a git which accepts signatures, but
those signatures are only bound to code by sha1.

With FOSS what is and isn't a bug is up to whoever wants to write the
code to fix it, or pay somebody else to write it for them.

--
Rich