0·
14 小时前Worth to keep in mind though that the gpg signature basically only signs the (git) hashes of the contained objects, so the choice of hash function is indeed important for security.
- 0 Posts
- 2 Comments
Joined 8 天前
Cake day: 2026年9月30日
You are not logged in. If you use a Fediverse account that is able to follow users, you can follow this user.
Yes, but the “commit object” is just a bunch of metadata that refers to the tree by its hash:
% git cat-file commit 6de20f6092 tree 5cb21f9acf8c31ce1a8f6bb0bbc3b9e4e8607ce8 parent c679abf7d2c0f3f4ee623e0882a50964e9b100cc author Junio C Hamano <gitster@pobox.com> 1791306800 -0700 committer Junio C Hamano <gitster@pobox.com> 1791306812 -0700 The 4th batch Signed-off-by: Junio C Hamano <gitster@pobox.com>And the tree in turn refers to the files (or subfolders) by their hashes:
% git cat-file -p 5cb21f9acf8c31ce1a8f6bb0bbc3b9e4e8607ce8 | head 100644 blob fd4fb56b6d56789369d4824ad10999369127f5c7 .b4-config 100644 blob 8168d8a10b3a9e14f6c019e8ffbe5a71dc307d8b .b4-cover-template 100644 blob fef04a38402fee6465a6a4225374d493b47421c0 .cirrus.yml 100644 blob 86b4fe33e5cd98e2a347944559c345419824c245 .clang-format 100644 blob 82e121a41754b536611c9ce9b2b4aba349e7ed9d .editorconfig 100644 blob 26490ad60a74d0968eaf2f77abffcb21d78b18e3 .gitattributes 040000 tree 5f898fc5ec3429058fd21072db170fff9e49eab4 .github 100644 blob 0209bd16f209c232748734d911099b37be80fc12 .gitignore 100644 blob 3f2483550038f6aabb2f8b858b4ee7b29a66072a .gitlab-ci.yml 100644 blob cbeebdab7a5e2c6afec338c3534930f569c90f63 .gitmodulesIf you can produce a hash collision, you can therefore have two repositories with the same signed commit but different file content.