Whatever happened to SHA-256 support in Git? [LWN.net]

Whatever happened to SHA-256 support in Git?

Posted Jun 24, 2022 10:20 UTC (Fri) by k3ninho (subscriber, #50375)
Parent article: Whatever happened to SHA-256 support in Git?

>What has happened here looks, to an extent at least, like a story that has played out numerous times over the course of free-software history. A problem has been identified, and a great deal of core foundational work has been done to solve it. That solution appears to be well considered and solidly implemented. In a sense, the job is 90% done. All that is left is the hard work of making the transition to a new hash easy for users — what could be thought of as "the other 90%" of the job.

It used to be 80:20, and I thought we learned to improve estimates based on past evidence, not get worse at them.

I've found myself saying 'changing a computer system changes how people work' quite a bit recently and, it doesn't seem unfair to note that here there's a change to the system that doesn't have corresponding effort to change the way users use git.

Part of the 'scratch your own itch' of the free software and open source community is that people adapt as part of adopting updated editions of the software they're involved in; part of the 'being in community' involves support and training to help other users out. While a code change might be in place and deemed 'done', the adoption and migration phases are not.

Notably with git, is there a need or any benefit to recomputing the history of a tree with SHA256 hashes, like some kind of Export-Transform-Load (ETL) task? Who would you trust to publish the first trees or to attest they've replicated the work?

K3n.

to post comments

Whatever happened to SHA-256 support in Git?

Posted Jun 24, 2022 12:15 UTC (Fri) by dbnichol (subscriber, #39622) [Link]

This part of the article is what stuck me, too. Git has been around for nearly 20 years now. There are vast amounts of existing git repos with sha1 identifiers in them.

I'd say the project is at best 50% done if there's no interoperability with sha1 repos. Even if you switched git to default to sha256 on new repos and convinced all the major hosting providers to rewrite the history on all their repos to sha256 today, it would be years of pain before that trickled down through all the repos in the wild.

Unless there's compatibility with sha1 repos and a nearly automatic way to rewrite existing repos to sha256 in a compatible way, then it's essentially unusable. That seems like just as big a problem if not bigger than making git capable of using a different hashing algorithm.