Re: Git and SHA1 collisions

2024-03-31 Thread Peter Pentchev
On Sun, Mar 31, 2024 at 10:27:05AM +0200, Simon Josefsson wrote: > Gioele Barabucci writes: > > > But pulling a successful collision attack is not a trivial task. For > > instance, the xz attacker did not have all that was required to carry > > it out (for example they had no direct access to the

Re: Git and SHA1 collisions

2024-03-31 Thread Simon Josefsson
Gioele Barabucci writes: > But pulling a successful collision attack is not a trivial task. For > instance, the xz attacker did not have all that was required to carry > it out (for example they had no direct access to the git > servers... yet). Is that necessary? It seems that if you have push