Gits move away from SHA-1: Version 2.29 brings experimental SHA-256 support
Summary
The latest version of Linus Torvalds Git version-control system brings experimental support for the SHA-256 cryptographic hash, moving it away from its reliance on the less safe SHA-1. The researchers highlighted that Git "strongly relies on SHA-1" for checking the integrity of file objects and commits. They argued SHA-1 was a tampering risk because it was possible to create "two Git repositories with the same head commit hash and different contents, say, a benign source code and a backdoored one". However, ever since SHAttered arrived, the Git project has been hardening its SHA-1 implementation and gradually enabling support for the safer SHA-256. "This prevents GitHub from accepting both the benign and malicious halves of the pair, since the mathematical tricks required to generate a collision in any reasonable amount of time can be detected and rejected by Git."