Re: Security review of tag2upload

[Marco d'Itri <md@Linux.IT>]

simon@josefsson.org wrote:

>Can this be substantiated?  Using SHA1CD in Git does not necessarily
>mean someone cannot manually create a Git repository with a colliding
>git commit somewhere in the history that gets accepted by git, and
>allows someone to replace actual file contents.  That may be the case,
>but I haven't seen any detailed analysis answering that.
This is quite a strong assertion, and it is up to you to prove it.
The current consensus among cryptography experts is that SHA-1 is still
resistant to preimage attacks.

-- 
ciao,
Marco