On Mon, Sep 14, 2015 at 3:10 PM, Scott Robison <[email protected]> wrote: > > I wasn't really thinking of who might want to do it, just that sha1 isn't > being used for cryptographic security and that would be covered by other > means (GPG for example). >
The hashes can be important for verifying the integrity of the repository. Even when not "signing" commits, a secure hash is still valuable. The more secure the hash, the harder it is to hide corruption. Also, the description of the "PGP command" setting says "Command used to clear-sign manifests at check-in." This suggests that only the manifest itself is signed. Therefor, the GPG signature relies on the hashes - in the manifest - generated by Fossil
_______________________________________________ fossil-users mailing list [email protected] http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
