Re: Files with identical SHA1 breaks the repo

2017-02-26 Thread Stefan
On 2/25/2017 08:51, b...@qqmail.nl wrote: > > I remember some experiments in early development of WC-NG where we > measured which checksums worked vs which ones were too expensive. > Going to the SHA1 family was at least 5 times more expensive or so… > > > > We determined back then SHA1 was good

Re: [PATCH] reject-known-sha1-collisions.sh: shell language tweaks

2017-02-26 Thread Andreas Stieger
Hi, Daniel Shahaf wrote: > [[[ > * tools/hook-scripts/reject-known-sha1-collisions.sh > Use a more portable syntax for the [(1) (test(1)) tool. > Handle filenames with literal backslashes. > ]]] Thanks, r1784484. Andreas

Re: [PATCH] use SHA-2 family hash for releases

2017-02-26 Thread Stefan Fuhrmann
On 24.02.2017 06:26, Daniel Shahaf wrote: Andreas Stieger wrote on Thu, Feb 23, 2017 at 21:08:43 +0100: +++ tools/dist/release.py (working copy) @@ -537,9 +537,9 @@ def roll_tarballs(args): shutil.move(filename, get_deploydir(args.base_dir)) filename = os.path.join(

Re: Files with identical SHA1 breaks the repo

2017-02-26 Thread Stefan Sperling
On Sun, Feb 26, 2017 at 07:29:30PM +0100, Branko Čibej wrote: > On 26.02.2017 18:26, Paul Hammant wrote: > > Why don't y'all take the same tactic as Git does - SHA1 the contents of the > > file *and a prepended a type/length field* ?. > > And when the hash-colliding files happen to have the same t

Re: Files with identical SHA1 breaks the repo

2017-02-26 Thread Branko Čibej
On 26.02.2017 18:26, Paul Hammant wrote: > Why don't y'all take the same tactic as Git does - SHA1 the contents of the > file *and a prepended a type/length field* ?. And when the hash-colliding files happen to have the same type and length, as in the published collision... Ah, of course, Git is

Re: Files with identical SHA1 breaks the repo

2017-02-26 Thread Paul Hammant
Why don't y'all take the same tactic as Git does - SHA1 the contents of the file *and a prepended a type/length field* ?. That and a tool to back convert SHA1s for existing repos. Linus weighed in again: https://plus.google.com/+LinusTorvalds/posts/7tp2gYWQugL Svn is more likely to be used as a s

Re: Files with identical SHA1 breaks the repo

2017-02-26 Thread Garance A Drosehn
On 24 Feb 2017, at 15:46, Stefan Sperling wrote: > > I believe we should prepare a new working format for 1.10.0 > which addresses this problem. I don't see a good way of fixing > it without a format bump. The bright side of this is that it > gives us a good reason to get 1.10.0 ready ASAP. > > We