14 points | by chmaynard 2 hours ago
4 comments
Does it mean that when switching trop sha1 to sha256 you need to forcepush and rewrite all history? Wouldn’t that be a massive source of potential vulnerabilities?
I don't know much about this. How does that enable vulnerabilities exactly?
Trusting a forced push w/o any other verification means nefarious history changes can be slipped in.
`git add --resolved` is a wonderful idea, and definitely something I would start using.
Does it mean that when switching trop sha1 to sha256 you need to forcepush and rewrite all history? Wouldn’t that be a massive source of potential vulnerabilities?
I don't know much about this. How does that enable vulnerabilities exactly?
Trusting a forced push w/o any other verification means nefarious history changes can be slipped in.
`git add --resolved` is a wonderful idea, and definitely something I would start using.