Skip to content
Snippets Groups Projects

Makefile: Build Git with non-collision-detecting SHA1

Merged Makefile: Build Git with non-collision-detecting SHA1
jt/git-sha1-no-dc into master
Merged Justin Tobler requested to merge jt/git-sha1-no-dc into master
  1. Jan 28, 2025
    • Justin Tobler's avatar
      Makefile: Build Git with non-collision-detecting SHA1 · 8e9d4424
      Justin Tobler authored 
      By default, Git uses SHA1DC for all SHA1 hashing operations. This
implementation includes collision detection to protect against collision
attacks, but comes with a performance penalty. Not all hashing
operations performed by Git are vulnerable to collision attacks though.

In Git version 2.47.0, Git can be built with `OPENSSL_SHA1_UNSAFE` set
to use a non-collision-detecting SHA1 implementation in
non-cryptographic scenarios. This improves performance without
compromising security.

Update the Gitaly Makefile to build the bundled Git v2.48 with this
option set.
      8e9d4424