@matheusbsbs / matheus-bagliano / commits / c79bb70a2e

Enable SHA-256 by default in breaking changes mode

Our document on breaking changes indicates that we intend to default to SHA-256 in Git 3.0. Since most people choose the default option, this is an important security upgrade to our defaults. To allow people to test this case, when WITH_BREAKING_CHANGES is set in the configuration, build Git with SHA-256 as the default hash. Update the testsuite to use the build options information to automatically choose the right value. Note that if the command substitution for GIT_TEST_BUILTIN_HASH fails, so does the testsuite—and quite spectacularly at that. Thus, the case where the Git binary is somehow subtly broken will not go undetected. Signed-off-by: brian m. carlson <sandals@crustytoothpaste.net> Signed-off-by: Junio C Hamano <gitster@pobox.com>

brian m. carlson committed Jul 1, 2025 at 21:22 UTC c79bb70a2e7d9158ec165ea16ad45371cd6e350d
2 files changed +8 -2
hash.h
+7 -1
@@ -174,8 +174,14 @@ static inline void git_SHA256_Clone(git_SHA256_CTX *dst, const git_SHA256_CTX *s
174 #define GIT_HASH_SHA256 2
175 /* Number of algorithms supported (including unknown). */
176 #define GIT_HASH_NALGOS (GIT_HASH_SHA256 + 1)
177 +
178 /* Default hash algorithm if unspecified. */
178 -#define GIT_HASH_DEFAULT GIT_HASH_SHA1
179 +#ifdef WITH_BREAKING_CHANGES
180 +# define GIT_HASH_DEFAULT GIT_HASH_SHA256
181 +#else
182 +# define GIT_HASH_DEFAULT GIT_HASH_SHA1
183 +#endif
184 +
185 /* Legacy hash algorithm. Implied for older data formats which don't specify. */
186 #define GIT_HASH_SHA1_LEGACY GIT_HASH_SHA1
187
t/test-lib.sh
+1 -1
@@ -536,7 +536,7 @@ export GIT_COMMITTER_EMAIL GIT_COMMITTER_NAME
536 export GIT_COMMITTER_DATE GIT_AUTHOR_DATE
537 export EDITOR
538
539 -GIT_TEST_BUILTIN_HASH=sha1
539 +GIT_TEST_BUILTIN_HASH=$("$GIT_BUILD_DIR/git" version --build-options | sed -ne 's/^default-hash: //p')
540 GIT_DEFAULT_HASH="${GIT_TEST_DEFAULT_HASH:-$GIT_TEST_BUILTIN_HASH}"
541 export GIT_DEFAULT_HASH
542 GIT_DEFAULT_REF_FORMAT="${GIT_TEST_DEFAULT_REF_FORMAT:-files}"