On Tue, Apr 29, 2008 at 5:46 AM, Jurko Gospodnetić
<jurko.gospodnetic@docte.hr> wrote:
quoted text
>
> > I think you are missing the point. One of the pluses behind originally
> > using SHA-1 and the signed tags is that the system as a whole is
> > cryptographically secure. You can verify from the public key of
> > whoever made the tag that yes, this really is the source and history
> > they tagged.
> >
>
>   I am not really sure I follow this.... how can you 'verify from the public
> key of whoever made the tag' that the SHA-1 hash is correct!? SHA-1 does not
> have anything do with any externally provided keys or have I managed to get
> something confused here?
>

Sorry for the confusion, its about using the signed tag and the SHA-1
of the parent commits, along with their associated trees and blobs to
verify the source and history. If you can't trust the signed tag, or
all of the SHA-1's, you can't trust the source and history.

However, as many said, I don't think there is any reason to not trust
SHA-1 is the context of source control.