Whatever happened to SHA-256 support in Git?
This is one of the reasons why Go has its own versioning system.  From a project's `go.sum`:<p>example.com/example v0.0.0-20171218180944-5ea4d0ddac55 h1:jbGlDKdzAZ92NzK65hUP98ri0/r50vVVvmZsFP/nIqo=<p>Where "h1" is an upgradeable hash (h1 is SHA-256).  If there's ever a problem with h1, the hash can be simply upgraded.<p>Git's documentation describes how to sign a git commit:<p>$ git commit -a -S -m 'signed commit'<p>When signing a git commit using the built in gpg function the project is not rehashed with a secure hash function, like SHA-256 or SHA3-256.  Instead gpg signs the SHA-1 commit digest directly. It's not signing the result of a secure hash algorithm.<p>SHA-1 has been considered weak for a long time (about 17 years).  Bruce Schneier warned in February 2005 that SHA-1 needed to be replaced.  Git development didn't start until April 2005.  Before git started development, SHA-1 was identified as needing deprecation.