On: Git 3.0's upcoming SHA-256 default will be a costly mistake

[Onavo]

There's a massive push right now from top down to have secure software supply chains. Google SBOM and SigStore. It's not an organic need but if you have government customers you don't have many options.

[Dayshine → Onavo]

Ironically rewriting git history is a perfect opportunity for a supply chain attack.

[samus → Dayshine]

The switchover date is usually announced well in advance and any interested parties can easily verify that the conversion was authentic.