Subject: Re: When should we release Git 3.0?

From: Michal Suchánek <[email-masked]>
Date: Thu, 2 Oct 2025 18:10:22 +0200

On Thu, Oct 02, 2025 at 08:32:38AM -0700, Junio C Hamano wrote:
> Patrick Steinhardt <[email-masked]> writes:
> 
> > Once we have roadmaps, we should set a strict deadline that takes them
> > into account. Any hosting provider or implementation of Git that doesn't
> > provide a roadmap will not be taken into account in our planning.
> 
> Works fine as long as we assume everybody that matters will
> eventually want to move away from SHA-1.
> 
>  - If a stakeholder gives a roadmap that has no SHA-256 in their
>    future, in other words, if they are content to serve only the
>    SHA-1 projects, what's the impact to them?  We are not dropping
>    the support for SHA-1 in the sense that if you clone from an
>    existing SHA-1 repository you'll get an SHA-1 repository and you
>    can push and fetch between them just fine, so presumably that is
>    fine as well.
> 
>  - If a stakeholder gives a roadmap with SHA-256 so far into the
>    future that we cannot wait, what's the impact to them?  Their
>    customers that want SHA-256 earlier than they can supply could
>    move to other hosting or implementation, but not really.  Both

I suppose that's already the case to some extent. git does support
sha256, some forges do as well, and some people want it to the point
that they install such forge, and create the sha256 repositories
although it is not the default.

There is some tradeoff here. When it's nice to have but not required
people will use it when convenient. When it's really required people
will use even an obscure implementation to get the requested feature.

>    hosting providers and Git implementations have components that
>    are move than Git that are hard to migrate, like issue trackers,
>    CI services, workflow tools, etc., that make their customers
>    captive audience [*].
> 
>  - If a stakeholder has a roadmap with SHA-256 in line with our
>    timeframe, do we still need to assess the impact to them, or as
>    long as we and they work hard to stick to the plan, we all will
>    be happy?
> 
> > We should of course actively reach out to the projects that we're aware
> > of so that they have a chance to provide such a roadmap in the first
> > place.
> 
> 
> [Footnote]
> 
>  * Issue trackers and review logs that are federated, possibly using
>    Git database for storage and transfer, may allow projects and
>    users to freely roam across hosting sites, but there is no strong
>    incentive for the hosting sites to fund such an effort X-<.

Many forges provide migration options for importing data from other
forges for which there is incentive, with various level of completeness
and reliability. Another thing that contributes to lock-in is network
effect of popular forges.

Thanks

Michal