SHA-256

[lorenzleutgeb]

Consider the improvements regarding support for SHA-256 in Git, last mentioned in the release notes for version 2.45:

• https://github.com/git/git/blob/master/Documentation/RelNotes/2.45.0.txt
• https://github.blog/open-source/git/highlights-from-git-2-45/

libgit2 has experimental support for SHA-256, guarded by -DEXPERIMENTAL_SHA256.

There is a reference to this in git2-rs:

git2-rs/libgit2-sys/lib.rs

Line 1174 in abbd64e

// SHA256 is still experimental so we are not going to enable it.

It might be useful to allow users explore SHA-256 compatibility with git2-rs, probably behind a feature flag.

[extrawurst]

With libgit2 1.9.0 it was announced that 2.0.0 will be ABI breaking and making SHA256 support default

[yonas]

With libgit2 1.9.0 it was announced that 2.0.0 will be ABI breaking and making SHA256 support default

@extrawurst When do you plan on releasing v2.0.0?

[eirnym]

a CVE to double check in this library as well: https://nvd.nist.gov/vuln/detail/CVE-2025-31130

[theAkito]

Is there a roadmap with rough dates/spans, when this can be realistically expected to be released?

[weihanglo]

No date ATM. This is a libgit2 Rust binding, so we get whatever upstream libgit2 provides

[lorenzleutgeb]

I asked upstream here: libgit2/libgit2#7149 (With a quote of the part of the release notes referred to by #1090 (comment).)

[Taywee]

Upstream indicates that they want more users to use the SHA256 support so they could have actual testing for it. A feature flag for experimental features like this would be a good idea, I think. It's obviously some work. Is this project open to the possibility of that kind of PR?

[weihanglo]

Sounds like a good attempt as well as a preparation of the sha256 stabilization. We just need to make sure that it is documented as experimental and has tests covered

[lorenzleutgeb]

Cool. Exactly what I suggested more than a year ago 🙃 I would be open to experimenting with SHA-256 guarded by an experimental feature flag in the Radicle codebase.

Just as an idea for naming: clap seems to use "unstable-" as prefix, see https://github.com/clap-rs/clap/blob/cb49ebad046317a6bef22a553f6f1c8b7852853c/Cargo.toml#L178-L183