[NOTES 09/11] Git 3.0

[Taylor Blau <me@ttaylorr.com>]

Topic: Git 3.0
Leader: Patrick Steinhardt


* Any questions?
* Emily: Patrick, you had proposed the end of next year as the cut date, are
	people happy with that?
* Taylor: we've been using that internally as a benchmark for when we need to
	deliver SHA-256. If Git 3.0 came later and we had more time, certainly
	wouldn't complain, but also wouldn't ask the project to push it back purely on
	that basis.
* Caleb: we need community support for SHA-256.
* Emily: feels like everybody is playing chicken.
* Taylor: ultimately the users need to tell us.
* Patrick: is there work going on on GitOxide?
* Caleb: nobody is asking for it from GitButler's perspective
* Elijah: if we don't push a date out, nobody will ask for it.
* brian: the cost for creating a SHA-1 collision is roughly $10k USD. Don't want
	to spend my bonus check on it, but could do it and spam us with alerts.
* Taylor: sure, but we could just silence those alerts. Also, who would spend
	$10k on this? ;-)
* brian: fair, though not implementations are using a SHA1-DC?
* brian: we should include this in Git 3.0, and we should set a hard date for
	it. We should plan the interop work around that, but can't guarantee that it
	will land by then.
* Martin: what's in scope for Git 3.0?
	 * Elijah: SHA-256 (and maybe interop) is the main thing, some deprecations
	 * Patrick: we have a BreakingChanges that lists what we want to remove.
		 Default reference backend is going to become reftable.
* Taylor: we should be doing brown-outs for deprecated features
* Elijah: we should delay for interop
* Peff: how important is interop really? What is the use-case?
* Elijah: will forges actually support SHA-256 once we enable it? Do we have
	people create SHA-256 and then have them not push them anywhere.
* Peff: how do we push forges versus not?
* Peff: When we release Git 3.0 should not depend on whether or not interop
	works, but whether or not real-world forges and plugins support SHA-256
* brian: smaller forges aren't there yet and won't undertake it until it's in
	3.0
* Taylor: sure, but not the vast majority of users. Ultimately there are always
	going to be some stragglers. Reality is that what “we” consider to be Git and
	the rest of the world consider to be Git are not the same thing. So if we
	release without good support on the forges side, users will be mad at us.
* Let's figure it out on the list?
* brian: I'll start that off.