Re: When should we release Git 3.0?

[Patrick Steinhardt <ps@pks.im>]

On Thu, Oct 02, 2025 at 06:10:22PM +0200, Michal Suchánek wrote:
> On Thu, Oct 02, 2025 at 08:32:38AM -0700, Junio C Hamano wrote:
> > Patrick Steinhardt <ps@pks.im> writes:
> > 
> > > Once we have roadmaps, we should set a strict deadline that takes them
> > > into account. Any hosting provider or implementation of Git that doesn't
> > > provide a roadmap will not be taken into account in our planning.
> > 
> > Works fine as long as we assume everybody that matters will
> > eventually want to move away from SHA-1.
> > 
> >  - If a stakeholder gives a roadmap that has no SHA-256 in their
> >    future, in other words, if they are content to serve only the
> >    SHA-1 projects, what's the impact to them?  We are not dropping
> >    the support for SHA-1 in the sense that if you clone from an
> >    existing SHA-1 repository you'll get an SHA-1 repository and you
> >    can push and fetch between them just fine, so presumably that is
> >    fine as well.
> > 
> >  - If a stakeholder gives a roadmap with SHA-256 so far into the
> >    future that we cannot wait, what's the impact to them?  Their
> >    customers that want SHA-256 earlier than they can supply could
> >    move to other hosting or implementation, but not really.  Both
> 
> I suppose that's already the case to some extent. git does support
> sha256, some forges do as well, and some people want it to the point
> that they install such forge, and create the sha256 repositories
> although it is not the default.
> 
> There is some tradeoff here. When it's nice to have but not required
> people will use it when convenient. When it's really required people
> will use even an obscure implementation to get the requested feature.

True. In any case, I think that for now we should just wait how such
roadmaps would look like and then discuss based on the findings.

The question of course is how to get such roadmaps. The easiest way to
do it is probably to gather a list of known projects that would be
impacted and just shoot maintainers or representatives of those an
email? From the top of my head, that would include:

  - Implementations
      - libgit2
      - JGit
      - Gitoxide
      - go-git
  - Forges
      - GitHub
      - GitLab
      - Bitbucket
      - Forgejo
      - SourceHut

I probably missed some stakeholders here, so please help me fill in the
blanks.

> >    hosting providers and Git implementations have components that
> >    are move than Git that are hard to migrate, like issue trackers,
> >    CI services, workflow tools, etc., that make their customers
> >    captive audience [*].
> > 
> >  - If a stakeholder has a roadmap with SHA-256 in line with our
> >    timeframe, do we still need to assess the impact to them, or as
> >    long as we and they work hard to stick to the plan, we all will
> >    be happy?

Well, the impact in that case would be negligible, I assume, so everyone
woudl be happy. If plans change then we can of course also adapt our own
timeline a bit, at least as long as they would give us a notification
well ahead of the scheduled flag day.

Patrick