You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@apr.apache.org by William A Rowe Jr <wr...@rowe-clan.net> on 2018/09/18 12:52:22 UTC
Hashes for apr downloads
Note that in moderation of announce@apache.org, I received the following
response;
> MD5 and SHA1 hashes have been deprecated for some time on download pages
(*)
>
> Please update the download page(s) to remove these.
>
> (*) http://www.apache.org/dev/release-distribution#sigs-and-sums
Are we concerned with retaining either-or MD5 or SHA1 for legacy
architecture users? As we integrate to openssl 0.9.8+, and those all have
an `openssl sha256` facility, it seems like the concern is pretty obscure.
Do we have an opinion on offering both sha256 + sha512? Only one or the
other, and if so, which?
Thoughts?
Bill
AW: Hashes for apr downloads
Posted by Mario Brandt <jb...@gmail.com>.
IMHO,
there is no benefit in having a sha512. If one does not trust a download mirror or the direct download from apache.org that person doesn't trust any source.
Worst case scenario is than to do a svn co rather than downloading the tar ball file.
Re: Hashes for apr downloads
Posted by William A Rowe Jr <wr...@rowe-clan.net>.
On Tue, Sep 18, 2018 at 8:21 AM Ruediger Pluem <rp...@apache.org> wrote:
>
> On 09/18/2018 02:52 PM, William A Rowe Jr wrote:
> > Note that in moderation of announce@apache.org <mailto:
> announce@apache.org>, I received the following response;
> >
> >> MD5 and SHA1 hashes have been deprecated for some time on download
> pages (*)
> >>
> >> Please update the download page(s) to remove these.
> >>
> >> (*) http://www.apache.org/dev/release-distribution#sigs-and-sums
> >
> > Are we concerned with retaining either-or MD5 or SHA1 for legacy
> architecture users? As we integrate to openssl 0.9.8+,
> > and those all have an `openssl sha256` facility, it seems like the
> concern is pretty obscure.
>
> Sounds reasonable.
>
> > Do we have an opinion on offering both sha256 + sha512? Only one or the
> other, and if so, which?
>
> Does offering both create additional work?
>
The pmc/apr/tools/release.sh script does emits all the desired hashes.
More hrefs to adjust in download.html, that's about it.
My only question was, does adding sha512 add "value" when the gpg
signature is supposedly authoritative (and anyone who can manipulate
the tarball can manipulate a sha file too.)
Re: Hashes for apr downloads
Posted by Ruediger Pluem <rp...@apache.org>.
On 09/18/2018 02:52 PM, William A Rowe Jr wrote:
> Note that in moderation of announce@apache.org <ma...@apache.org>, I received the following response;
>
>> MD5 and SHA1 hashes have been deprecated for some time on download pages (*)
>>
>> Please update the download page(s) to remove these.
>>
>> (*) http://www.apache.org/dev/release-distribution#sigs-and-sums
>
> Are we concerned with retaining either-or MD5 or SHA1 for legacy architecture users? As we integrate to openssl 0.9.8+,
> and those all have an `openssl sha256` facility, it seems like the concern is pretty obscure.
Sounds reasonable.
>
> Do we have an opinion on offering both sha256 + sha512? Only one or the other, and if so, which?
Does offering both create additional work?
Regards
Rüdiger