You are viewing a plain text version of this content. The canonical link for it is here.
Posted to docs@httpd.apache.org by bu...@apache.org on 2018/07/11 21:29:11 UTC
[Bug 62530] New: MD5 deprecated; remove from instructions
https://bz.apache.org/bugzilla/show_bug.cgi?id=62530
Bug ID: 62530
Summary: MD5 deprecated; remove from instructions
Product: Apache httpd-2
Version: 2.5-HEAD
Hardware: PC
OS: Mac OS X 10.1
Status: NEW
Severity: normal
Priority: P2
Component: Documentation
Assignee: docs@httpd.apache.org
Reporter: sebb@apache.org
Target Milestone: ---
The page
http://httpd.apache.org/dev/verification.html
mentions MD5 as the primary hash format; this is deprecated since March 2018.
Since other projects are often directed to HTTPD as an example to follow, it
would be helpful if the page could be updated.
I think it's as simple as removing the word MD5 a couple of times as it is only
used to qualify the hash type.
Note that the page does not provide any details of how to use a hash for
checking downloads.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: docs-unsubscribe@httpd.apache.org
For additional commands, e-mail: docs-help@httpd.apache.org
[Bug 62530] MD5 deprecated; remove from instructions
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=62530
--- Comment #3 from Luca Toscano <to...@gmail.com> ---
Thanks for the references! I think that leaving only md5 may be misleading for
user reading http://httpd.apache.org/dev/verification.html, how should we
proceed? Replace "MD5" occurrence with ""/"file"/"file digest"/something-else?
I think that we should also make sure to provide a SHA512 hash from the next
release onward.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: docs-unsubscribe@httpd.apache.org
For additional commands, e-mail: docs-help@httpd.apache.org
[Bug 62530] MD5 deprecated; remove from instructions
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=62530
--- Comment #4 from Sebb <se...@apache.org> ---
The page only mentions MD5 in the following phrase, which occurs twice:
"PGP signatures and MD5 hashes"
The simplest solution is to change this to
"PGP signatures and SHA hashes"
However ideally the page should also describe how to use a hash to verify a
download.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: docs-unsubscribe@httpd.apache.org
For additional commands, e-mail: docs-help@httpd.apache.org
[Bug 62530] MD5 deprecated; remove from instructions
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=62530
--- Comment #2 from Christophe JAILLET <ch...@wanadoo.fr> ---
Luca: reference is http://www.apache.org/dev/release-distribution#sigs-and-sums
You can also find some discussion about it on the private@ ML.
Mails are dated 2018-08-17 14:18, and 2018-03-05 11:18.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: docs-unsubscribe@httpd.apache.org
For additional commands, e-mail: docs-help@httpd.apache.org
[Bug 62530] MD5 deprecated; remove from instructions
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=62530
--- Comment #1 from Luca Toscano <to...@gmail.com> ---
Hi,
when you say "deprecated" you mean generically or by the Apache foundation? It
is pretty clear in the documentation that the verification is done via PGP and
not MD5, but I agree with you that it might be confusing for people.
How about replacing the MD5 occurrences with MD5/SHA1/SHA256 ? Would it be a
good compromise?
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: docs-unsubscribe@httpd.apache.org
For additional commands, e-mail: docs-help@httpd.apache.org
[Bug 62530] MD5 deprecated; remove from instructions
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=62530
Sebb <se...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |FIXED
Status|NEW |RESOLVED
--- Comment #6 from Sebb <se...@apache.org> ---
thanks
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: docs-unsubscribe@httpd.apache.org
For additional commands, e-mail: docs-help@httpd.apache.org
[Bug 62530] MD5 deprecated; remove from instructions
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=62530
--- Comment #5 from Luca Toscano <to...@gmail.com> ---
Done it, also upgraded the download page as well. Let me know if it is good or
not :)
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: docs-unsubscribe@httpd.apache.org
For additional commands, e-mail: docs-help@httpd.apache.org