On Fri, Sep 18, 2026 at 8:28 PM Paul Bolle via devel <[email protected]> wrote: > > Every now and then I run into old style sources files on > src.fedoraproject.org. That is the plain md5sum format, like this: > c4867d72c41564318e0107745eb7a0f2 setserial-2.17.tar.gz > > Most sources files nowadays use the sha512sum tagged format: > SHA512 (setserial-2.17.tar.gz) = > 27b4918d303302dfdbca2f8c4fe500685068cfbf3de70b4907bac5a9cdb2e643656c1d821e714c08723abcfbaf99129866002117450bef731a0a09cd38138645 > > These old style files appear to be mostly generated for sources now old > enough to vote, at least in my country. And they make my, ahem, tooling > fail. (That is: a local script can't handle them.) > > How many of these old style sources files are there still left? If only > a few, could we perhaps kick these files into the sha512sum tagged era?
If you wanted to do all the work (with all the various PRs required for each package) I guess you could do it, but is there any advantage to the organization to do so globally that I am missing? While md5 is not considered secure, to replace the sources with some invalid variant (that matched the md5) it would require one to have otherwise valid credentials (that are stronger than md5), most likely minimizing any risk of using md5 checks in practice. Ideally upstreams would cryptographically sign their releases (and gpgverify could be used as a stronger check for source verification), but only a limited number do so, and if you wanted to actually increase validation, you should engage with all those upstreams. If your personal scripting does not handle the md5 case then your personal scripting should probably be updated to accommodate the existing definition of the signatures (that includes md5). -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
