[resend, apparently the previous copy got lost in transit] On Sat, Sep 19, 2026 at 12:32:00AM -0500, Jason Tibbitts wrote: > >>>>> Paul Bolle via devel <[email protected]> writes: > > > How many of these old style sources files are there still left? > > Well, I grabbed the git seed and ran "grep -L SHA512 */sources" and > found 2641 packages.
That is a lot. > > If only a few, could we perhaps kick these files into the sha512sum > > tagged era? > > I think most would consider that to be more than a few. If you have an > automated way to fix these, I suppose someone could go through and do > that, or at least start a discussion about undertaking a conversion. > But I wonder if the effort is justifiable. I think we should do this. If we accept the premise that the old hash cannot be trusted (i.e. that it's possible to craft a collision), then we want _all_ packages to use the new hash. If at least one package uses the "weak" hash, it becomes a potential attack vector. I think it'd make sense to apply this through a provenpackager. For each of the packages, fetch the sources from the cache, recompute the checksum, save new sources file. The commit should be done with '[skip changelog]' for packages with %autochangelog, and with no changelog entry for the rest. Zbyszek -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
