Zbigniew Jędrzejewski-Szmek venit, vidit, dixit 2026-09-22 08:51:23: > [resend, apparently the previous copy got lost in transit] > > On Sat, Sep 19, 2026 at 12:32:00AM -0500, Jason Tibbitts wrote: > > >>>>> Paul Bolle via devel <[email protected]> writes: > > > > > How many of these old style sources files are there still left? > > > > Well, I grabbed the git seed and ran "grep -L SHA512 */sources" and > > found 2641 packages. > > That is a lot. > > > > If only a few, could we perhaps kick these files into the sha512sum > > > tagged era? > > > > I think most would consider that to be more than a few. If you have an > > automated way to fix these, I suppose someone could go through and do > > that, or at least start a discussion about undertaking a conversion. > > But I wonder if the effort is justifiable. > > I think we should do this. If we accept the premise that the old > hash cannot be trusted (i.e. that it's possible to craft a collision), > then we want _all_ packages to use the new hash. If at least one > package uses the "weak" hash, it becomes a potential attack vector. > > I think it'd make sense to apply this through a provenpackager. > For each of the packages, fetch the sources from the cache, recompute > the checksum, save new sources file. The commit should be done with > '[skip changelog]' for packages with %autochangelog, and with no > changelog entry for the rest. >
... and since this does not require a package rebuild, the load on the dist-git infrastructure should be low. The heavy part is the check-out from the lookaside-cache: It requires a download of the sources, local sha256sum, plus possibly an upload - or does the lookaside-cache "know somehow" that it has that tarball under a different "name" (md5sum) already? Would it be possible to reindex (point from md5sum and sha256sum to the same sources) on the lookaside cache first? Or does this duplicate sources in the cache? Michael -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
