Re: Re: [RFC][Release Process] Deprecate/Remove MD5 checksums

On Mon, Jun 5, 2017 at 11:06 AM, Niklas Keller <me@kelunik.com> wrote: > 2017-06-05 16:42 GMT+02:00 Sara Golemon <pollita@php.net>: >> >> On Tue, May 30, 2017 at 12:27 AM, Sara Golemon <pollita@php.net> wrote: >> > https://wiki.php.net/rfc/release-md5-deprecation >> > >> > Primary discussion points: Deprecate or Remove? Deprecate for how long? >> > >> No response from my post last week, bumping at a different time of day >> to get response. > > I think I responded, but maybe only on Twitter. I'm definitely in favor of > removing them. > > I think it would be good to add at least SHA-256 checksums for the older > releases. > That's not a terrible idea. I'll script something up to download, verify gpg if it's available (verify existing m5 if it's not), and generate a sha256 from it resulting in a diff to web-php/include/releases.inc . Can do that irrespective of whether or not we stop adding md5s. -Sara