3 ms·
Disabling sha1 does not seem like a good decision. There are still enough upstream software projects that only publish their checksums as sha1 or even only md5.
by raimue 10y ago
Disabling sha1 does not seem like a good decision. There are still enough upstream software projects that only publish their checksums as sha1 or even only md5. Keeping the original checksum allows quick comparison that a Formula is meant to use the same tarballs that were published by upstream. The problems of algorithms such as sha1 or md5 can be remedied by an additional strong checksum in the Formula. Checksum calculation is so fast that doing it twice will not matter.
- jonchang 10y agoHomebrew does, in fact, always use its own strong additional checksum (sha256) in the individual Formulae for all downloaded resources.
- raimue 10y agoThere is nothing wrong with calculating your own additional checksum, but as far as I can see, sha256 is now the only supported checksum type in Homebrew at all.