Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:99363
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: softfail (pb1.pair.com: domain golemon.com does not designate 209.85.128.181 as permitted sender)
MIME-Version: 1.0
Sender: php@golemon.com
In-Reply-To: <CANUQDChaU2baGe7roLfsMYUcH5uRt79u68zT8eAvcipP+n2Upg@mail.gmail.com>
References: <CAESVnVrV_fx840YSk2LzyTVRa2dgsphpVUO0NOLH6dJcPjKmkQ@mail.gmail.com>
 <CAESVnVr5ju6QepAk_9L6vNL14_0kQBU1oB6+RB-GL4Har9GPpg@mail.gmail.com> <CANUQDChaU2baGe7roLfsMYUcH5uRt79u68zT8eAvcipP+n2Upg@mail.gmail.com>
Date: Mon, 5 Jun 2017 11:12:39 -0400
Message-ID: <CAESVnVpf79VEVOJWU+Sc9J+_pNFwJb1vgEyFoqn19QZefj2agQ@mail.gmail.com>
To: Niklas Keller <me@kelunik.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: text/plain; charset="UTF-8"
Subject: Re: [PHP-DEV] Re: [RFC][Release Process] Deprecate/Remove MD5 checksums
From: pollita@php.net (Sara Golemon)

On Mon, Jun 5, 2017 at 11:06 AM, Niklas Keller <me@kelunik.com> wrote:
> 2017-06-05 16:42 GMT+02:00 Sara Golemon <pollita@php.net>:
>>
>> On Tue, May 30, 2017 at 12:27 AM, Sara Golemon <pollita@php.net> wrote:
>> > https://wiki.php.net/rfc/release-md5-deprecation
>> >
>> > Primary discussion points: Deprecate or Remove? Deprecate for how long?
>> >
>> No response from my post last week, bumping at a different time of day
>> to get response.
>
> I think I responded, but maybe only on Twitter. I'm definitely in favor of
> removing them.
>
> I think it would be good to add at least SHA-256 checksums for the older
> releases.
>
That's not a terrible idea.  I'll script something up to download,
verify gpg if it's available (verify existing m5 if it's not), and
generate a sha256 from it resulting in a diff to
web-php/include/releases.inc . Can do that irrespective of whether or
not we stop adding md5s.

-Sara