Finally moving away from weak hash algorithms (and extra-files while we are at it) about opam-repository HOT 5 CLOSED

This issue was discussed during the opam-repository maintainer meeting and we decided that this should go ahead. Further discussions and such can happen in the different PRs that this issue is manifesting as.

from opam-repository.

Dear everyone (cc'ing manually @shonfeder @kit-ty-kate @raphael-proust),

I've also done the third and fourth step. And for you to have an easier time to validate the results (well, and me verifying that I didn't break anything), there's now a tool -- https://github.com/hannesm/opam-check-checksum -- You run it with the current opam repository (use 6ed19e3) on the one side (--old-opam-repo=DIR), and the updated one on the other side (--opam-repo=DIR -- use 2730ed6, the HEAD of https://github.com/hannesm/opam-repository/tree/extra-file-to-extra-source).

What does opam-check-checksum do? Well, it will read all opam files in old-opam-repo, and check opam files for having extra-files or only a md5 checksum. If this is the case, opam-repo is checked that the old hashes are included (for url), and for extra-files that a extra-sources entry is present and also contains the old checksum.

For me this ran without issues after I fixed a silly mistake (it should retain the sha512 if it was present) in the migration command.

To give some motivation, if we merge that branch, the MD5-only checksums go down from 12577 to 70 (measured with git grep 'checksum: "md5=' | wc -l). The remaining MD5-only checksums are due to unavailable sources/tarballs.

It would be great if you could either merge the opam-source-archives PR and my branch (named extra-file-to-extra-source), or tell me whether there are any steps I should do before this can be merged. You can of course take your time and look at the diff, or reproduce the results -- as mentioned, the two big commits are automated, the in-between one was a manual move to reconcile the fix-gcc patch.

from opam-repository.

If you'd like to read the diff for opam-repository, I recommend to use git diff -D 6ed19e325e5016a43606d8073ca73998f9ebf68f..2730ed62d22b8488a96c5683498a99a8426ce178 (which avoids the full text of the deleted files).

from opam-repository.

FYI, #25960 added hashes to +trunk packages, see

from opam-repository.

Thanks @emillon for your headsup, in #25962 these checksums got removed again.

from opam-repository.