[Distutils] Proposal: drop md5 for sha256

[Donald Stufft]

On Tuesday, July 3, 2012 at 3:45 AM, Tarek Ziadé wrote:
>  
> Hash in the RECORD file have nothing to do with making sure the package  
> is originated from developer X.
> Its only purpose is to know if a file on the system was changed
>  
Using sha256 would enable preventing someone from maliciously changing the
file. Similar to how IDS systems capture hashes of binaries to compare against.
Of course someone using the system like this would need to protect the filesystem
storing the RECORD files accordingly.

I also think that switching to sha256 is pretty low cost with minimal (no?) downsides
with some possible upsides. Is there a reason to stay with md5?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/distutils-sig/attachments/20120703/9f1f9b46/attachment.html>