[Distutils] Proposal: drop md5 for sha256

[Tarek Ziadé]

On 7/3/12 4:32 PM, PJ Eby wrote:
> On Tue, Jul 3, 2012 at 8:48 AM, Jeroen Dekkers <jeroen at dekkers.ch 
> <mailto:jeroen at dekkers.ch>> wrote:
>
>     And yes, attacks on md5 will only get better, so we should migrate to
>     better hashes in the future. 
>
>
> No, because that's not what the RECORD hashes are for.  It's not an 
> intrusion detection system, it's an installer conflict and "oops I 
> edited the wrong file" checker.
>
> People who are upset because md5 is low security are correctly 
> understanding that this system *provides no security*.  We are not 
> promising ANY security, so *not* using a secure hash is actually 
> preferable.  The goal is data integrity against accidental overwrite 
> by dumb installer tools (e.g. distutils) and accidental edits, not 
> security against malicious tampering.

Yeah I don't really understand this debate over md5 hashes here. I 
suggest that we emphasis in PEP 376 the fact that the sole purpose is to 
have a checksum.



>
>
>
>
> _______________________________________________
> Distutils-SIG maillist  -  Distutils-SIG at python.org
> http://mail.python.org/mailman/listinfo/distutils-sig


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/distutils-sig/attachments/20120703/d1b31cf8/attachment.html>