Re: [Gnu-arch-users] SHA1 sums for checksums file

[Tom Lord]

    > From: Colin Walters <address@hidden>

Thanks for working on this, by the way.

    >         patch-1
    >           add SHA1 to checksums, verify it [INCOMPATIBLE CHANGE]

    > I was fairly verbose in the patch-1 patch log.  In case [INCOMPATIBLE
    > CHANGE] isn't clear enough - yes, you will have to re-checksum and
    > re-sign your archives.

We should be able to eliminate that limitation, I think.

(Assuming I do merge in SHA1 support, then) I don't mind leaving md5.c
linked in.    Is your opinion that md5 security is _so_ bad that
revisions currently using it should be changes?   Or would it be
enough to just use sha1 on new revisions?


-t