Hi, On Wed, 29 Nov 2023 at 00:05, Holger Levsen <hol...@layer-acht.org> wrote: > > hi, > > snapshot.d.o also uses sha1 sums, at least internally, but I'd not > surprised if also for external verification.
At the moment I am trying to focus on contents of .dsc and .changes only, not the InReleases Packages etc files. Does snapshot.d.o peak inside .dsc and .changes files? Does it use sha1 for "by-hash" like content addressing? My understanding was that "by-hash" lookups use sha256 only (at least launchpad's implementation had code for sha1 but it never was in production proper) -- okurrr, Dimitri
