Re: [ALL] SHA-1 vs. SHA-256

2018-05-19 Thread Gary Gregory
On Sat, May 19, 2018 at 6:38 AM, ajs6f wrote: > > On May 19, 2018, at 5:34 AM, Emmanuel Bourg wrote: > > On 18/05/2018 17:30, Gary Gregory wrote: > > > >> Thoughts? > > > > I wouldn't bother. The checksum is just there to ensure the download > worked properly, and for this even md5 is fine. > >

Re: [ALL] SHA-1 vs. SHA-256

2018-05-19 Thread ajs6f
> On May 19, 2018, at 5:34 AM, Emmanuel Bourg wrote: > On 18/05/2018 17:30, Gary Gregory wrote: > >> Thoughts? > > I wouldn't bother. The checksum is just there to ensure the download worked > properly, and for this even md5 is fine. > > The authenticity of the artifacts is ensured by the GPG

Re: [ALL] SHA-1 vs. SHA-256

2018-05-19 Thread Emmanuel Bourg
On 18/05/2018 17:30, Gary Gregory wrote: > Thoughts? I wouldn't bother. The checksum is just there to ensure the download worked properly, and for this even md5 is fine. The authenticity of the artifacts is ensured by the GPG signatures. Emmanuel Bourg -

Re: [ALL] SHA-1 vs. SHA-256

2018-05-18 Thread ajs6f
+1 ajs6f > On May 18, 2018, at 5:50 PM, Bruno P. Kinoshita wrote: > > No objections from me. +1 > > Sent from Yahoo Mail on Android > > On Sat, 19 May 2018 at 9:24, Gary Gregory wrote: > Hi All: > > Eclipse is moving to SHA-256 to validate downloads [1] alongside MD5. > > We just updat

Re: [ALL] SHA-1 vs. SHA-256

2018-05-18 Thread Bruno P. Kinoshita
No objections from me. +1 Sent from Yahoo Mail on Android On Sat, 19 May 2018 at 9:24, Gary Gregory wrote: Hi All: Eclipse is moving to SHA-256 to validate downloads [1] alongside MD5. We just updated to SHA-1 which apparently has been subject to a collision attack [2]. Our newish commo

Re: [ALL] SHA-1 vs. SHA-256

2018-05-18 Thread Gary Gregory
On Fri, May 18, 2018 at 9:56 AM, Rob Tompkins wrote: > > > > On May 18, 2018, at 11:42 AM, Gary Gregory > wrote: > > > >> On Fri, May 18, 2018 at 9:36 AM, sebb wrote: > >> > >>> On 18 May 2018 at 16:30, Gary Gregory wrote: > >>> Hi All: > >>> > >>> Eclipse is moving to SHA-256 to validate down

Re: [ALL] SHA-1 vs. SHA-256

2018-05-18 Thread Rob Tompkins
> On May 18, 2018, at 11:42 AM, Gary Gregory wrote: > >> On Fri, May 18, 2018 at 9:36 AM, sebb wrote: >> >>> On 18 May 2018 at 16:30, Gary Gregory wrote: >>> Hi All: >>> >>> Eclipse is moving to SHA-256 to validate downloads [1] alongside MD5. >>> >>> We just updated to SHA-1 which apparen

Re: [ALL] SHA-1 vs. SHA-256

2018-05-18 Thread Gary Gregory
On Fri, May 18, 2018 at 9:36 AM, sebb wrote: > On 18 May 2018 at 16:30, Gary Gregory wrote: > > Hi All: > > > > Eclipse is moving to SHA-256 to validate downloads [1] alongside MD5. > > > > We just updated to SHA-1 which apparently has been subject to a collision > > attack [2]. > > > > Our newi

Re: [ALL] SHA-1 vs. SHA-256

2018-05-18 Thread sebb
On 18 May 2018 at 16:30, Gary Gregory wrote: > Hi All: > > Eclipse is moving to SHA-256 to validate downloads [1] alongside MD5. > > We just updated to SHA-1 which apparently has been subject to a collision > attack [2]. > > Our newish commons-release-plugin has just been updated to SHA-1. > > I'd

[ALL] SHA-1 vs. SHA-256

2018-05-18 Thread Gary Gregory
Hi All: Eclipse is moving to SHA-256 to validate downloads [1] alongside MD5. We just updated to SHA-1 which apparently has been subject to a collision attack [2]. Our newish commons-release-plugin has just been updated to SHA-1. I'd like to add SHA-256 alongside SHA-1. Thoughts? [1] https://