2025-02-03 10:59:02 +00:00
|
|
|
---
|
|
|
|
|
last_review_date: "1970-01-01"
|
|
|
|
|
---
|
|
|
|
|
|
2017-01-04 10:53:21 +00:00
|
|
|
# MD5 and SHA-1 Deprecation
|
2017-01-04 16:16:00 -06:00
|
|
|
|
2017-10-22 03:17:00 +01:00
|
|
|
In early 2015 Homebrew started the process of deprecating _SHA1_ for package
|
|
|
|
|
integrity verification. Since then formulae under the Homebrew organisation
|
2023-09-08 14:46:15 -04:00
|
|
|
have been migrated to use _SHA-256_ for verification; this includes both source
|
2017-10-22 03:17:00 +01:00
|
|
|
packages and our precompiled packages (bottles).
|
2016-03-20 16:27:54 +00:00
|
|
|
|
2017-10-22 03:17:00 +01:00
|
|
|
Homebrew has since stopped supporting _SHA1_ and _MD5_ entirely.
|
|
|
|
|
_MD5_ checksums were removed from core formulae in 2012 and as of April 2015
|
|
|
|
|
installing a formula verified by _MD5_ is actively blocked.
|
2016-03-20 16:27:54 +00:00
|
|
|
|
2016-11-26 17:27:02 +00:00
|
|
|
We removed _SHA1_ support in **November 2016**,
|
|
|
|
|
21 months after we started warning people to move away from it for verification.
|
|
|
|
|
This is enforced in the same way _MD5_ is, by blocking the installation of that
|
|
|
|
|
individual formula until the checksum is migrated.
|
2016-03-20 16:27:54 +00:00
|
|
|
|
2022-01-03 16:57:25 -05:00
|
|
|
This means custom taps, local custom formulae, etc. need to be migrated to use
|
2023-09-08 14:46:15 -04:00
|
|
|
_SHA-256_ before you can install them.
|
