mirrors/brew
1
0
Fork 0
mirror of https://github.com/Homebrew/brew.git synced 2025-07-14 16:09:03 +08:00
Code Issues Packages Projects Releases Wiki Activity

Checksum_Deprecation: tweak phrasing/explanation/etc

Browse Source
This commit is contained in:
Dominyk Tiller 2017-10-22 03:17:00 +01:00
parent ce0e96c320
commit 71ef1b091a
No known key found for this signature in database
GPG Key ID: FE19AEFCF658C6F6
1 changed files with 7 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
docs/Checksum_Deprecation.md
View File

@ -1,22 +1,18 @@
# MD5 and SHA-1 Deprecation
During early 2015 Homebrew started the process of deprecating _SHA1_ for package
integrity verification. Since then every formulae under the Homebrew organisation
has been moved onto _SHA256_ verification; this includes both source packages
and our precompiled packages (bottles).
In early 2015 Homebrew started the process of deprecating _SHA1_ for package
integrity verification. Since then formulae under the Homebrew organisation
have been moved onto using _SHA256_ for verification; this includes both source
packages and our precompiled packages (bottles).
We have stopped supporting _SHA1_ and _MD5_ entirely.
_MD5_ checksums were removed from core formulae in 2012 but until April 2015
if you tried to install a formula still using one Homebrew wouldn't actively stop you.
Homebrew has since stopped supporting _SHA1_ and _MD5_ entirely.
_MD5_ checksums were removed from core formulae in 2012 and as of April 2015
installing a formula verified by _MD5_ is actively blocked.
We removed _SHA1_ support in **November 2016**,
21 months after we started warning people to move away from it for verification.
This is enforced in the same way _MD5_ is, by blocking the installation of that
individual formula until the checksum is migrated.
From March 20th 2016 we've stepped up the visibility of that notification & you'll start
seeing deprecation warnings when installing _SHA1_-validated formula.
If you see these please consider reporting it to where the formula originated.
This means custom taps, local custom formulae, etc need to be migrated to use
_SHA256_ before you can install them.