forked from Homebrew/brew
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Checksum_Deprecation: tweak phrasing/explanation/etc
- Loading branch information
Showing
1 changed file
with
7 additions
and
11 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,22 +1,18 @@ | ||
# MD5 and SHA-1 Deprecation | ||
|
||
During early 2015 Homebrew started the process of deprecating _SHA1_ for package | ||
integrity verification. Since then every formulae under the Homebrew organisation | ||
has been moved onto _SHA256_ verification; this includes both source packages | ||
and our precompiled packages (bottles). | ||
In early 2015 Homebrew started the process of deprecating _SHA1_ for package | ||
integrity verification. Since then formulae under the Homebrew organisation | ||
have been moved onto using _SHA256_ for verification; this includes both source | ||
packages and our precompiled packages (bottles). | ||
|
||
We have stopped supporting _SHA1_ and _MD5_ entirely. | ||
_MD5_ checksums were removed from core formulae in 2012 but until April 2015 | ||
if you tried to install a formula still using one Homebrew wouldn't actively stop you. | ||
Homebrew has since stopped supporting _SHA1_ and _MD5_ entirely. | ||
_MD5_ checksums were removed from core formulae in 2012 and as of April 2015 | ||
installing a formula verified by _MD5_ is actively blocked. | ||
|
||
We removed _SHA1_ support in **November 2016**, | ||
21 months after we started warning people to move away from it for verification. | ||
This is enforced in the same way _MD5_ is, by blocking the installation of that | ||
individual formula until the checksum is migrated. | ||
|
||
From March 20th 2016 we've stepped up the visibility of that notification & you'll start | ||
seeing deprecation warnings when installing _SHA1_-validated formula. | ||
If you see these please consider reporting it to where the formula originated. | ||
|
||
This means custom taps, local custom formulae, etc need to be migrated to use | ||
_SHA256_ before you can install them. |