[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Adding sha256 support into jigdo tools (jigdo and jigit)

[ Sent to multiple people and Debian bugs - please respect the
  reply-to and follow up on the debian-cd list if you have
  replies/comments. ]

Hi folks!

For a while we've been working to move away from using MD5 in various
parts of Debian, and jigdo is one of the last few things that's still
using it now. We've had a few bugs raised about this (#887837 and
#887831) and quite some discussion recently. I've been hacking on
jigdo and jigit to add support for a new v2 jigdo format which
switches from using md5 for internal checksumming to using sha256
instead, and I'm just about done now. I have a few remaining things to
do next, that I'd like to ask for some help with (please!) - see
further down. Prompt responses would be appreciated if possible.


I've extended jigdo to support both formats (old and new). Building a
new jigdo/template pair requires the user to specify which format they
want, while creating/verifying an image will auto-detect the format
automatically from the input data. I think that is clearly the best
design here.

I'm *most* worried about updating the various clients that people may
have in the field, using jigdo-lite/jigdo-mirror to make ISO images
from the jigdo data that we release with Debian, so that was my first
priority. I'm *not* aware of anybody actually using jigdo-file itself
to create new jigdo/template pairs these days, but I've done the right
thing anyway and added support for sha256 here too.

I've forked from Richard's last 0.7.3 release, and put it into my own git
server at


along with the various fixes that we already had in Debian since that

I've built and tested binaries locally with both jigdo formats,
including on Windows. All looks good here. \o/


I've also updated and extended my own jigit/libjte code to work with
both formats, and I'm about to release those. The changes are not too
big, and the external API for libjte is *very* close to what we had
before. I've already updated a local copy of xorriso to use it, and
the changes are tiny! \o/


I am *not* planning to update my code in genisoimage to use the new
jigdo v2 format. We don't use genisoimage at all in the Debian images
team any more, having moved to xorriso instead. The only reason to
even think about updating genisoimage would be for powerpc
images. While the debian-ports people are still supporting powerpc and
periodically releasing new unofficial CD/DVD images for it, I don't
think jigdo is needed here. *If you think differently*, let me know...

Publishing the new format

debian-cd and some of our backend setup on our cdimage sites will need
some minor updates to support the new sha256 format as well, but
that's not urgent yet. We must *not* switch to publishing the new v2
jigdo format for a while (I'm thinking maybe 12 months?), to give
people the chance to update their clients. I also don't want to leave
this *too* long, as the Debian ftpmaster team and others would like to
ditch md5 soon.

We'll need to make noise about this, and update web pages etc. to
mention the change. New links to new tools, etc.


With your blessing, I'd like to release my new code as jigdo version
0.8.0. If you're ok with that, could you please update your jigdo web
pages to mention this? I'll add a page at


that you can link to. I'll add some docs, and links back to you (of
course!) and download links for Windows binaries etc. So far I've left
the creator information in newer jigdo files pointing at your site as
you're the inventor, but I'm also happy to change that if you'd like
and reduce your web traffic - just let me know please! :-)


You're the person normally working with people using jigdo tools to
mirror Debian's CD/DVD releases. We'll need to ask people to update
all their tools to enable using the new v2 format. What systems are
they normally using? I'm guessing a mix of Debian systems of various
versions, plus maybe a few other OSes? I'm happy to do Debian
backports builds of the new tool versions to help support people, but
I don't know:

 (a) what else might need to be supported
 (b) what timescale these people would be happy with or updates

Obviously, we don't want to be pushing new format versions until the
mirror network is ready to take them. But we want that to be as soon
as practically possible.


You've done an awesome job with xorriso and the libjte integration!
It's been really easy to drop in my new libjte code and have xorriso
generate the new format. I've got a simple diff right now that I'm
just cleaning up and will send you shortly.

Steve McIntyre, Cambridge, UK.                                steve@einval.com
You lock the door
And throw away the key
There's someone in my head but it's not me 

Attachment: signature.asc
Description: PGP signature

Reply to: