Re: apt-get update hashsum mismatch prevent

[Michael Vogt <mvo@debian.org>]

On Thu, Jun 19, 2014 at 08:12:33PM +0200, Ansgar Burchardt wrote:
> Hi,
Hi Ansgar,

thanks for your feedback!
 
> Michael Vogt <mvo@debian.org> writes:
> > - we add a flag to InRelease like "Content-Addressable-Indexes: yes"
> >   "Get-By-Hash: sha256,sha1" (suggestions for a good name welcome) [2]
> 
> > [2] Either going with a simple boolean flag in which case the hashes
> >     need to be provided for all hashes in the Release file (e.g.
> >     via symlinks) or by using specific hashes mentioned in the 
> >     Release file. I lean towards just using a boolean as its
> >     the simplest solution.
> 
> I think the field should say which hash to use. There is no need for the
> archive to have to provide the files under all possible hash names (or
> apt/debmirror/* to probe which files actually exist).

Ok, David is also in favor of using a explicit hashtype in the field,
so I will put it on the list of things to implement. There is a
implementation of this in experimental but that is just using the
boolean flag which means it will use the strongest hash. I will try to
find time to fix this soon.

Cheers,
 Michael