Switching to SHA256 (was: GNOME 2.27.4 released!)

[Olav Vitters <olav bkor dhs org>]

On Wed, Jul 15, 2009 at 06:38:21PM +0200, Frederic Peters wrote:
> To compile GNOME 2.27.4, you can the jhbuild [1] modulesets [2] (which
> use the exact tarball versions from the official release):
> 
>   [1] http://library.gnome.org/devel/jhbuild/
>   [2] http://download.gnome.org/teams/releng/2.27.4/

Regarding releng jhbuild modulsets:
The releng jhbuild modulesets have been using MD5 as hashing method. I'd
like to switch everything to SHA256. This requires Python 2.5 or newer.
I've pushed changes in releng module to make use of SHA256, with a
fallback to md5 in case Python 2.4 is used. However, that fallback is
NOT perfect.
IMPACT: If you generate the tarball moduleset on Python 2.5 or newer,
the moduleset files *require* Python 2.5 or newer. IMO for the releng
moduleset that is fine.

Regarding general jhbuild modulesets:
Jhbuild has been changed by fpeters (thanks!) to hopefully fall back to
md5 in case the modulset has something like the following:
  md5sum="blabla" hash="sha256:foobar"
It will only use md5sum attribute for Python 2.4, and hash attribute if
either md5sum attribute is left out, or in case the system has Python
2.5 or newer (so with md5sum="1" hash="md5:2" it'll see the hash as "1"
on Python 2.4).
Anyway, I want to add the sha256 hash method to the GNOME 2.28
moduleset. Python 2.4 (or older) will still make use of md5 as hash
method.
IMPACT: Needs to specify md5sum as well as hash in the modulesets (not
just hash), else we break Python 2.4 compatibility).


Note: IIRC GNOME requires Python 2.5. However, jhbuild can set that up.
This is about jhbuild itself requiring 2.5 in some cases.

Again, RHEL5 has Python 2.4 (used on one of the buildbots).

Suggest we keep Python 2.4 support (aka md5sum attribute) in the general
moduleset until RHEL6 is out (I expect that beginning of 2009, that is
just guesswork though).
For the releng tarball modulset, I am for dropping Python 2.4 support.
If people disagree, I need to do some work on convert-to-tarballs.py.


PS: install-module already solely makes use of sha256sum.

-- 
Regards,
Olav