{"action":"created","issue":{"url":"https://api.github.com/repos/creationix/nvm/issues/664","labels_url":"https://api.github.com/repos/creationix/nvm/issues/664/labels{/name}","comments_url":"https://api.github.com/repos/creationix/nvm/issues/664/comments","events_url":"https://api.github.com/repos/creationix/nvm/issues/664/events","html_url":"https://github.com/creationix/nvm/pull/664","id":57865601,"number":664,"title":"nvm: support SHA256 instead of SHA1","user":{"login":"DomT4","id":6998367,"avatar_url":"https://avatars.githubusercontent.com/u/6998367?v=3","gravatar_id":"","url":"https://api.github.com/users/DomT4","html_url":"https://github.com/DomT4","followers_url":"https://api.github.com/users/DomT4/followers","following_url":"https://api.github.com/users/DomT4/following{/other_user}","gists_url":"https://api.github.com/users/DomT4/gists{/gist_id}","starred_url":"https://api.github.com/users/DomT4/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DomT4/subscriptions","organizations_url":"https://api.github.com/users/DomT4/orgs","repos_url":"https://api.github.com/users/DomT4/repos","events_url":"https://api.github.com/users/DomT4/events{/privacy}","received_events_url":"https://api.github.com/users/DomT4/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-02-16T23:48:29Z","updated_at":"2015-02-17T00:08:21Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/creationix/nvm/pulls/664","html_url":"https://github.com/creationix/nvm/pull/664","diff_url":"https://github.com/creationix/nvm/pull/664.diff","patch_url":"https://github.com/creationix/nvm/pull/664.patch"},"body":"Supports iojs and Node SHA256 checksumming instead of SHA1 for Node and nothing for ` iojs `. Should support at least Ubuntu, Debian, Linux Mint, Arch Linux, Gentoo, OpenBSD, FreeBSD, CentOS, OS X and Cygwin.\r\n\r\nThere's a whole range of fallbacks there, from the regular shasums to BSD & OS X's more centralised one `shasum` which does everything and then has fallbacks on 4 of the more popular/new/shiny SSL tools in PolarSSL, OpenSSL, LibreSSL and BoringSSL.\r\n\r\nI know there were concerns about this sort of thing previously because of some systems lacking SHA256, but the introduction of the SSL Toolkits as backups should mitigate that quite a bit. I tested the OpenSSL branch way back to OpenSSL 0.9.8e and found that to support the method used here. OpenBSD is trying to kill off OpenSSL on their system slowly, so LibreSSL as well as the ` shasum ` BSD utility should cover those."},"comment":{"url":"https://api.github.com/repos/creationix/nvm/issues/comments/74594410","html_url":"https://github.com/creationix/nvm/pull/664#issuecomment-74594410","issue_url":"https://api.github.com/repos/creationix/nvm/issues/664","id":74594410,"user":{"login":"ljharb","id":45469,"avatar_url":"https://avatars.githubusercontent.com/u/45469?v=3","gravatar_id":"","url":"https://api.github.com/users/ljharb","html_url":"https://github.com/ljharb","followers_url":"https://api.github.com/users/ljharb/followers","following_url":"https://api.github.com/users/ljharb/following{/other_user}","gists_url":"https://api.github.com/users/ljharb/gists{/gist_id}","starred_url":"https://api.github.com/users/ljharb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ljharb/subscriptions","organizations_url":"https://api.github.com/users/ljharb/orgs","repos_url":"https://api.github.com/users/ljharb/repos","events_url":"https://api.github.com/users/ljharb/events{/privacy}","received_events_url":"https://api.github.com/users/ljharb/received_events","type":"User","site_admin":false},"created_at":"2015-02-17T00:08:21Z","updated_at":"2015-02-17T00:08:21Z","body":"Thanks for taking a crack at this!\r\n\r\nNot every version on http://nodejs.org/dist/ has `SHASUMS256.txt` - specifically, `v0.5.x`, `v0.6.x`, `v0.7.x`, `<= v0.8.22`, and `v0.9.x`. Dropping `SHA-1` support entirely, at least in the way this PR does, means `nvm` would be dropping support for these node versions too, which isn't acceptable.\r\n\r\nIf you want to change this PR to add `nvm_checksum_256` for example, and use that only on the `io.js` code paths, that would be a great first start - and later it could be conditionally used when `nvm_version_greater_than_or_equal_to 0.10.0` for the node paths - that would be a great start."}}