{"action":"created","comment":{"url":"https://api.github.com/repos/Homebrew/homebrew/pulls/comments/25624535","id":25624535,"diff_hunk":"@@ -827,12 +827,26 @@ def audit_version\n   def audit_checksum\n     return unless checksum\n \n-    case checksum.hash_type\n-    when :md5\n-      problem \"MD5 checksums are deprecated, please use SHA1 or SHA256\"\n-      return\n-    when :sha1   then len = 40\n-    when :sha256 then len = 64\n+    strict = ARGV.include? \"--strict\"\n+\n+    if strict\n+      case checksum.hash_type\n+      when :md5\n+        problem \"MD5 checksums are deprecated, please use SHA256\"\n+        return\n+      when :sha1\n+        problem \"SHA1 checksums are deprecated, please use SHA256\"\n+        return\n+      when :sha256 then len = 64\n+      end\n+    else\n+      case checksum.hash_type\n+      when :md5\n+        problem \"MD5 checksums are deprecated, please use SHA256\"","path":"Library/Homebrew/cmd/audit.rb","position":25,"original_position":25,"commit_id":"6aeb816096780c92ffc11e58fb53600e7eeb1b8c","original_commit_id":"d997b720e336b813ee0b274bb9de68386c888e7e","user":{"login":"mikemcquaid","id":125011,"avatar_url":"https://avatars.githubusercontent.com/u/125011?v=3","gravatar_id":"","url":"https://api.github.com/users/mikemcquaid","html_url":"https://github.com/mikemcquaid","followers_url":"https://api.github.com/users/mikemcquaid/followers","following_url":"https://api.github.com/users/mikemcquaid/following{/other_user}","gists_url":"https://api.github.com/users/mikemcquaid/gists{/gist_id}","starred_url":"https://api.github.com/users/mikemcquaid/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikemcquaid/subscriptions","organizations_url":"https://api.github.com/users/mikemcquaid/orgs","repos_url":"https://api.github.com/users/mikemcquaid/repos","events_url":"https://api.github.com/users/mikemcquaid/events{/privacy}","received_events_url":"https://api.github.com/users/mikemcquaid/received_events","type":"User","site_admin":true},"body":"> As in if checksum.hash_type?\r\n\r\nYup.","created_at":"2015-03-02T18:41:29Z","updated_at":"2015-03-02T18:41:29Z","html_url":"https://github.com/Homebrew/homebrew/pull/37164#discussion_r25624535","pull_request_url":"https://api.github.com/repos/Homebrew/homebrew/pulls/37164","_links":{"self":{"href":"https://api.github.com/repos/Homebrew/homebrew/pulls/comments/25624535"},"html":{"href":"https://github.com/Homebrew/homebrew/pull/37164#discussion_r25624535"},"pull_request":{"href":"https://api.github.com/repos/Homebrew/homebrew/pulls/37164"}}},"pull_request":{"url":"https://api.github.com/repos/Homebrew/homebrew/pulls/37164","id":29946956,"html_url":"https://github.com/Homebrew/homebrew/pull/37164","diff_url":"https://github.com/Homebrew/homebrew/pull/37164.diff","patch_url":"https://github.com/Homebrew/homebrew/pull/37164.patch","issue_url":"https://api.github.com/repos/Homebrew/homebrew/issues/37164","number":37164,"state":"open","locked":false,"title":"checksums: switch to sha256 for bottles and new formulae","user":{"login":"DomT4","id":6998367,"avatar_url":"https://avatars.githubusercontent.com/u/6998367?v=3","gravatar_id":"","url":"https://api.github.com/users/DomT4","html_url":"https://github.com/DomT4","followers_url":"https://api.github.com/users/DomT4/followers","following_url":"https://api.github.com/users/DomT4/following{/other_user}","gists_url":"https://api.github.com/users/DomT4/gists{/gist_id}","starred_url":"https://api.github.com/users/DomT4/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DomT4/subscriptions","organizations_url":"https://api.github.com/users/DomT4/orgs","repos_url":"https://api.github.com/users/DomT4/repos","events_url":"https://api.github.com/users/DomT4/events{/privacy}","received_events_url":"https://api.github.com/users/DomT4/received_events","type":"User","site_admin":false},"body":"As far as I can see, the SHA1 check on this was first introduced at least as far back as the middle of 2012, when a very low number of formulae had SHA256 checksums.\r\n\r\nCircle forwards to 2015 and we have ~210 formulae using SHA256 checksums, with (hopefully) more to follow in the coming months/years/etc.\r\n\r\nThis has resulted in an odd discrepancy where Homebrew effectively downgrades the SHA check on formula with SHA256 checksums from SHA256 via source to SHA1 via bottle.\r\n\r\nConsequently, I’d like to propose that we start generating bottles with SHA256 hashes. I contemplated examining the formula file for the checksum it was using, and then adopting that SHA1/SHA256 and passing either ` bottle.sha256 bottle_path.sha256 ` or ` bottle.sha1 bottle_path.sha1 ` to the bottle mechanism depending on what the response was, but I’m not entirely sure what the complexity would gain Homebrew, to be honest.\r\n\r\nNone of the machines that we currently support building bottles for have any significant computational delay generating SHA256sums, and all are capable of generating those SHA256sums, so there wouldn’t be a user-appreciable gain in performance in only supporting SHA1, or rather a user-appreciable loss of performance in supporting SHA256 if you prefer it phrased that way around.\r\n\r\nJust pondering on this really. I think given the slow move away from SHA1, this wouldn’t be a bad place to start, as it’d only impact formula authors and/or maintainers and is a tiny change. It also doesn't break the status quo as far as my testing goes. Bottles with SHA1 are still accepted, you just can't generate bottles with SHA1 anymore.\r\n\r\nThoughts?","created_at":"2015-02-24T23:27:57Z","updated_at":"2015-03-02T18:41:29Z","closed_at":null,"merged_at":null,"merge_commit_sha":"1a35f033cf6a62bb2c6e9b394b3f3c920eb81236","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/Homebrew/homebrew/pulls/37164/commits","review_comments_url":"https://api.github.com/repos/Homebrew/homebrew/pulls/37164/comments","review_comment_url":"https://api.github.com/repos/Homebrew/homebrew/pulls/comments{/number}","comments_url":"https://api.github.com/repos/Homebrew/homebrew/issues/37164/comments","statuses_url":"https://api.github.com/repos/Homebrew/homebrew/statuses/6aeb816096780c92ffc11e58fb53600e7eeb1b8c","head":{"label":"DomT4:bottles","ref":"bottles","sha":"6aeb816096780c92ffc11e58fb53600e7eeb1b8c","user":{"login":"DomT4","id":6998367,"avatar_url":"https://avatars.githubusercontent.com/u/6998367?v=3","gravatar_id":"","url":"https://api.github.com/users/DomT4","html_url":"https://github.com/DomT4","followers_url":"https://api.github.com/users/DomT4/followers","following_url":"https://api.github.com/users/DomT4/following{/other_user}","gists_url":"https://api.github.com/users/DomT4/gists{/gist_id}","starred_url":"https://api.github.com/users/DomT4/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DomT4/subscriptions","organizations_url":"https://api.github.com/users/DomT4/orgs","repos_url":"https://api.github.com/users/DomT4/repos","events_url":"https://api.github.com/users/DomT4/events{/privacy}","received_events_url":"https://api.github.com/users/DomT4/received_events","type":"User","site_admin":false},"repo":{"id":23289808,"name":"homebrew","full_name":"DomT4/homebrew","owner":{"login":"DomT4","id":6998367,"avatar_url":"https://avatars.githubusercontent.com/u/6998367?v=3","gravatar_id":"","url":"https://api.github.com/users/DomT4","html_url":"https://github.com/DomT4","followers_url":"https://api.github.com/users/DomT4/followers","following_url":"https://api.github.com/users/DomT4/following{/other_user}","gists_url":"https://api.github.com/users/DomT4/gists{/gist_id}","starred_url":"https://api.github.com/users/DomT4/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DomT4/subscriptions","organizations_url":"https://api.github.com/users/DomT4/orgs","repos_url":"https://api.github.com/users/DomT4/repos","events_url":"https://api.github.com/users/DomT4/events{/privacy}","received_events_url":"https://api.github.com/users/DomT4/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/DomT4/homebrew","description":"The missing package manager for OS X.","fork":true,"url":"https://api.github.com/repos/DomT4/homebrew","forks_url":"https://api.github.com/repos/DomT4/homebrew/forks","keys_url":"https://api.github.com/repos/DomT4/homebrew/keys{/key_id}","collaborators_url":"https://api.github.com/repos/DomT4/homebrew/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/DomT4/homebrew/teams","hooks_url":"https://api.github.com/repos/DomT4/homebrew/hooks","issue_events_url":"https://api.github.com/repos/DomT4/homebrew/issues/events{/number}","events_url":"https://api.github.com/repos/DomT4/homebrew/events","assignees_url":"https://api.github.com/repos/DomT4/homebrew/assignees{/user}","branches_url":"https://api.github.com/repos/DomT4/homebrew/branches{/branch}","tags_url":"https://api.github.com/repos/DomT4/homebrew/tags","blobs_url":"https://api.github.com/repos/DomT4/homebrew/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/DomT4/homebrew/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/DomT4/homebrew/git/refs{/sha}","trees_url":"https://api.github.com/repos/DomT4/homebrew/git/trees{/sha}","statuses_url":"https://api.github.com/repos/DomT4/homebrew/statuses/{sha}","languages_url":"https://api.github.com/repos/DomT4/homebrew/languages","stargazers_url":"https://api.github.com/repos/DomT4/homebrew/stargazers","contributors_url":"https://api.github.com/repos/DomT4/homebrew/contributors","subscribers_url":"https://api.github.com/repos/DomT4/homebrew/subscribers","subscription_url":"https://api.github.com/repos/DomT4/homebrew/subscription","commits_url":"https://api.github.com/repos/DomT4/homebrew/commits{/sha}","git_commits_url":"https://api.github.com/repos/DomT4/homebrew/git/commits{/sha}","comments_url":"https://api.github.com/repos/DomT4/homebrew/comments{/number}","issue_comment_url":"https://api.github.com/repos/DomT4/homebrew/issues/comments{/number}","contents_url":"https://api.github.com/repos/DomT4/homebrew/contents/{+path}","compare_url":"https://api.github.com/repos/DomT4/homebrew/compare/{base}...{head}","merges_url":"https://api.github.com/repos/DomT4/homebrew/merges","archive_url":"https://api.github.com/repos/DomT4/homebrew/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/DomT4/homebrew/downloads","issues_url":"https://api.github.com/repos/DomT4/homebrew/issues{/number}","pulls_url":"https://api.github.com/repos/DomT4/homebrew/pulls{/number}","milestones_url":"https://api.github.com/repos/DomT4/homebrew/milestones{/number}","notifications_url":"https://api.github.com/repos/DomT4/homebrew/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/DomT4/homebrew/labels{/name}","releases_url":"https://api.github.com/repos/DomT4/homebrew/releases{/id}","created_at":"2014-08-24T19:01:40Z","updated_at":"2015-03-02T18:03:17Z","pushed_at":"2015-03-02T18:03:16Z","git_url":"git://github.com/DomT4/homebrew.git","ssh_url":"git@github.com:DomT4/homebrew.git","clone_url":"https://github.com/DomT4/homebrew.git","svn_url":"https://github.com/DomT4/homebrew","homepage":"http://brew.sh","size":36508,"stargazers_count":0,"watchers_count":0,"language":"Ruby","has_issues":true,"has_downloads":false,"has_wiki":false,"has_pages":true,"forks_count":2,"mirror_url":null,"open_issues_count":0,"forks":2,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"Homebrew:master","ref":"master","sha":"756da4a5a1f9c6fc42f8708503297eb9ff55b9be","user":{"login":"Homebrew","id":1503512,"avatar_url":"https://avatars.githubusercontent.com/u/1503512?v=3","gravatar_id":"","url":"https://api.github.com/users/Homebrew","html_url":"https://github.com/Homebrew","followers_url":"https://api.github.com/users/Homebrew/followers","following_url":"https://api.github.com/users/Homebrew/following{/other_user}","gists_url":"https://api.github.com/users/Homebrew/gists{/gist_id}","starred_url":"https://api.github.com/users/Homebrew/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Homebrew/subscriptions","organizations_url":"https://api.github.com/users/Homebrew/orgs","repos_url":"https://api.github.com/users/Homebrew/repos","events_url":"https://api.github.com/users/Homebrew/events{/privacy}","received_events_url":"https://api.github.com/users/Homebrew/received_events","type":"Organization","site_admin":false},"repo":{"id":206084,"name":"homebrew","full_name":"Homebrew/homebrew","owner":{"login":"Homebrew","id":1503512,"avatar_url":"https://avatars.githubusercontent.com/u/1503512?v=3","gravatar_id":"","url":"https://api.github.com/users/Homebrew","html_url":"https://github.com/Homebrew","followers_url":"https://api.github.com/users/Homebrew/followers","following_url":"https://api.github.com/users/Homebrew/following{/other_user}","gists_url":"https://api.github.com/users/Homebrew/gists{/gist_id}","starred_url":"https://api.github.com/users/Homebrew/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Homebrew/subscriptions","organizations_url":"https://api.github.com/users/Homebrew/orgs","repos_url":"https://api.github.com/users/Homebrew/repos","events_url":"https://api.github.com/users/Homebrew/events{/privacy}","received_events_url":"https://api.github.com/users/Homebrew/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/Homebrew/homebrew","description":"The missing package manager for OS X.","fork":false,"url":"https://api.github.com/repos/Homebrew/homebrew","forks_url":"https://api.github.com/repos/Homebrew/homebrew/forks","keys_url":"https://api.github.com/repos/Homebrew/homebrew/keys{/key_id}","collaborators_url":"https://api.github.com/repos/Homebrew/homebrew/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/Homebrew/homebrew/teams","hooks_url":"https://api.github.com/repos/Homebrew/homebrew/hooks","issue_events_url":"https://api.github.com/repos/Homebrew/homebrew/issues/events{/number}","events_url":"https://api.github.com/repos/Homebrew/homebrew/events","assignees_url":"https://api.github.com/repos/Homebrew/homebrew/assignees{/user}","branches_url":"https://api.github.com/repos/Homebrew/homebrew/branches{/branch}","tags_url":"https://api.github.com/repos/Homebrew/homebrew/tags","blobs_url":"https://api.github.com/repos/Homebrew/homebrew/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/Homebrew/homebrew/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/Homebrew/homebrew/git/refs{/sha}","trees_url":"https://api.github.com/repos/Homebrew/homebrew/git/trees{/sha}","statuses_url":"https://api.github.com/repos/Homebrew/homebrew/statuses/{sha}","languages_url":"https://api.github.com/repos/Homebrew/homebrew/languages","stargazers_url":"https://api.github.com/repos/Homebrew/homebrew/stargazers","contributors_url":"https://api.github.com/repos/Homebrew/homebrew/contributors","subscribers_url":"https://api.github.com/repos/Homebrew/homebrew/subscribers","subscription_url":"https://api.github.com/repos/Homebrew/homebrew/subscription","commits_url":"https://api.github.com/repos/Homebrew/homebrew/commits{/sha}","git_commits_url":"https://api.github.com/repos/Homebrew/homebrew/git/commits{/sha}","comments_url":"https://api.github.com/repos/Homebrew/homebrew/comments{/number}","issue_comment_url":"https://api.github.com/repos/Homebrew/homebrew/issues/comments{/number}","contents_url":"https://api.github.com/repos/Homebrew/homebrew/contents/{+path}","compare_url":"https://api.github.com/repos/Homebrew/homebrew/compare/{base}...{head}","merges_url":"https://api.github.com/repos/Homebrew/homebrew/merges","archive_url":"https://api.github.com/repos/Homebrew/homebrew/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/Homebrew/homebrew/downloads","issues_url":"https://api.github.com/repos/Homebrew/homebrew/issues{/number}","pulls_url":"https://api.github.com/repos/Homebrew/homebrew/pulls{/number}","milestones_url":"https://api.github.com/repos/Homebrew/homebrew/milestones{/number}","notifications_url":"https://api.github.com/repos/Homebrew/homebrew/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/Homebrew/homebrew/labels{/name}","releases_url":"https://api.github.com/repos/Homebrew/homebrew/releases{/id}","created_at":"2009-05-20T19:38:37Z","updated_at":"2015-03-02T18:32:59Z","pushed_at":"2015-03-02T17:14:33Z","git_url":"git://github.com/Homebrew/homebrew.git","ssh_url":"git@github.com:Homebrew/homebrew.git","clone_url":"https://github.com/Homebrew/homebrew.git","svn_url":"https://github.com/Homebrew/homebrew","homepage":"http://brew.sh","size":1451012,"stargazers_count":21677,"watchers_count":21677,"language":"Ruby","has_issues":true,"has_downloads":false,"has_wiki":true,"has_pages":true,"forks_count":10826,"mirror_url":null,"open_issues_count":324,"forks":10826,"open_issues":324,"watchers":21677,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/Homebrew/homebrew/pulls/37164"},"html":{"href":"https://github.com/Homebrew/homebrew/pull/37164"},"issue":{"href":"https://api.github.com/repos/Homebrew/homebrew/issues/37164"},"comments":{"href":"https://api.github.com/repos/Homebrew/homebrew/issues/37164/comments"},"review_comments":{"href":"https://api.github.com/repos/Homebrew/homebrew/pulls/37164/comments"},"review_comment":{"href":"https://api.github.com/repos/Homebrew/homebrew/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/Homebrew/homebrew/pulls/37164/commits"},"statuses":{"href":"https://api.github.com/repos/Homebrew/homebrew/statuses/6aeb816096780c92ffc11e58fb53600e7eeb1b8c"}}}}