Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Offer stronger digest algorithm(s) than MD5 #721

Open
ferki opened this issue Jun 13, 2015 · 4 comments
Open

Offer stronger digest algorithm(s) than MD5 #721

ferki opened this issue Jun 13, 2015 · 4 comments

Comments

@ferki
Copy link
Member

ferki commented Jun 13, 2015

Digest::MD5 is available as a core module on all supported perl versions, which makes it a convenient choice for checksumming e.g. to detect changes before/after file operations. However it would be very nice to offer other, stronger algorithms to do the same. SHA2 and SHA3 comes into mind particularly.

At first glance this would also mean having some "smart default chooser" based on the perl version used and/or module availability in general, plus configuration options to enforce using a specific algorithm (and probably failing it not posssible, or at least falling back to other methods, but notifying the user about the fact).

credits: topic originally brought up by stephanj on IRC

@ipcjk
Copy link

ipcjk commented Sep 4, 2015

I have already seen Digest::MD5 not installed by default e.g. on RHEL7.

@ferki
Copy link
Member Author

ferki commented Sep 4, 2015

@ipcjk: thanks for the info! Do you also have some resources which explain why did they chose not to provide core perl modules by default? I mean I accept this as a fact, and looks like we need to be more careful about module availability on the remotes, but I'd like to understand their reasons too :)

@ipcjk
Copy link

ipcjk commented Sep 4, 2015

Maybe its the old redhat perl problem?
http://www.nntp.perl.org/group/perl.perl5.porters/2009/08/msg149747.html

The contents of the current perl package is viewable here http://rpm.pbone.net/index.php3/stat/6/idpl/29075650/dir/centos_7/com/perl-5.16.3-285.el7.x86_64.rpm

I always put a dependency on the package perl-Digest-MD5 in my Rexfile or else things will break. Maybe we can put a warning and/or a workaround (md5sum [coreutils]-packages or openssl md5) in.

@ferki
Copy link
Member Author

ferki commented Sep 4, 2015

@ipcjk: thanks for the useful info! I think we can try to detect availability first, and printing out a nice error message, or even try to install it (after enabling a feature flag). It might also worth to open an issue in Red Hat's tracker about it, but I doubt it's going to be fixed (at least soon-ish). Anyhow I'd like to avoid hijacking this issue and handle those todos on a different one.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants