Re: [bitbake-devel][PATCH] fetch: Upgrade shown checksum to SHA-512

On Wed, May 13, 2026 at 2:21 PM Alexander Kanavin
<[email protected]> wrote:
>
> On Wed, 13 May 2026 at 16:46, Joshua Watt via lists.openembedded.org
> <[email protected]> wrote:
> >  CHECKSUM_LIST = [ "goh1", "md5", "sha256", "sha1", "sha384", "sha512" ]
> > -SHOWN_CHECKSUM_LIST = ["sha256"]
> > +SHOWN_CHECKSUM_LIST = ["sha256", "sha512"]
>
> This raises so many questions :)
> - why suggest adding/fixing both sha256 and sha512 to users, and not
> just sha512? One checksum is enough, and causes less visual clutter in
> recipes

I suspect we'd want to make SHA-512 the only option by the next LTS. I
don't have a strong opinion if we do that now or in a future release.

> - if sha512 is suggested, should devtool be tweaked to add that in
> version upgrades and newly added recipes? (something similar was
> previously done to assist md5 to sha256 transition)

Probably, but only if we make SHA 512 the only option, so see above.

> - last but not least, should we look into adding support for better,
> newer ways to identify commits in git, replacing the classic,
> not-that-secure sha1 ?

I've not seen any guidance about what to do with git SHAs in e.g. BSI
TR-03183, so I'm operating under the assumption that SHA 1 is fine for
now. If you know of a better way to do it, and/or see some
specification that demands we do something different, we can discuss
that. Either way, I would consider changing the way git works as out
of scope for this change.

>
> Alex