Subject: Re: bug#55666: enhancement request - SHA-256 for emacs downloads

From: Ali Elshishini <[email-masked]>
Date: Sun, 29 May 2022 19:46:52 +0000

the hash dont match

PS C:\downloads> Get-FileHash -Algorithm SHA256 .\emacs-28.1.zip | select -ExpandProperty hash | % tolower
0ef568df955fec4721634336585968fe593f3b008fce936a464fb524e5a3f009

Your hash is
9006f875255056af0bb318298537f66353806b64eee0c3a593c5862328e685fc *emacs-28.1.zip

I redownloaded the file from https://ftp.gnu.org/gnu/emacs/windows/emacs-28/
just to be sure

Thanks
Ali

________________________________
From: Corwin Brust <[email-masked]>
Sent: May 29, 2022 2:53 PM
To: Ali Elshishini <[email-masked]>
Cc: Lars Ingebrigtsen <[email-masked]>; [email-masked] <[email-masked]>
Subject: Re: bug#55666: enhancement request - SHA-256 for emacs downloads

On Sun, May 29, 2022 at 12:08 PM Ali Elshishini <[email-masked]> wrote:
>
> First sorry for top posting, I am using hotmail/outlook, and dont know how to setup bottom posting
> Also honestly, I never really knew about this convention of bottom posting

It's not a problem for me; more of a "netiquette" WRT to mailing
lists, in general.

> Second, that a lot Corwin, adding the SHA hashes will be great

Let see if others voice opinions; if not I'm happy to start doing that.

> Finally, just my 2 cent, SHA1 is to my knowledge is considered obsolete and broken https://en.wikipedia.org/wiki/SHA-1
> So I think SHA-256 should be enough, and if you want to can consider SHA-512

I'm not convinced of any practical benefit to SHA256 (or 512) WRT
verification of data integrity (although I do understand SHA1 isn't
recommended for encryption/cryptographic use-cases.

That said, here are SHA256 sums for the present binaries for Emacs 28.1:

c31fc9e1b48eeb3a50dcc161e4749b304d25e23bf33c287b50bfe9e3f4742577
*emacs-28.1-installer.exe
da25ef9e067d630995c43faf460f991c4d5b2020a0fc02c7a7955069bf977508
*emacs-28.1-no-deps.zip
9006f875255056af0bb318298537f66353806b64eee0c3a593c5862328e685fc *emacs-28.1.zip
9c8c6066a4a1a4f68b44a0158af255ebe8671a5bcd6fb5e9db7fea26b6a3d4eb
*emacs-28.1-DEBUG-installer.exe
659b8281c301ea1c2e03b6bf935f1e488ed4f4d787cb4e7c23fce494193b6525
*emacs-28.1-DEBUG-no-deps.zip
3962e056ef58b32ad9b175a7e2ea3ed6e18c397f4825bb9756bef6e5606b930e
*emacs-28.1-DEBUG.zip
8f963ced4d88c4ed802676f59f2417b660cf8c494bd9bf9fe19bb4ca1be2a940
*emacs-28-deps-mingw-w64-src.zip
ba7e56f76a1d550add33dc4d28bb8e1dcd6d5882cb2be03b30441491873c01d5
*emacs-28-deps.zip

Please do let me know if signatures appear to be a mismatch with what
you have downloaded.