pythonPackages.mpv: 0.1 #11620
pythonPackages.mpv: 0.1 #11620
Conversation
| src = pkgs.fetchurl { | ||
| url = "https://pypi.python.org/packages/source/m/mpv/${name}.tar.gz"; | ||
| md5 = "48114a00be2dc8898a88b3a253362fae"; | ||
| }; |
There was a problem hiding this comment.
pypi does md5. As do most packages in this file. Also, what’s wrong with them in this case?
There was a problem hiding this comment.
Both PyPI and nixpkgs repository still use md5 a lot. That is not good. Why?
The idea of the hash is to know for sure you have the file that you want to have. If a source file in the cache or upstream was changed, you want to know that.
Unfortunately, multiple files can be created with the same hash. Doing this on purpose is a collision attack. A collision attack with an md5 hash can be done in mere seconds if I am correct. With SHA-1 and SHA-2(56) it will take a lot longer.
Last month support for SHA-512 was added to Nix. I suppose we soon should start using SHA-512 then.
|
And also please rename commit to |
Profpatsch
force-pushed
the
python-mpv
branch
from
457cd52 to
b1e44d8
Compare
|
@jagajaga Done. |
No description provided.