Hubert Feyrer <hubert@feyrer.de> wrote:

> No, that's by far not enough. Have a look at the pkg_* source.

Ah, okay, I forgot about maintaining. 

[...]

>  * in what form you want to use SHA1 on systems that don't come
>    with openssl in-tree.
>  * How to retain backward compatibility with existing binary packages

For that purpose we should consider using both, MD5 _and_ SHA1
hashes for a period of time.

-Dominik

-- 
/*  Dominik Rothert         |           dr@astorit.com  *
 *  A S T O R I T           |  http://www.astorit.com/  *
 *  Hohenzollernring 52     |       fon +49-221-251440  *
 *  50672 Cologne, Germany  |       fax +49-221-251443  */:wq!