301257 - Make post-mozilla-rel.pl use a stronger crypto hash when creating update.snippet

Status: RESOLVED WORKSFORME

(Toolkit :: Application Update, defect)

Description

[Darin Fisher]

Make post-mozilla-rel.pl use a stronger crypto hash when creating update.snippet

Currently, it is using MD5, and we should instead leverage a perl crypto module
to use a stronger hash.  MD5 is probably fine in practice, but for good measure,
we probably ought to use something stronger (because we can).

Comment 1

[Doug Turner (:dougt)]

does the perl install use the DIGEST package?  I think that comes with sha1.

Comment 2

[Darin Fisher]

Here's a pointer to the code:
http://lxr.mozilla.org/mozilla/source/tools/tinderbox/post-mozilla-rel.pl#418

Comment 3

[Darin Fisher]

Oops, I forgot to mention that the version of post-mozilla-rel.pl that is
actually in production has been modified to select md5 instead of sha1 because
some of the tinderboxen do not have the sha1sum program installed.

Comment 4

[Jean-Marc Desperrier]

I think the resolution to this bug is to install sha1sum on all tinderboxen, and
modify the script. Isn't it a really minor change to install sha1sum ?

Should this be assigned to chase ?

Comment 5

[Robert Strong (they/them - no direct email)]

We are using SHA1 now on the tinderboxen... resolving wfm since I don't know the bug that changed this.