Repository navigation
package: Accept sha512 digests for repository files - #403
Open
daandemeyer wants to merge 2 commits into
Open
daandemeyer wants to merge 2 commits into
daandemeyer wants to merge 2 commits into
Conversation
martinpitt
approved these changes
Nov 13, 2026
martinpitt
left a comment
martinpitt
left a comment
Member
There was a problem hiding this comment.
Nice, thanks! The buck bump needs the new digests, I take the liberty to push them to your branch.
openSUSE publishes sha512 checksums for its repository metadata and packages, but the pinned buck2 only verifies a download against a sha1 or sha256. The 2026-11-12 release accepts a sha512 in download_file(), so let's bump to it. Signed-off-by: Daan De Meyer <daan@amutable.com>
openSUSE states a sha512 for every package and every repomd stream, and no sha256. The snapshot, the transaction and the package pool only accept a sha256, so we can't pin an openSUSE repository. Let's key a package by its sha256 or its sha512, and tell a sha256 from a sha512 by its length. A metadata file then contains whichever digest its repository states, and download_file() checks that digest. Signed-off-by: Daan De Meyer <daan@amutable.com> Signed-off-by: Martin Pitt <martin@amutable.com>
martinpitt
force-pushed
the
sha512-digests
branch
from
November 13, 2026 06:47
143e472 to
96edae1
Compare
martinpitt
enabled auto-merge (rebase)
November 13, 2026 06:47
daandemeyer
disabled auto-merge
November 13, 2026 06:51
Member
Author
|
Don't merge just yet this needs more work |
Member
|
@daandemeyer oh, ok -- want to land the buck2 bump separately? that feels independent and a nice prep to regression test the new version and get the digest updated. |
Member
Author
|
We can land it, though I wouldn't use the sha512 stuff just yet, it might need work before it's usable for this and other use cases given how much claude is going in circles here. |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
openSUSE states only a sha512 for its packages and repomd streams, while the
snapshot, the transaction and the package pool only take a sha256. Let's bump
buck2 to a release whose download_file() checks a sha512, key a package by its
sha256 or sha512 (told apart by length), and let a metadata file carry
whichever digest its repository states. This is the groundwork for an openSUSE
release in the catalog.