SHA256 checksum for apt-deb

[Anders F Björklund]

Smart only validates the MD5 checksum for dpkg packages. It should check SHA and SHA256 too, when available.

[Anders F Björklund (afb)]

Split off from Bug #331935

[Clint Byrum (clint-fewbar)]

Upon inspection, the linked branch has been merged and this code is included in v1.3.

[Anders F Björklund (afb)]

Well, the sha256 parser has been merged but the code only checks md5 if present (if so, sha256 is skipped)

The question is whether it should change to checking sha256 first, otherwise sha1 and lastly fall back to md5.

This was suggested for 1.2, but postponed for performance reasons (I think ?).

Each checksum is about 2 times slower, so checking sha256 takes 4x of md5.

[Anders F Björklund (afb)]

The main reason this only affects apt-deb and not yum-rpm is because the repodata deletes the older checksums, while the debian repository has all three checksums present. Otherwise the same code is shared between all backends.

[Anders F Björklund (afb)]

Now (r991), it will check MD5 first and then SHA too (prefer SHA256, when available)