From 71ef1b091a1147de291e49fd3403ae4fb499aca5 Mon Sep 17 00:00:00 2001 From: Dominyk Tiller Date: Sun, 22 Oct 2017 03:17:00 +0100 Subject: [PATCH] Checksum_Deprecation: tweak phrasing/explanation/etc --- docs/Checksum_Deprecation.md | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/docs/Checksum_Deprecation.md b/docs/Checksum_Deprecation.md index 3ef0d41ecf..a2e49e50ae 100644 --- a/docs/Checksum_Deprecation.md +++ b/docs/Checksum_Deprecation.md @@ -1,22 +1,18 @@ # MD5 and SHA-1 Deprecation -During early 2015 Homebrew started the process of deprecating _SHA1_ for package -integrity verification. Since then every formulae under the Homebrew organisation -has been moved onto _SHA256_ verification; this includes both source packages -and our precompiled packages (bottles). +In early 2015 Homebrew started the process of deprecating _SHA1_ for package +integrity verification. Since then formulae under the Homebrew organisation +have been moved onto using _SHA256_ for verification; this includes both source +packages and our precompiled packages (bottles). -We have stopped supporting _SHA1_ and _MD5_ entirely. -_MD5_ checksums were removed from core formulae in 2012 but until April 2015 -if you tried to install a formula still using one Homebrew wouldn't actively stop you. +Homebrew has since stopped supporting _SHA1_ and _MD5_ entirely. +_MD5_ checksums were removed from core formulae in 2012 and as of April 2015 +installing a formula verified by _MD5_ is actively blocked. We removed _SHA1_ support in **November 2016**, 21 months after we started warning people to move away from it for verification. This is enforced in the same way _MD5_ is, by blocking the installation of that individual formula until the checksum is migrated. -From March 20th 2016 we've stepped up the visibility of that notification & you'll start -seeing deprecation warnings when installing _SHA1_-validated formula. -If you see these please consider reporting it to where the formula originated. - This means custom taps, local custom formulae, etc need to be migrated to use _SHA256_ before you can install them.