{"issue":{"title":"Sha256 trust","user":{"login":"richoH","id":476418,"url":"https://api.github.com/users/richoH","avatar_url":"https://secure.gravatar.com/avatar/78112a4ae9b68d8876a1043023dc1825?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","gravatar_id":"78112a4ae9b68d8876a1043023dc1825"},"created_at":"2011-08-24T09:50:27Z","milestone":null,"labels":[],"state":"closed","updated_at":"2011-12-28T05:17:27Z","id":1473183,"closed_at":"2011-08-25T00:45:05Z","html_url":"https://github.com/wayneeseguin/rvm/issues/381","pull_request":{"patch_url":"https://github.com/wayneeseguin/rvm/pull/381.patch","html_url":"https://github.com/wayneeseguin/rvm/pull/381","diff_url":"https://github.com/wayneeseguin/rvm/pull/381.diff"},"body":"Hi Wayne,\r\n\r\nI use rvm a lot at work btw. Thanks.\r\n\r\nHowever, md5 has been repeatedly proven to be a weak alogorithm cryptographically. I can't find the paper at the moment, but a great example was the group who claimed to know who would win the next presidential election. Without wanting to specify who, they said they'd release the checksum now and the paper after the election. Clearly, they had multiple documents with the same md5 sum, but the gist of their research was proof of md5's insecurities.\r\n\r\nBy requiring the rvmrc's to pass both md5 and sha256 verification, the potential for collision becomes infinitessimally small, for a tiny performance hit, considering how often they are generally checked.\r\n\r\nThe test suite does not pass on my machine (either on master or my branch) but the same tests fail either way.\r\n\r\nLet me know if there's anything you'd prefer implemented differently.\r\n\r\nCheers\r\n\r\nricho","number":381,"url":"https://api.github.com/repos/wayneeseguin/rvm/issues/381","comments":11,"assignee":null},"comment":{"user":{"login":"mpapis","id":48054,"url":"https://api.github.com/users/mpapis","avatar_url":"https://secure.gravatar.com/avatar/3ec52ed58eb92026d86e62c39bdb7589?d=https://a248.e.akamai.net/assets.github.com%2Fimages%2Fgravatars%2Fgravatar-140.png","gravatar_id":"3ec52ed58eb92026d86e62c39bdb7589"},"created_at":"2011-12-28T05:17:27Z","updated_at":"2011-12-28T05:17:27Z","id":3288257,"body":"i can not be sure but it might be, osx-gcc-installer has reference to `perl5` ... not sure what does it mean - but it's mentioned lots of times in there","url":"https://api.github.com/repos/wayneeseguin/rvm/issues/comments/3288257"},"action":"created"}