You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The opamHash module is in the same opam-core library, and already provides the required functionality. But opamDirTrack uses Digest (from the OCaml stdlib) directly. Is there a reason for this?
If not, it'd be great to be able to select which hash kind to use for DirTrack (maybe via a new field in opamCoreConfig.t?). This would be especially useful for tools such as orb (where maybe some threat models are ruling out to use MD5).
Another option would be to reuse the precise_tracking field, and store a opamHash.t option in there instead of a bool.
The text was updated successfully, but these errors were encountered:
It is possible to add an argument to OpamDirTrack function, that has as default precise_tracking. In that case, the hash format check can be done only at OpamDirTrack level, as OpamStd.Core can't depend on OpamHash.
For Digest use, i'll ping @AltGr . Note that those hashes would be needed on a bunch of files, and default sha256 & sha512 call openssl for each computation, if OPAMUSEOPENSSL/use_openssl is not set to false. Otherwise, it's the internal implementation in OpamSHA.
The opamHash module is in the same opam-core library, and already provides the required functionality. But opamDirTrack uses
Digest
(from the OCaml stdlib) directly. Is there a reason for this?If not, it'd be great to be able to select which hash kind to use for DirTrack (maybe via a new field in opamCoreConfig.t?). This would be especially useful for tools such as orb (where maybe some threat models are ruling out to use MD5).
Another option would be to reuse the
precise_tracking
field, and store aopamHash.t option
in there instead of a bool.The text was updated successfully, but these errors were encountered: