what should clients do with multiple hash algos #174

jku · 2024-08-26T10:45:37Z

Some open questions not defined in spec:

if there are mutliple hash algorithms listed for an artifact, must the client verify all of them?
if client only supports some of the algorithms listed, is it ok to only verify those
should the client be able to use metadata that contains hash algorithms it does not support or know about (assuming hashes can be verified using known algorithms)?

* Spec does not clearly state what algorithms should be supported * Test for sha256, sha512 and finally both of them * Test a unknown hash algo as well * Avoid testing unknown + known algo: the expected results is not clear, see theupdateframework#174 If we had a good "optional feature" selection we could use that for the supported algorithms but for now I think xfail works for this case. Signed-off-by: Jussi Kukkonen <[email protected]>

* Spec does not clearly state what algorithms should be supported * Test for sha256, sha512 and finally both of them * Test a unknown hash algo as well * Avoid testing unknown + known algo: the expected results is not clear, see #174 If we had a good "optional feature" selection we could use that for the supported algorithms but for now I think xfail works for this case. Signed-off-by: Jussi Kukkonen <[email protected]>

jku added the specification label Aug 26, 2024

jku mentioned this issue Aug 26, 2024

Add tests for hash algorithm support #175

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

what should clients do with multiple hash algos #174

what should clients do with multiple hash algos #174

jku commented Aug 26, 2024 •

edited

Loading

what should clients do with multiple hash algos #174

what should clients do with multiple hash algos #174

Comments

jku commented Aug 26, 2024 • edited Loading

jku commented Aug 26, 2024 •

edited

Loading