stop producing MD5 checksums of release artifacts

This is part of a goal to reduce release artifacts to ≤50 files so the list of
files is not truncated in Gitlab pages. MD5 is an obsolete checksum format that
has been deprecated for many years. This commit removes these checksums from
being produced in the deployment flow, leaving SHA256 checksums as the only
option. This is consistent with Gitlab’s Generic Package Registry that provides
an alternative way of seeing file checksums and also only offers SHA256.

This change reduces the number of release artifacts from 56 to 46.

Closes #2147.

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 258f517e3922e6b61049353b0168150de9811cf4..81d2c6eddec28f450fb84ed11667075155378245 100644 (file)
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Check for existence of `dl_iterate_phdr(3)` and if it is available, prefer
   using it instead of iterating over `/proc/self/maps` for computing `libdir`.
 - A limit on GVC config files of 100000 bytes has been removed.
+- MD5 checksums of release artifacts are no longer provided. SHA256 checksums
+  are still provided and these should be used instead.
 
 ### Fixed
 

diff --git a/ci/deploy.py b/ci/deploy.py
index c3f356db4a72d3fc1172f34b17dfbfee88b27e36..ef83783551dd6efa011e4f62e547c9bced58d20b 100644 (file)
--- a/ci/deploy.py
+++ b/ci/deploy.py
@@ -68,13 +68,6 @@ def checksum(path: Path) -> Generator[Path, None, None]:
 
   assert path.exists()
 
-  log.info(f"MD5 summing {path}")
-  check = Path(f"{path}.md5")
-  with open(check, "wt") as f:
-    with open(path, "rb") as data:
-      f.write(f"{hashlib.md5(data.read()).hexdigest()}  {path}\n")
-  yield check
-
   log.info(f"SHA256 summing {path}")
   check = Path(f"{path}.sha256")
   with open(check, "wt") as f: