From: Matthew Fernandez <matthew.fernandez@gmail.com>
Date: Thu, 11 Nov 2021 16:09:12 +0000 (-0800)
Subject: stop producing MD5 checksums of release artifacts
X-Git-Tag: 2.50.0~37^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=0b31ec29078ecee5b868b42453478f1dd8239d54;p=graphviz

stop producing MD5 checksums of release artifacts

This is part of a goal to reduce release artifacts to ≤50 files so the list of
files is not truncated in Gitlab pages. MD5 is an obsolete checksum format that
has been deprecated for many years. This commit removes these checksums from
being produced in the deployment flow, leaving SHA256 checksums as the only
option. This is consistent with Gitlab’s Generic Package Registry that provides
an alternative way of seeing file checksums and also only offers SHA256.

This change reduces the number of release artifacts from 56 to 46.

Closes #2147.
---

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 258f517e3..81d2c6edd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Check for existence of `dl_iterate_phdr(3)` and if it is available, prefer
   using it instead of iterating over `/proc/self/maps` for computing `libdir`.
 - A limit on GVC config files of 100000 bytes has been removed.
+- MD5 checksums of release artifacts are no longer provided. SHA256 checksums
+  are still provided and these should be used instead.
 
 ### Fixed
 
diff --git a/ci/deploy.py b/ci/deploy.py
index c3f356db4..ef8378355 100644
--- a/ci/deploy.py
+++ b/ci/deploy.py
@@ -68,13 +68,6 @@ def checksum(path: Path) -> Generator[Path, None, None]:
 
   assert path.exists()
 
-  log.info(f"MD5 summing {path}")
-  check = Path(f"{path}.md5")
-  with open(check, "wt") as f:
-    with open(path, "rb") as data:
-      f.write(f"{hashlib.md5(data.read()).hexdigest()}  {path}\n")
-  yield check
-
   log.info(f"SHA256 summing {path}")
   check = Path(f"{path}.sha256")
   with open(check, "wt") as f: