spdx-spec
spdx-spec copied to clipboard
spdx
Permit SHA256 to be optionally used rather than SHA1 as "mandatory" file hash
(reference to related but different issue #11: Deprecating SHA1)
Sections 4.4.3 and 4.4.4 of the spec currently read:
4.4.3 Cardinality: Mandatory, one SHA1, others may be optionally provided. 4.4.4 Algorithm: SHA1() is to be used on the file. Other algorithms that can be provided optionally include SHA256(), MD5().
Because of the option to include SHA256 hashes, applications that are concerned about SHA1 weaknesses can use SHA256. However, 4.4.3 would still require them to include SHA1 hashes in the document as well.
Is there any reason not to change 4.4.3 to something like: "Mandatory, one SHA1 or SHA256, others may be optionally provided"?
This is likely a breaking change (and therefore more appropriate for 3.0 rather than 2.2). It would mean that a valid SPDX document could omit all SHA1 hashes, while a 2.x reader can expect to find SHA1 hashes present.
If we're considering breaking changes, I would go all the way and propose no restrictions on which algorithms have to be there:
Cardinality: Mandatory, one or many.
One comment on this, which I just realized: The current algorithm for the Package Verification Code is based on calculating a SHA1 sum from the sorted SHA1 values for all Files in that Package. If SHA1 were no longer mandatory, then those SHA1 values could not be assumed to be present in the document. This would likely mean that the Package Verification Code algorithm would need to change.
One comment on this, which I just realized: The current algorithm for the Package Verification Code is based on calculating a SHA1 sum from the sorted SHA1 values for all Files in that Package. If SHA1 were no longer mandatory, then those SHA1 values could not be assumed to be present in the document. This would likely mean that the Package Verification Code algorithm would need to change.
Can the spec state that the Package Verification Code needs to be calculated using the algorithm that was used to calculate the checksum of the files in that package? So when validating, we check the PackageChecksum's algorithm and use the same one to verify the Package Verification Code.
We no longer require a specific file hash in 3.0.
Closing this specific issue.
If we want to include a specific file hash, please open a new PR (soon) as it would be a breaking change.
cc: @kestewart
