And This is Why build2 Uses SHA256
I am sure most of you have heard the news by now. And that's why in
build2 we use SHA256 from the outset. This is especially
important for the bpkg(1) package
manager since here we are talking about trust and not mere content
addressing, as is the case with git.
The security model of bpkg revolves around a simple
question: what happens when the server that hosts packages gets
compromised? Note that it's "when", not "if".
So bpkg repositories are signed using the public/private key
cryptography. More specifically, we generate an SHA256 sum for each package
and then sign this list of packages and their hash sums (called the
repository manifest) with the repository's private key. Provided you
do this manifest generation and signing on a firewall'ed, secure machine,
not much can happen if the package server gets compromised: the intruder
cannot replace a package since that would require either altering the
manifest (need private key) or forging the hash sum (need SHA1).
In fact, for cppget.org we
go a step further and keep the repository's private key on a Yubikey device,
in case the secure machine gets stolen. For details see bpkg-repository-signing(1).