Some platforms only have SHA-1

[ljharb]

See nvm-sh/nvm#171

Not every system will have the ability to compute sha-256 checksums. Could you also provide SHA-1 checksums alongside the SHA-256 checksums?

This will also allow the code path to remain simple in http://nvm.sh since nodejs.org only provides SHA-1.

[DomT4]

Could also consider implementing a fallback when sha256sum can't be found. Given OpenSSL's prevalence, it'd be relatively safe to fallback onto that. I can't think of a major platform off of the top of my head that doesn't or can't relatively easily support either OpenSSL or the shasum family; OS X is troublesome because the system OpenSSL is ancient, but may be able to dance with CommonCrypto there.

Not opposed to shipping SHA1sums as well, at all. Just pondering.

[ljharb]

I guess my concern is that, at the moment, I'll have to ship iojs support with zero checksum support whatsoever. SHA-1 may be less secure than SHA-256, but it's more secure than nothing :-)

[rvagg]

I'm just not convinced there is a platform that our binaries can support that can't do 256 if they can do shasumming at all. CentOS5 is the lowest we go and it doesn't even come with a shasum in its main repos!

[rvagg]

so CentOS6 comes with a shasum by default it seems but there is also a sha256sum installed along with it

[rvagg]

@ljharb ping me on IRC if you want some test machines on these old Linuxes and I can fire up some temporary ones on DigitalOcean for you to test with

[chrisdickinson]

Is this still an extant issue? Should the issue be moved to iojs/build?

[rvagg]

Yes, lets close here, I remain unconvinced there is a case for cluttering up our release directories with more files because (a) there hasn't been an enumeration of systems where sha-1 is available but sha-256 is unavailable and (b) even if such systems can be listed, I really don't believe they are targets for nvm, they are more likely to be production machines where nvm doesn't make much sense.

I do regret being difficult about this but one of the nice things about io.js is that we can make a break with older conventions that have been built up, including things like sticking to ancient versions of V8 because of toolchain concerns and the fact that we've reorganised the way naked Windows binaries are distributed in the /dist/ directory. I see SHASUMS.txt as one of these because the original reason for shipping it is no longer relevant.

i.e. please open an issue on iojs/build if there is still a concern about this but it's going to take some convincing, not just hand-waving and hypotheticals.