[arch-general] Pointless to use non-md5 for makepkg INTEGRITY_CHECK

[Aaron Griffin]

On Mon, Jan 12, 2009 at 2:22 PM, Aaron Schaefer <aaron at elasticdog.com> wrote:
> Once that patch gets pushed to the public, what do people think about
> switching over to sha256 as a default instead of md5 due to potential
> collision/security issues?

Haven't we been over this like a hundred times? md5sums are not used
for security. Not ever. Nope. Nada.

We use them solely to detect whether or not the download completed as
expected. And sha256 is going way overboard here.