Please remove md5sum and sha1 from the archive metadata

They can be safely removed in bionic and up.

d-i / anna, require MD5SUMs in xenial and down. And we still publish update to debian-installer/* suites.

Thus a blanket approach to remove MD5 & SHA1 can only be taken, once xenial goes end of basic support next year.

It feels like a schema change might be needed to support this.

I.e. introduce a "publish_md5sha1_hashes" boolean publishing_option on the distroseries, default True.

in the publishing.py filter out md5sha1, if the above publishing_option on the distroseries is false.

then set it to false on bionic and up.

Although I guess it should be like index_compressors, i.e. a list of things to do.

Cause we will be adding/removing hashes going into the future.

Comparing the current groovy unsplit mirror dists/, with the one that has md5&sha1 hashes stripped, and recompressed, the grand total win is 35MB.

I think the fact that we added one more kernel in groovy kills any of this gain, in terms of disk saving.

So "improvement" impact from doing this is surely negligible.

It feels that "High" should be changed to "Wishlist"

This is now causing active pain.

For FIPS certifcation of Ubuntu libraries we had to re-implement and re-add md5 with a usage indicator that it is not certified for use. Which costs us development time, and delays in submitting Ubuntu 22.04 for FIPS certification.

Separately sha1 has been deprecated by NIST and purchasing software that uses sha1 will be prohibited in 2030.

This is sort of already within the lifetime of Jammy.

Please remove MD5 and SHA1 from all currently supported Ubuntu Archive releases, as all of them support better hashes.

It doesn't make any sense for this to block FIPS certification. The mere presence of the metadata doesn't require anything to validate it.

Correct presence does not matter. Apt however checks everything that is present. And uses libraries in FIPS mode, and crashes if libgnutls30 doesn't implement or refuses to provide MD5.

This hasn't blocked FIPS submission for Jammy, but made it harder to do so. As we had rebuild gnutls, add md5, add custom code to add FIPS indicator that md5 usage taints APT. Add policy documents explaining that MD5 is available but should not be used, blah blah blah.

Waste of time, engineering, Atsec certification, delaying submission of FIPS, etc.

Also every single FIPS sales is confusing, as they keep looking at our policy documents and questioning why we offer MD5, and have it available at runtime and it is excluded, when it would make this more simple for it to not exist at all.

I don't want to do this ever again, and actually I do want to remove md5 from the distro without anything breaking.

It seems extremely ambitious to remove this retroactively from stable series.