Some weaknesses have been discovered in SHA-1, we should migrate to SHA-2 hashes used in repodata. See https://fedoraproject.org/wiki/Features/StrongerHashes for more rationale and information. Eventually this should be possible simply by passing "-s sha256" to createrepo.
This is really a mash and pungi bug, as those are the tools being used to create the distribution. assigning and cloning as such.
Well, without support in createrepo itself, there's very little the tools can do. I think it's best to just have the default set in createrepo, and then we don't need to modify every tool.b
What's the createrepo status here?
sha256 is the default algorithm in createrepo >= 0.9.7.
OK, if it's the default where it's needed, then mash shouldn't need to change.