Remove download hashes - Githubissues

bojidar-bg commented 4 years ago

After some discussion on IRC, we decided that it would be beneficial to remove the requirement for download hashes from assets. Rationale:

So far, we have depended that GitHub and other repository providers would never change the way they create .zip files. So far this has not happened, but every single time we have a hash error, we thought this might have been the culprit.
Hashes were a hassle for moderators to generate, and there were many cases of invalid hashes. This was a problem 11 days ago, when I introduced 17d0c2a3c643aeccb0685b09be4ba07ed2eac890, and it happened today as well.
Git commit hashes are as secure as zip hashes (when trusting the repository host), so we don't gain that much by forcing moderators to download and compute hashes of zips.

Obsoletes #6.

bojidar-bg commented 4 years ago

Going to merge and fix eventual issues as they come up. :pray:

ghost commented 2 years ago

Is this being done still? I just went to share an asset and it's asking for the hash and I don't know how to get that yet. (Little concerned because it makes it sound like I can't update it easily.)

Calinou commented 2 years ago

Is this being done still? I just went to share an asset and it's asking for the hash and I don't know how to get that yet. (Little concerned because it makes it sound like I can't update it easily.)

The asset submission page is asking for the Git commit hash, not the SHA-256 checksum of the generated ZIP archive. This PR does not change anything related to Git commit hashes.

ghost commented 2 years ago

Ah, wasn't clear. Sorry.

godotengine / godot-asset-library

Remove download hashes #209