You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
It's been a few years since the 1.0.0 release with many changes since. Is it possible to cut a stable release? I like the addition of the the Digester interface.
Reacted by Coleman McFarland, nimengliusha, Erik Godding Boye and Rafael Bodill
overall SGTM; there's one thing I was wondering the other day; when I made my PR (some time ago) to register the default algorithms automatically, that also included sha384 (as it "came with the package"), however the OCI spec doesn't list it (I think; on my phone right now), so I wonder if we should register it by default, or somehow make it optional;
Hm, ok, so I had my wires crossed, and thought that before 084376b, the SHA-384 was not registered, but it already was (but could not be used by default, unless "crypto/sha512" was imported.
So removing SHA384 would be a breaking change (and require a major version bump (V2); #97 (comment)
I did open a PR to somewhat improve docs (recommended use / not use);
And perhaps we should indeed consider to remove the "not recommended" algorithms from the default for a V2.0 (don't register SHA-512 and SHA-384 by default, and don't import "crypto/sha512")
My 2c would be to do a release soon and not let the perfect be the enemy of the good. So many Go projects out there still use v1.0.0 due to how Go's "latest version" works by default, and that version is extremely out of date at this point :)
Activity
AkihiroSuda commentedon Sep 20, 2023
SGTM, cc @opencontainers/go-digest-maintainers PTAL
thaJeztah commentedon Sep 20, 2023
overall SGTM; there's one thing I was wondering the other day; when I made my PR (some time ago) to register the default algorithms automatically, that also included sha384 (as it "came with the package"), however the OCI spec doesn't list it (I think; on my phone right now), so I wonder if we should register it by default, or somehow make it optional;
go-digest/sha.go
Line 21 in 5d0a588
thaJeztah commentedon Sep 20, 2023
(basically; it's easier to add these things, than to remove, once released)
corburn commentedon Jan 4, 2024
@thaJeztah agreed a future release could add registering SHA384 by default.
thaJeztah commentedon Jan 30, 2024
Hm, ok, so I had my wires crossed, and thought that before 084376b, the SHA-384 was not registered, but it already was (but could not be used by default, unless
"crypto/sha512"was imported.So removing SHA384 would be a breaking change (and require a major version bump (V2); #97 (comment)
I did open a PR to somewhat improve docs (recommended use / not use);
And perhaps we should indeed consider to remove the "not recommended" algorithms from the default for a V2.0 (don't register SHA-512 and SHA-384 by default, and don't import
"crypto/sha512")nimengliusha commentedon May 15, 2025
It's been a few years since the 1.0.0 release with many changes since. Is it possible to cut a stable release?
kimdre commentedon Jul 29, 2026
Can we expect a new release at some point?
AkihiroSuda commentedon Jul 29, 2026
Let's make a release after merging
IceCodeNew commentedon Aug 25, 2026
Hi there, just in case you missed that, the two PRs blocking a new release was already merged. May we have a new release to celebrate this year? ;-)
AkihiroSuda commentedon Aug 25, 2026
I want this one as well before releasing it
mvdan commentedon Oct 12, 2026
My 2c would be to do a release soon and not let the perfect be the enemy of the good. So many Go projects out there still use v1.0.0 due to how Go's "latest version" works by default, and that version is extremely out of date at this point :)