So, a couple of things came out of the meeting on Monday concerning these changes.
----
First, people seemed to be in agreement that having the hash type in the path on the lookaside cache was a good idea.
That should just be a trivial change to one of the patches: https://lists.fedoraproject.org/pipermail/infrastructure/2014-March/014189.h...
I'll submit a new version of that one soon.
----
However, the discussion showed that we didn't have a clear consensus on whether we would use only one hash or several, and which one(s) we'd use.
To me, one thing is clear: we should keep the existing md5 hashes around for some time, at least as long as some package modules still use a md5 hash in their "sources" file.
Dennis wants us to "convert" all of these to stronger hashes, which we could certainly do. (I'll start looking into writing a script that does that soon)
But the question is about what to do on new uploads.
I would personally prefer that we stored only one hash, and that we'd use the strongest currently available. (that would be sha512?)
But Till made the point that storing multiple hashes makes it easier to compare our sources with other projects or upstreams (as they might have hashes for different algorithms).
At this point, I don't mind implementing that, but it seems others preferred having only one hash...
As I said in the meeting, I'm happy to implement whatever ends up being the consensus. Can we build one? :)