pythonPackages.mpv: 0.1

[Profpatsch]

No description provided.

[FRidh]

sha256?

[Profpatsch]

pypi does md5. As do most packages in this file. Also, what’s wrong with them in this case?

[FRidh]

Both PyPI and nixpkgs repository still use md5 a lot. That is not good. Why?
The idea of the hash is to know for sure you have the file that you want to have. If a source file in the cache or upstream was changed, you want to know that.

Unfortunately, multiple files can be created with the same hash. Doing this on purpose is a collision attack. A collision attack with an md5 hash can be done in mere seconds if I am correct. With SHA-1 and SHA-2(56) it will take a lot longer.

Last month support for SHA-512 was added to Nix. I suppose we soon should start using SHA-512 then.

[jagajaga]

And also please rename commit to pythonPackages.mpv: init at 0.1.

[Profpatsch]

@jagajaga Done.