Fixity block case sensitivity

[pwinckles]

As JSON keys are case sensitive, while digests may not be, there is an additional requirement that each digest value MUST occur only once in the fixity block for any digest algorithm, regardless of case.

This mirrors the requirement for the manifest, but I do not think it is a requirement that can be generally applied to the fixity block. As per #534, the spec leaves the door open for non-hex encodings. If a new a digest algorithm is added and it's, say, base64 encoded, it would be wrong to treat the keys as case-insensitive.

I think the requirement either needs to be removed, or there needs to be additional language to clarify that it applies selectively based on encoding.

[zimeon]

I agree that this is a problem. There could be a digest algorithm where abc and ABC are both valid and different values. I think the actual requirement is:

• For digest algorithms with case insensitive digest values, each digest value MUST occur only once in the fixity block for that digest algorithm, regardless of case.

[awoods]

@zimeon : Is your suggestion here to update both occurrences (found in the manifest and fixity sections) of:

As JSON keys are case sensitive, while digests may not be, there is an additional requirement that each 
digest value must occur only once in the fixity block for any digest algorithm, regardless of case.

..to become:

As JSON keys are case sensitive, for digest algorithms with case insensitive digest values, there is an 
additional requirement that each digest value must occur only once in the [fixity|manifest] block for 
any digest algorithm, regardless of case.

[zimeon]

2021-12-21 agreed to #564 (comment) in editors' meeting