create manifest-sha256.txt vs. manifest-md5.txt?

[libbyhopfauf]

I'm wondering if for video AIPs we should consider changing the method for verifying data integrity from manifest-md5 to manifest-sha256? I did this for the audioaip script, but wasn't sure if we should also do it for video so they are more secure.

@privatezero thoughts?

[libbyhopfauf]

Just making a note that if we do this, we'd need to update the ltomanifest for ltotools as well so that it would be reading the information in the correct files (vs. not being able to find the manifest-md5 files).

[privatezero]

@libbyhopfauf - curious what exactly you mean by 'more secure' as I don't really use the checksums generated in this process for 'security' but rather than as a means to see if any data has inadvertently changed. SHA256 is more 'secure' in the sense that it is better than MD5 now at protecting against actual data attacks where people are able to create malicious files that still validate against the same checksum , but that isn't really what we are using the checksums for here.

MD5 is still ok for checking file sameness in a non-security context, as I'm pretty sure that the odds of a file getting corrupted in a way that still somehow validates against he same MD5 are astronomically low. MD5 is faster/less processor intensive to both generate and check (although that difference might be closing with modern processing). For all my things, I'm sticking with MD5 because I think it fits the use case, but there isn't any problem with you changing to SHA256 I'd say.

[libbyhopfauf]

I guess it was mainly the security thing, but TBH, all the conversation I saw around this were a little TLDR. I know a lot of peeps are worried about security right now, but on the other hand my first though was, "who is breaking into archives and create malicious files?" I really didn't have a strong opinion about it and was just hoping to get your expert opinion :) I like the idea of faster and less processing and I think our partners would prefer that as well. I'll make the change in the PR for audiotools!