Arch Linux

MD5 was cryptographically broken in 2008 and SHA1 in 2005, both are not considered suitable for security use. This todo list contains all packages that:

1) use a remote artifact as source= (starts with http://, https://, ftp://, ...)
2) the artifact is not a VCS source (like git+https://)
3) the artifact is not pinned by at least one secure cryptographic hash function (sha256sums=, sha512sums=, b2sums=, ...)