On Tue, Oct 07, 2025 at 12:27:16PM +0200, Patrick Steinhardt wrote:

Yeah, it's definitely my goal here to do exactly that: reach out to
folks and take everyone's input into account. Once we've got it, propose
a timeline.

I guess as part of that initial communication with the stakeholders we
can also mention that the current plan is to release roughly towards the
end of next year, which may help to put things into perspective.

I am not sure what our proposal would be other than max(proposed_dates),
clamped to some reasonable range that we are comfortable with so as not
to delay the transition to use SHA-256 by default too far into the
future.

I think a more interesting question is:

 - What do we do for implementations that do not have a roadmap, or
   whose roadmap is too far into the future?

 - What do we do for implementations that have a roadmap, have a date
   that is palatable to the project, but end up slipping and are unable
   to meet that date?

I generally agree that we have to draw a line in the sand *somewhere*,
but I don't think we should be so inflexible as to say "if you don't
have SHA-256 done by X date, you are out of luck". Of course, if the
amended timeline is too far beyond the initial deadline that's one case.
But if someone is a release cycle or so behind, I think it's reasonable
that the project should be flexible enough to accommodate that.

Thanks,
Taylor