2 files changed, 7 insertions, 6 deletions
diff --git a/custom/extensions/email-gravatar.lua b/custom/extensions/email-gravatar.lua
index d5c30fc..95f7aae 100644
--- a/custom/extensions/email-gravatar.lua
+++ b/custom/extensions/email-gravatar.lua
@@ -29,8 +29,8 @@
 --
 -- Every page view sends the visitor's IP address and a hash of each
 -- committer's email to a third-party service, so leave this filter off if
--- that is not acceptable for your instance. Addresses are hashed with MD5,
--- which Gravatar still accepts.
+-- that is not acceptable for your instance. Addresses are hashed with
+-- SHA-256, the form Gravatar documents.
 
 local has_digest, digest = pcall(require, "openssl.digest")
 
@@ -41,7 +41,7 @@ local has_digest, digest = pcall(require, "openssl.digest")
 -- the icon is not blocked as mixed content on an https page.
 local avatar_size = 13
 local default_image = "retro"
-local base_url = "https://www.gravatar.com/avatar/"
+local base_url = "https://gravatar.com/avatar/"
 
 
 -- One name reaches this filter as an open, writes and a close, so what the
@@ -50,7 +50,7 @@ local buffer = ""
 local avatar_hash = nil
 
 local function hash_hex(input)
-	local raw = digest.new("md5"):final(input)
+	local raw = digest.new("sha256"):final(input)
 	local hex = ""
 	for i = 1, #raw do
 		hex = hex .. string.format("%.2x", string.byte(raw, i))
diff --git a/custom/extensions/email-libravatar.lua b/custom/extensions/email-libravatar.lua
index 719be2e..e04c2c2 100644
--- a/custom/extensions/email-libravatar.lua
+++ b/custom/extensions/email-libravatar.lua
@@ -28,7 +28,8 @@
 --
 -- Every page view sends the visitor's IP address and a hash of each
 -- committer's email to a third-party service, so leave this filter off if
--- that is not acceptable for your instance. Addresses are hashed with MD5.
+-- that is not acceptable for your instance. Addresses are hashed with
+-- SHA-256, which Libravatar accepts alongside MD5.
 
 local has_digest, digest = pcall(require, "openssl.digest")
 
@@ -48,7 +49,7 @@ local buffer = ""
 local avatar_hash = nil
 
 local function hash_hex(input)
-	local raw = digest.new("md5"):final(input)
+	local raw = digest.new("sha256"):final(input)
 	local hex = ""
 	for i = 1, #raw do
 		hex = hex .. string.format("%.2x", string.byte(raw, i))