FEAT: Switch default hash-algo to sha256

Closes pypiserver#452

README.rst

@@ -149,7 +149,7 @@ not officially supported, and will not receive bugfixes or new features.
 
       --hash-algo ALGO
         Any `hashlib` available algo used as fragments on package links.
-        Set one of (0, no, off, false) to disabled it (default: md5).
+        Set one of (0, no, off, false) to disabled it (default: sha256).
 
       --welcome HTML_FILE
         Uses the ASCII contents of HTML_FILE as welcome message response.

pypiserver/config.py

@@ -76,7 +76,7 @@ class DEFAULTS:
 
     AUTHENTICATE = ["update"]
     FALLBACK_URL = "https://pypi.org/simple/"
-    HASH_ALGO = "md5"
+    HASH_ALGO = "sha256"
     INTERFACE = "0.0.0.0"
     LOG_FRMT = "%(asctime)s|%(name)s|%(levelname)s|%(thread)d|%(message)s"
     LOG_ERR_FRMT = "%(body)s: %(exception)s \n%(traceback)s"

tests/test_main.py

@@ -131,12 +131,12 @@ def test_fallback_url_default(main):
 
 def test_hash_algo_default(main):
     main([])
-    assert main.app._pypiserver_config.hash_algo == "md5"
+    assert main.app._pypiserver_config.hash_algo == "sha256"
 
 
 def test_hash_algo(main):
-    main(["--hash-algo=sha256"])
-    assert main.app._pypiserver_config.hash_algo == "sha256"
+    main(["--hash-algo=md5"])
+    assert main.app._pypiserver_config.hash_algo == "md5"
 
 
 def test_hash_algo_off(main):