By and large I agree with you about the hash algorithm being irrelevant, however, some entities have requirements for minimum acceptable hashing for such kind of verification. I think a baseline of a choice between md5 and shasum baseline is fine, especially while development of the feature is ongoing (md5 is still widely used in forensics), however that will not always be the case and building support in for additional options might be better. The time cost involved is something the end user should accept when they select the additional complexity.
Just as a test, I timed sha 512 on my Windows 10 image. Here is the results:
d0715180-198f-4f02-93d6-a638d573b1e9-image.png
Took about 2m 8s for 8 GB give or take. So the wait isn’t terrible at higher algorithm complexity. This test was done with a two virtual processor VM on a server with a bunch of other vms running.
Interestingly enough, the shasum utility on ubuntu can compare hashes to a text file for verification.
4e873e2c-fd44-4f6e-b026-0462cccbd356-image.png
Also, I don’t think the hash need be taken inline with the imaging process, but be done post imaging, either on demand, or run in background automatically before image is made available for distribution.
Thoughts?