gravatar has changed hash to sha256

[ppc52776]

Description

gitea can't get avatar from gravatar, the log shows
2025/04/25 18:00:44 routers/web/base.go:80:func2() [W] Unable to find avatars 0f67de64ebe46c139b7d9f3c56732507

The gravatar has changed the avatar url's hash code to sha256: https://gravatar.com/avatar/{sha256}
but the libravatar still using md5 hash.

See the example at developer part:
https://gravatar.com/

Gitea Version

1.23.7

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

docker

Database

None

[wxiaoguang]

but the libravatar still using md5 hash.

libravatar is introduced by gogs/gogs#3320 and maintained by @strk, do you have ideas about how to correct it?

[silverwind]

Maybe it's time to incorporate that lib into gitea, it's only 300 lines of go code.

[becm]

This would also be a good chance to also fix/improve Gitea's already existing avatar endpoints.

It has (maybe by accident) already a Gravatar-MD5-compatible notation for the default email-based avatar.
The content-derived checksum for user-supplied avatars is however incompatible with that location:

• Bad MD5 filename for non-default avatars #23041

Suggestion:

• drop content-derived obfuscation and store avatar files with plain (unique internal) User-ID
• add routing for respective SHA256 of emails
• add routing for respective MD5/SHA1 values (optional compatibility layer)

This way, client tools with configurable avatar sources can get (user-assigned) avatars for commit listings.