[
https://issues.apache.org/jira/browse/CLIMATE-521?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14136322#comment-14136322
]
Sebb commented on CLIMATE-521:
------------------------------
The hashes and sigs are not published to mirrors - they have to be downloaded
from the ASF hosts, as does the KEYS file.
This is to reduce the likelihood of them being tampered with.
So unless you provide links on the download page, it will be very difficult for
users to find them.
For some sample download pages that provide the info, please see:
http://httpd.apache.org/download.cgi
http://tomcat.apache.org/download-80.cgi
http://commons.apache.org/proper/commons-net/download_net.cgi
The links in the description provide further info on how to set these pages up.
> Downloads must use ASF mirror system; also have sigs and hashes
> ---------------------------------------------------------------
>
> Key: CLIMATE-521
> URL: https://issues.apache.org/jira/browse/CLIMATE-521
> Project: Apache Open Climate Workbench
> Issue Type: Bug
> Components: website
> Reporter: Sebb
>
> The download link in [1] currently points directly to the ASF server:
> https://www.apache.org/dist/climate/0.4/
> This is not allowed.
> Downloads MUST use the ASF mirroring system for current releases.
> Also users must be able to check the hashes and sigs for a release.
> Please read:
> http://www.apache.org/dev/release.html
> and
> http://www.apache.org/dev/release-download-pages
> [1] http://climate.apache.org/index.html
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
