Mark, I'm not really sure where you are coming from on this. It's gotten a bit off topic, so I'm not sure what problem is trying to be addressed. A few points though.
> No, I mean client side. Where maven would download the artifact to its > local repository, generate the md5 on the client side and upload it to > the server again. This way you can rely on the md5 generation in maven > or ant to accomplish consistent md5 generation. md5 is not going to be different between implementations, as long as the output format is just the checksum, not the other guff that comes out of the unix apps. and as I said... > >> Maven should be publishing proper md5 files for new artifacts So I don't see this is a big need. > This is something again that I think should be managed in the client and > possibly be required in the upload bundle. Agreed about the upload bundle. That's easy enough/ > Well I'm unsure of the usefulness of the script. I really doubt that > these files should be "resigned" on the server side like this. I mean, > how much are you trusting the origination of this file that your willing > to stake signing it for the third party that didn't sign it in the first > place? We aren't signing anything. Its a hash to verify the integrity of the download. They are coming from the same server, so the security value is nil because the md5 could be replaced just as easily as the JAR. And besides, weren't you going to download, sign, and reupload the same thing a few moments ago? :) > As well, if you really want signing to happen on the serverside like > this, then the script could be modified to generate md5's on both > platforms. But, I'd also point out that on bsd, the md5 script generates > the following: > > > md5 commons-collections-3.1.jar > MD5 (commons-collections-3.1.jar) = d1dcb0fbee884bb855bb327b8190af36 > > while the GNU md5 script generates the following: > > [EMAIL PROTECTED] jars]$ md5sum commons-collections-3.1.jar > d1dcb0fbee884bb855bb327b8190af36 commons-collections-3.1.jar since, as I understand it, this is just a utility script to fix some broken checksums on two specific environments, I don't see the big deal in a couple of lines of sed to handle both these formats to become: > > And maven just generates and uses: > d1dcb0fbee884bb855bb327b8190af36 > So what about machines that don't have a native md5 generation script? > How would one put a repository on them such that this script was useful? > I just think thought needs to go into how to make this independent of > platform and if you want serverside scripting like this, then you either > have to be platform specific or platform independent, the most > independent I think you can get is to require and use 'java/ant' to do > this sort of signing. I think we were talking about different things based on this. If you are worried about how the checksums are -supposed- to get there, then Maven should be handling it correctly. > http://ant.apache.org/manual/CoreTasks/checksum.html I'm sure it just uses java.util to do the MD5Sum as well, so I'm not sure how this is helpful. Cheers, Brett --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
