Hi, > The nightly builds have been SHA-512 since Feb 12, so yes 0.9.2 will be > SHA-512 instead of MD5.
Good to hear the change has been made. [1] However I noticed that the extension on the hash file is required to be “.sha512” not “.SHA-512”. [2] I believe this is to do with how the hash files and mirror system interact. [3] (i.e. you need check the hashes directly at Apache not from the mirrors) > This is just more FUD from Justin. I’m sorry you took it that way, there is certainly no intention of that. As I said that not everyone may not be aware of the changes to policy in this area or following the lists this was discussed on. As this is a public mailing list it would help you to be a little more respectful in your style of communication. Thanks, Justin 1. http://apacheroyaleci.westus2.cloudapp.azure.com:8080/job/royale-asjs/ <http://apacheroyaleci.westus2.cloudapp.azure.com:8080/job/royale-asjs/> 2. https://www.apache.org/dev/release-distribution#sigs-and-sums <https://www.apache.org/dev/release-distribution#sigs-and-sums> 3. https://www.apache.org/info/verification.html#Sign <https://www.apache.org/info/verification.html#Sign>