Hi,

> The nightly builds have been SHA-512 since Feb 12, so yes 0.9.2 will be
> SHA-512 instead of MD5.

Good to hear the change has been made. [1]  However I noticed that the 
extension on the hash file is required to be “.sha512” not “.SHA-512”. [2]  I 
believe this is to do with how the hash files and mirror system interact. [3] 
(i.e. you need check the hashes directly at Apache not from the mirrors)

>  This is just more FUD from Justin.

I’m sorry you took it that way, there is certainly no intention of that. As I 
said that not everyone may not be aware of the changes to policy in this area 
or following the lists this was discussed on. As this is a public mailing list 
it would help you to be a little more respectful in your style of communication.

Thanks,
Justin

1. http://apacheroyaleci.westus2.cloudapp.azure.com:8080/job/royale-asjs/ 
<http://apacheroyaleci.westus2.cloudapp.azure.com:8080/job/royale-asjs/>
2. https://www.apache.org/dev/release-distribution#sigs-and-sums 
<https://www.apache.org/dev/release-distribution#sigs-and-sums>
3. https://www.apache.org/info/verification.html#Sign 
<https://www.apache.org/info/verification.html#Sign>


Reply via email to