[ 
https://issues.apache.org/jira/browse/SLING-7534?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16435459#comment-16435459
 ] 

Bertrand Delacretaz commented on SLING-7534:
--------------------------------------------

I'm wondering if it's repository.apache.org that generates the checksums: 
grepping the output of {{mvn -X deploy}} on the 
{{sling-org-apache-sling-engine}} module as an example:

{code}
$ egrep -i 'md5|checksum|uploaded' deploy-output.txt
  <createChecksum default-value="false">${createChecksum}</createChecksum>
[DEBUG]   (f) createChecksum = false
Uploaded: 
https://repository.apache.org/content/repositories/snapshots/org/apache/sling/org.apache.sling.engine/2.6.13-SNAPSHOT/org.apache.sling.engine-2.6.13-20180412.121129-18.jar
 (203 KB at 96.0 KB/sec)
Uploaded: 
https://repository.apache.org/content/repositories/snapshots/org/apache/sling/org.apache.sling.engine/2.6.13-SNAPSHOT/org.apache.sling.engine-2.6.13-20180412.121129-18.pom
 (10 KB at 5.1 KB/sec)
Uploaded: 
https://repository.apache.org/content/repositories/snapshots/org/apache/sling/org.apache.sling.engine/2.6.13-SNAPSHOT/maven-metadata.xml
 (1011 B at 0.7 KB/sec)
Uploaded: 
https://repository.apache.org/content/repositories/snapshots/org/apache/sling/org.apache.sling.engine/maven-metadata.xml
 (2 KB at 0.7 KB/sec)
Uploaded: 
https://repository.apache.org/content/repositories/snapshots/org/apache/sling/org.apache.sling.engine/2.6.13-SNAPSHOT/org.apache.sling.engine-2.6.13-20180412.121129-18-sources.jar
 (144 KB at 71.2 KB/sec)
Uploaded: 
https://repository.apache.org/content/repositories/snapshots/org/apache/sling/org.apache.sling.engine/2.6.13-SNAPSHOT/maven-metadata.xml
 (1011 B at 0.7 KB/sec)
{code}

It doesn't seem like checksums are generated by the build nor uploaded, but 
after running the above there is an 
https://repository.apache.org/content/repositories/snapshots/org/apache/sling/org.apache.sling.engine/2.6.13-SNAPSHOT/org.apache.sling.engine-2.6.13-20180412.121129-18-sources.jar.md5
 indeed.

Also, {{mvn help:effective-pom}} doesn't say anything about checksums or md5 - 
but maybe those are defaults of the install or release plugin, I'm not sure.

> Release policy - stop providing MD5 signatures
> ----------------------------------------------
>
>                 Key: SLING-7534
>                 URL: https://issues.apache.org/jira/browse/SLING-7534
>             Project: Sling
>          Issue Type: Task
>          Components: Tooling
>            Reporter: Robert Munteanu
>            Priority: Major
>
> See http://www.apache.org/dev/release-distribution#sigs-and-sums , we SHOULD 
> no longer provide MD5 checksums for new releases.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

Reply via email to