[ 
https://issues.apache.org/jira/browse/SLING-7534?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16435529#comment-16435529
 ] 

Konrad Windszus commented on SLING-7534:
----------------------------------------

As far as I know only the {{maven-install-plugin}} can generate checksums on 
the maven side 
(http://maven.apache.org/plugins/maven-install-plugin/examples/installing-checksums.html)
 but this will only affect installation to a local repo. For the 
maven-deploy-plugin 
(http://maven.apache.org/plugins/maven-deploy-plugin/deploy-mojo.html) there is 
no such option. Also nothing is configured in that regard in either sling 
parent nor ASF parent. But Nexus is not supposed to generate those either 
(compare with 
https://blog.sonatype.com/2012/03/the-first-line-of-defense-checksums-and-pgp-signatures-in-repositories/).

> Release policy - stop providing MD5 signatures
> ----------------------------------------------
>
>                 Key: SLING-7534
>                 URL: https://issues.apache.org/jira/browse/SLING-7534
>             Project: Sling
>          Issue Type: Task
>          Components: Tooling
>            Reporter: Robert Munteanu
>            Priority: Major
>
> See http://www.apache.org/dev/release-distribution#sigs-and-sums , we SHOULD 
> no longer provide MD5 checksums for new releases.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

Reply via email to