On 30/07/11 01:17, Alejandro Abdelnur wrote:
Joep,
Ivy& Maven pull JARs from the maven repos you specify.
Maven verifies checksums and I assume Ivy does.
by default? If so, that's an improvement.
You could turn your verified ~/.m2 into a Maven proxy and switch fetching
JARs not found in the proxy cache.
Bottom line, for you concerns Ivy and Maven are equally good or bad.
If you could set them up to retrieve checksums from elsewhere life would
be better. Even if the ASF won't host GPL or LGPL artifacts, there's no
reason why we couldn't host the checksums
