cstamas commented on PR #2084: URL: https://github.com/apache/maven-resolver/pull/2084#issuecomment-5475865049
So, checksums list were envisioned as: * first match makes verification outcome OK * the list should be descending "by alg strength" * there are reposes like Central, where some (modern) artifacts have "more" than SHA1, while ancient old artifacts (like aopalliance, used by todays Maven even as Guice transitive dep) only SHA1 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
