[jira] [Comment Edited] (SLING-7534) Release policy - stop providing MD5 and start providing SHA-512 signatures

["Konrad Windszus (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/SLING-7534?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17113778#comment-17113778 ] 

Konrad Windszus edited comment on SLING-7534 at 5/22/20, 6:10 AM:
------------------------------------------------------------------

Finally Nexus 2.14.18 has been released which creates sha512 checksums. We should download and verify those during the release check. Also we can upload those more easily to dist afterwards.

Regarding https://sling.apache.org/downloads.cgi, we first need to generate the checksums manually for all dist artifacts before we can adjust the links in https://github.com/apache/sling-site/blob/c42f72983684ae76344638b2aa7561cea66657e4/src/main/jbake/templates/downloads.tpl#L316 to point to sha512 instead.


was (Author: kwin):
Finally Nexus 2.14.18 has been released which creates sha512 checksums. We should download and verify those during the release check.

> Release policy - stop providing MD5 and start providing SHA-512 signatures
> --------------------------------------------------------------------------
>
>                 Key: SLING-7534
>                 URL: https://issues.apache.org/jira/browse/SLING-7534
>             Project: Sling
>          Issue Type: Task
>          Components: Tooling
>            Reporter: Robert Munteanu
>            Priority: Major
>             Fix For: Parent 40
>
>
> See http://www.apache.org/dev/release-distribution#sigs-and-sums , we SHOULD no longer provide MD5 checksums for new releases.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)