You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@cxf.apache.org by "Colm O hEigeartaigh (JIRA)" <ji...@apache.org> on 2018/07/04 10:59:00 UTC

[jira] [Resolved] (CXF-7780) No need to use both sigs and hashes

     [ https://issues.apache.org/jira/browse/CXF-7780?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Colm O hEigeartaigh resolved CXF-7780.
--------------------------------------
    Resolution: Fixed

> No need to use both sigs and hashes
> -----------------------------------
>
>                 Key: CXF-7780
>                 URL: https://issues.apache.org/jira/browse/CXF-7780
>             Project: CXF
>          Issue Type: Improvement
>            Reporter: Sebb
>            Assignee: Colm O hEigeartaigh
>            Priority: Major
>
> The CXF download page says:
> "When downloading from a mirror please check the SHA1/MD5 checksums as well as verifying the OpenPGP compatible signature available from the main Apache site. "
> MD5 should be dropped as there aren't any.
> Also there's no point verifying both.
> Generally it's better to check the sig, failing that use a checksum.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)