[jira] [Commented] (GROOVY-9458) Missing sigs and hashes on download page

["Paul King (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/GROOVY-9458?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17072379#comment-17072379 ] 

Paul King commented on GROOVY-9458:
-----------------------------------

[~sebb] My understanding is that those policies aren't applicable to community artifacts. The windows installer executables are not released by the Groovy PMC nor hosted on Apache infrastructure and are clearly labelled as "community artifacts". We provide those links simply as a convenience for windows users who expect installer executables since we have no equivalent. I believe our approach is in full compliance with existing policies. Is that not your understanding?

> Missing sigs and hashes on download page
> ----------------------------------------
>
>                 Key: GROOVY-9458
>                 URL: https://issues.apache.org/jira/browse/GROOVY-9458
>             Project: Groovy
>          Issue Type: Bug
>            Reporter: Sebb
>            Priority: Major
>
> The public download page includes links to several Windows installer executables.
> These have neither signatures nor hashes.
> However as per [1] 
> "All supplied packages MUST be cryptographically signed by the Release Manager with a detached signature"
> And as per [2]
> "For every artifact distributed to the public through Apache channels, the PMC ... MUST supply at least one checksum file"
> Please either remove the links or provide the required sigs and hashes.
> Thanks.
> [1] http://www.apache.org/legal/release-policy.html#release-signing 
> [2] https://www.apache.org/dev/release-distribution#sigs-and-sums



--
This message was sent by Atlassian Jira
(v8.3.4#803005)