[jira] [Commented] (DERBY-6973) Provide SHA-512 checksums on future releases

["Rick Hillegas (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/DERBY-6973?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16216164#comment-16216164 ] 

Rick Hillegas commented on DERBY-6973:
--------------------------------------

MD5 is a checksum type used by the following other popular Apache projects. However, Webserver also offers SHA256.

Apache Webserver: https://httpd.apache.org/download.cgi

Apache Spark: https://www.apache.org/dist/spark/spark-2.2.0/

Apache Kafka: https://kafka.apache.org/downloads

Managers of future releases should consider using SHA-512 checksums in order to reduce the possibility of collisions. It is more a question of optics than real danger, I think. The probability of a collision is vanishingly small, particularly for scrupulous downloaders who also verify the PGP signature. The other projects cited above provide multiple checksum alternatives. Thanks for the nudge.


> Provide SHA-512 checksums on future releases
> --------------------------------------------
>
>                 Key: DERBY-6973
>                 URL: https://issues.apache.org/jira/browse/DERBY-6973
>             Project: Derby
>          Issue Type: Bug
>          Components: Web Site
>    Affects Versions: 10.0.2.0, 10.0.2.1, 10.1.1.0, 10.1.2.1, 10.1.3.1, 10.2.1.6, 10.2.2.0, 10.3.1.4, 10.3.2.1, 10.3.3.0, 10.4.1.3, 10.4.2.0, 10.5.1.1, 10.5.2.0, 10.5.3.0, 10.6.1.0, 10.6.2.1, 10.7.1.1, 10.8.1.2, 10.8.2.2, 10.8.3.0, 10.9.1.0, 10.10.1.1, 10.10.2.0, 10.11.1.1, 10.12.1.1, 10.13.1.1, 10.14.1.0
>            Reporter:  Warren MacEvoy
>
> Releases have md5 sum for signatures, and nothing modern.  How is this even possible?



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)