sha1 and md5 checksums

[Steve Loughran <st...@gmail.com>]

I have a couple of q's about checksums

1. we have things out there that dont have all the checksums. e.g under

http://ibiblio.org/maven2/org/apache/maven/maven-artifact-ant/2.0.4/

the maven-artifact-ant-2.0.4-dep.jar only has .md5, not sha1.

Is this something the uploader has to do, or is generation of the
checksums automated.


2. Does anything walk round the repository or its mirrors and check
that checksums are consistent on a site, and consistent with the
central repo?

-steve

Re: sha1 and md5 checksums

[Steve Loughran <st...@gmail.com>]

On 23/08/06, Carlos Sanchez <ca...@apache.org> wrote:
> On 8/22/06, Steve Loughran <st...@gmail.com> wrote:
> > I have a couple of q's about checksums
> >
> > 1. we have things out there that dont have all the checksums. e.g under
> >
> > http://ibiblio.org/maven2/org/apache/maven/maven-artifact-ant/2.0.4/
> >
> > the maven-artifact-ant-2.0.4-dep.jar only has .md5, not sha1.
> >
> > Is this something the uploader has to do, or is generation of the
> > checksums automated.
>
> uploader responsability


ok, sounds like a process failure on this one. More generally, should
we be allowing uploads to go through that dont come checksummed?
>
> >
> >
> > 2. Does anything walk round the repository or its mirrors and check
> > that checksums are consistent on a site, and consistent with the
> > central repo?
>
> nothing yet

OK. I may have some time next month to do some prolog programming. I
have ideas, like comparing the Ivy and M2 metadata and seeing how they
differ, and taking snapshots of both metadata sets to see how they
change over time.


-steve

Re: sha1 and md5 checksums

[Carlos Sanchez <ca...@apache.org>]

On 8/22/06, Steve Loughran <st...@gmail.com> wrote:
> I have a couple of q's about checksums
>
> 1. we have things out there that dont have all the checksums. e.g under
>
> http://ibiblio.org/maven2/org/apache/maven/maven-artifact-ant/2.0.4/
>
> the maven-artifact-ant-2.0.4-dep.jar only has .md5, not sha1.
>
> Is this something the uploader has to do, or is generation of the
> checksums automated.

uploader responsability

>
>
> 2. Does anything walk round the repository or its mirrors and check
> that checksums are consistent on a site, and consistent with the
> central repo?

nothing yet

>
> -steve
>


-- 
I could give you my word as a Spaniard.
No good. I've known too many Spaniards.
                             -- The Princess Bride