projects w/out SHA1s

[Steve Loughran <st...@gmail.com>]

while trying to work out why json lib doesn't want to come out and
play, I see that it is up on the repository without any checksums

http://repo2.maven.org/maven2/net/sf/json-lib/json-lib/2.3/
http://mirrors.ibiblio.org/pub/mirrors/maven2/net/sf/json-lib/json-lib/2.3/

Didnt think that this was allowed, even for non-ASF artifacts

Re: projects w/out SHA1s

[Carlos Sanchez <ca...@apache.org>]

json-lib is maintained by Andres Almiray. We depend on the good faith
of the projects to provide the right files. I'm sure he won't have any
issue in providing the checksums and taking note for next releases.

On Fri, Feb 5, 2010 at 5:03 AM, Steve Loughran <st...@gmail.com> wrote:
> while trying to work out why json lib doesn't want to come out and
> play, I see that it is up on the repository without any checksums
>
> http://repo2.maven.org/maven2/net/sf/json-lib/json-lib/2.3/
> http://mirrors.ibiblio.org/pub/mirrors/maven2/net/sf/json-lib/json-lib/2.3/
>
> Didnt think that this was allowed, even for non-ASF artifacts
>

Re: projects w/out SHA1s

[Brian Fox <br...@sonatype.com>]

On Fri, Feb 5, 2010 at 8:03 AM, Steve Loughran <st...@gmail.com> wrote:
> while trying to work out why json lib doesn't want to come out and
> play, I see that it is up on the repository without any checksums
>
> http://repo2.maven.org/maven2/net/sf/json-lib/json-lib/2.3/
> http://mirrors.ibiblio.org/pub/mirrors/maven2/net/sf/json-lib/json-lib/2.3/
>
> Didnt think that this was allowed, even for non-ASF artifacts
>

Right, this is one reason why new rsyncs aren't allowed. It's not
practical to inspect the contents.