On 24 August 2018 at 19:42, sebb <seb...@gmail.com> wrote: > On 24 August 2018 at 18:51, Thomas Vandahl <t...@apache.org> wrote: >> On 24.08.18 15:42, sebb wrote: >>> If it really is the case that the Apache Parent POM only creates the >>> checksums for artifacts with a specific name, then IMO it is badly >>> broken and needs a bug report. >> >> Feel free. Lines 425 to 454. >> >>> Note that it says: >>> "For every artifact distributed to the public through Apache channels, >>> the PMC..." >>> >>> Since we distribute the binaries, they must have SHA256+ >> >> I see. Does Maven Central qualify as "Apache channel"? Because I have no >> idea how to achieve this. Tried multiple configurations - PITA. > > I don't know if Maven Central counts; I expect it needs changes to Nexus. > > However www.apache.org/dist does count, and that's the one that Maven > needs to fix.
I've just remembered - we don't use the apache-release profile, which is where the new checksum has been added. So the new Apache pom won't help. I think the apache-release profile only handles source artifacts for dist. See http://maven.apache.org/pom/asf/ It also uses a different naming convention, and there are a few other differences from our release profile. However it may be possible to use the checksum-maven-plugin in our POM to create the additional hashes. >> Bye, Thomas >> >> --------------------------------------------------------------------- >> To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org >> For additional commands, e-mail: dev-h...@commons.apache.org >> --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@commons.apache.org For additional commands, e-mail: dev-h...@commons.apache.org
