Re: sha512

[Konrad Windszus]

> On 18. Oct 2018, at 10:26, Bertrand Delacretaz <bdelacre...@apache.org> wrote:
> 
> Note that http://www.apache.org/dev/release-distribution#sigs-and-sums
> now says SHOULD supply sha-512 and SHOULD NOT supply md5.

Actually it says in another paragraph: 

> For new releases, PMCs MUST supply SHA-256 and/or SHA-512; 


So this is mandatory to provide for new(!) releases.