[
https://issues.apache.org/jira/browse/SLING-7534?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16435529#comment-16435529
]
Konrad Windszus commented on SLING-7534:
----------------------------------------
As far as I know only the {{maven-install-plugin}} can generate checksums on
the maven side
(http://maven.apache.org/plugins/maven-install-plugin/examples/installing-checksums.html)
but this will only affect installation to a local repo. For the
maven-deploy-plugin
(http://maven.apache.org/plugins/maven-deploy-plugin/deploy-mojo.html) there is
no such option. Also nothing is configured in that regard in either sling
parent nor ASF parent. But Nexus is not supposed to generate those either
(compare with
https://blog.sonatype.com/2012/03/the-first-line-of-defense-checksums-and-pgp-signatures-in-repositories/).
> Release policy - stop providing MD5 signatures
> ----------------------------------------------
>
> Key: SLING-7534
> URL: https://issues.apache.org/jira/browse/SLING-7534
> Project: Sling
> Issue Type: Task
> Components: Tooling
> Reporter: Robert Munteanu
> Priority: Major
>
> See http://www.apache.org/dev/release-distribution#sigs-and-sums , we SHOULD
> no longer provide MD5 checksums for new releases.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
