[
https://issues.apache.org/jira/browse/CLOUDSTACK-10280?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17295224#comment-17295224
]
Sebb commented on CLOUDSTACK-10280:
-----------------------------------
Yes, MD5 deprecation is part of policy
https://infra.apache.org/release-distribution#sigs-and-sums
As to using GitHub instead of JIRA, please ask INFRA to make JIRA read-only
> Please use HTTPS for KEYS, sigs and hashes
> ------------------------------------------
>
> Key: CLOUDSTACK-10280
> URL: https://issues.apache.org/jira/browse/CLOUDSTACK-10280
> Project: CloudStack
> Issue Type: Bug
> Security Level: Public(Anyone can view this level - this is the
> default.)
> Reporter: Sebb
> Priority: Critical
>
> The download page is generally fine.
> However the links to the KEYS, sigs (PGP) and hashes use http; ideally they
> should use https.
> Also the gpg command should read:
> gpg --verify apache-cloudstack-X.X.X-src.tar.bz2.asc
> apache-cloudstack-X.X.X-src.tar.bz2
> i.e. both the detached sig and the artifact itself should be specified.
> See: https://www.apache.org/info/verification.html#CheckingSignatures
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
