[ 
https://issues.apache.org/jira/browse/MPOM-118?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15289970#comment-15289970
 ] 

Sebb commented on MPOM-118:
---------------------------

Would it be worth adding a feature to the GPG plugin to print a large warning 
if a weak algorithm has been chosen?
(Along with a pointer to a web page with details on why it's important and how 
to avoid it)

Projects could suppress the warning by changing the algorithm to a safer one.

> Enforce strong GPG signatures by default
> ----------------------------------------
>
>                 Key: MPOM-118
>                 URL: https://issues.apache.org/jira/browse/MPOM-118
>             Project: Maven POMs
>          Issue Type: Improvement
>          Components: asf
>    Affects Versions: ASF-17
>            Reporter: Christopher Tubbs
>
> maven-gpg-plugin configuration could be improved a bit so that ASF releases 
> are not weakened by a user's weak personal configuration.
> I suggest adding something like the following to maven-gpg-plugin's 
> configuration in the pluginManagement section:
> {code:xml}
> <gpgArguments combine.children="append">
>   <arg>--digest-algo=SHA512</arg>
> </gpgArguments>
> {code}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Reply via email to