Thanks Craig, we're tracking this issue as DERBY-6973:
https://issues.apache.org/jira/browse/DERBY-6973
bryan
On Thu, May 31, 2018 at 9:21 PM, Craig Russell wrote:
> Hi,
>
> FYI, the download pages are fine except for one issue. MD5 is no longer
> recommended for checksums, and SHA is required.
>
> Announcements of Apache project releases must contain a link to the relevant
> download page. [1]
> The download page must provide public download links where current official
> source releases and accompanying cryptographic files may be obtained. [2]
>
> Announcements that contain a link to the dyn/closer page alone will be
> rejected by the moderators.
>
> Announcements that contain a link to a web page that does not include a link
> to a mirror to the artifact plus links to the signature and at least one sha
> checksum will be rejected.
>
> [1] http://www.apache.org/legal/release-policy.html#release-announcements
> [2] https://www.apache.org/dev/release-distribution#download-links
>
> This advice is for the next release...
>
> Regards,
>
> Craig
>
> Craig L Russell
> Secretary, Apache Software Foundation
> c...@apache.org http://db.apache.org/jdo
>
