Re: .sha256 artifact checksums on Central

2023-11-22 Thread Tamás Cservenák
Most probably is, this should never happen. There is NO global policy change, SHA-1 is still _mandatory_, while you CAN add SHA256 or whatever "better" if you want... but SHA-1 is mandatory. This should be enforced by Sonatype... T On Wed, Nov 22, 2023 at 5:38 PM Bernd Eckenfels wrote: > > > Mi

Re: .sha256 artifact checksums on Central

2023-11-22 Thread Bernd Eckenfels
Michael Osipov wrote on 22. Nov 2023 17:18 (GMT +01:00): > Look at this: > https://repo.maven.apache.org/maven2/com/microsoft/sqlserver/mssql-jdbc/12.4.2.jre11/ > > Whatever they did, they did wrong. Microsoft is responsive in their bug tracker, will let them know. But how can you upload a i

Re: .sha256 artifact checksums on Central

2023-11-22 Thread Michael Osipov
Look at this: https://repo.maven.apache.org/maven2/com/microsoft/sqlserver/mssql-jdbc/12.4.2.jre11/ Whatever they did, they did wrong. It is pointless to upload hashes for signatures. Moreover, MD5 and SHA1 are missing. They are mandatory, at least on oss.sonatype.org. They have just failed. G

Re: .sha256 artifact checksums on Central

2023-11-21 Thread Tamás Cservenák
Sorry, talked prematurely (and not at desk, only phone)... this is a sonatype issue it seems. Will take a deeper look tomorrow. T On Tue, Nov 21, 2023, 21:11 Tamás Cservenák wrote: > Sha1s are present as well... Unsure what the problem is here, what do i > miss? > > T > > On Tue, Nov 21, 2023,

Re: .sha256 artifact checksums on Central

2023-11-21 Thread Tamás Cservenák
Sha1s are present as well... Unsure what the problem is here, what do i miss? T On Tue, Nov 21, 2023, 20:10 Bernd Eckenfels wrote: > > > Bernd Eckenfels wrote on 21. Nov 2023 19:44 (GMT +01:00): > > Strange enough central did accept those, but seems to not support it with > > Remote Included St

Re: .sha256 artifact checksums on Central

2023-11-21 Thread Bernd Eckenfels
Bernd Eckenfels wrote on 21. Nov 2023 19:44 (GMT +01:00): > Strange enough central did accept those, but seems to not support it with > Remote Included Strategy (X- headers): Now that I thought about it, another possible explanation: I think -Daether.checksums.algo= rithms=SHA-256 is effectiv,

.sha256 artifact checksums on Central

2023-11-21 Thread Bernd Eckenfels
Hello, I have noticed that Microsoft started to add .sha256 checksums to their POMs instead of .sha1. It looks like Maven Central accepts this, so is this a global policy change? https://repo.maven.apache.org/maven2/com/microsoft/sqlserver/mssql-jdbc/12.4.1.jre11/mssql-jdbc-12.4.1.jre11.pom.