ant-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Conor MacNeill <co...@cortexebusiness.com.au>
Subject Re: validating content in Maven repositories
Date Sat, 23 Oct 2004 01:25:05 GMT
As far as I can tell, MD5s from the same server can only tell you about 
download corruption. MD5s from a separate, "trusted" server for a 
download verify the remote machine's content is correct with respect to 
the trusted version. This is important for mirroring - if you look at 
Ant's download page, the zips are sourced from a mirror but the MD5s 
point to the apache.org version.

To properly validate a download, it does need to be signed. We currently 
do that but there is no guaranteed trust relationships set up. Once we 
get to the question of a CA, you need to include ASF-wide infrastructure 
people in the discussion. I think there may be some overhead in managing 
that for the whole ASF

Conor

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For additional commands, e-mail: dev-help@ant.apache.org


Mime
View raw message