aurora-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From s...@apache.org
Subject aurora git commit: Switch release checksum to sha512
Date Sun, 08 Oct 2017 16:41:50 GMT
Repository: aurora
Updated Branches:
  refs/heads/master 0f1e68401 -> e0b6953ec


Switch release checksum to sha512

For our releases we will now be using .sha512 files rather than .sha files
containing sha1 checksums. This change is triggered by a recent update of
the Apache Release Distribution Policy.

Please see this mail for details:

```
Hi PMC,

    The Release Distribution Policy[1] changed regarding .sha files.
    See under "Cryptographic Signatures and Checksums Requirements" [2].

   Old policy :

     -- use extension .sha for any SHA checksum (SHA-1, SHA-256, SHA-512)

   New policy :

      -- use .sha1 for a SHA-1 checksum
      -- use .sha256 for a SHA-256 checksum
      -- use .sha512 for a SHA-512 checksum
      -- [*] .sha should contain a SHA-1

   Why this change ?

      -- Verifying a checksum under the old policy is/was not handy.
         You have to inspect the .sha to find out which algorithm
         should be used ; or try them all (SHA-1, SHA256, etc).
         The new scheme avoids this ambiguity.
      -- The last point[*] was only added for clarity. Most of the
         old, stale .sha's contain a SHA-1. The relatively new .sha's
         contain a SHA-512. The expectation is that the last catagory will
         disappear, when active projects adapt to the 'new' convention.

   Impact :

      -- Should be none ; many projects already use the 'new' convention.
      -- Please ask your release managers to use .sha1, .sha256, .sha512
         instead of the .sha extension.
      -- Please fix your build-tools if you have any.

   Piggyback :

      -- The policy requires a .md5 for every package ;
         providing a .sha512 is recommended.
         Since MD5 is essentially broken, it is to be expected that
         in the future a .sha512 will be required.
         Perhaps it is wize to start providing .sha512's
         with your releases if you do not already do so.

      -- Visit http://mirror-vm.apache.org/checker/
         to check the health of your /dist/-area ;
         my stuff ; any feedback is most welcome.

   Thanks ; regards,

   Henk Penning

    [1] http://www.apache.org/dev/release-distribution
    [2] http://www.apache.org/dev/release-distribution#sigs-and-sums
```

Reviewed at https://reviews.apache.org/r/62830/


Project: http://git-wip-us.apache.org/repos/asf/aurora/repo
Commit: http://git-wip-us.apache.org/repos/asf/aurora/commit/e0b6953e
Tree: http://git-wip-us.apache.org/repos/asf/aurora/tree/e0b6953e
Diff: http://git-wip-us.apache.org/repos/asf/aurora/diff/e0b6953e

Branch: refs/heads/master
Commit: e0b6953ec33609486ee46cc9a95aff131be6a8ad
Parents: 0f1e684
Author: Stephan Erb <serb@apache.org>
Authored: Sun Oct 8 18:41:35 2017 +0200
Committer: Stephan Erb <serb@apache.org>
Committed: Sun Oct 8 18:41:35 2017 +0200

----------------------------------------------------------------------
 build-support/release/release                  | 2 +-
 build-support/release/release-candidate        | 2 +-
 build-support/release/verify-release-candidate | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/aurora/blob/e0b6953e/build-support/release/release
----------------------------------------------------------------------
diff --git a/build-support/release/release b/build-support/release/release
index ff7ee71..86bcbe4 100755
--- a/build-support/release/release
+++ b/build-support/release/release
@@ -194,7 +194,7 @@ gpg --armor --output ${dist_name}.tar.gz.asc --detach-sig ${dist_name}.tar.gz
 # Create the checksums
 echo "Creating checksums"
 gpg --print-md MD5 ${dist_name}.tar.gz > ${dist_name}.tar.gz.md5
-shasum ${dist_name}.tar.gz > ${dist_name}.tar.gz.sha
+shasum -a 512 ${dist_name}.tar.gz > ${dist_name}.tar.gz.sha512
 
 if [[ $publish == 1 ]]; then
   # Commit the release

http://git-wip-us.apache.org/repos/asf/aurora/blob/e0b6953e/build-support/release/release-candidate
----------------------------------------------------------------------
diff --git a/build-support/release/release-candidate b/build-support/release/release-candidate
index bab92bb..1a03d5e 100755
--- a/build-support/release/release-candidate
+++ b/build-support/release/release-candidate
@@ -215,7 +215,7 @@ pushd ${dist_dir}
   # Create the checksums
   echo "Creating checksums"
   gpg --print-md MD5 ${dist_name}.tar.gz > ${dist_name}.tar.gz.md5
-  shasum ${dist_name}.tar.gz > ${dist_name}.tar.gz.sha
+  shasum -a 512 ${dist_name}.tar.gz > ${dist_name}.tar.gz.sha512
 popd
 
 aurora_svn_rc_url="${aurora_svn_dist_url}/${rc_version}"

http://git-wip-us.apache.org/repos/asf/aurora/blob/e0b6953e/build-support/release/verify-release-candidate
----------------------------------------------------------------------
diff --git a/build-support/release/verify-release-candidate b/build-support/release/verify-release-candidate
index 3b9beee..dcd8114 100755
--- a/build-support/release/verify-release-candidate
+++ b/build-support/release/verify-release-candidate
@@ -41,10 +41,10 @@ fetch_archive() {
   download_rc_file ${dist_name}.tar.gz
   download_rc_file ${dist_name}.tar.gz.asc
   download_rc_file ${dist_name}.tar.gz.md5
-  download_rc_file ${dist_name}.tar.gz.sha
+  download_rc_file ${dist_name}.tar.gz.sha512
   gpg --verify ${dist_name}.tar.gz.asc ${dist_name}.tar.gz
   gpg --print-md MD5 ${dist_name}.tar.gz | diff - ${dist_name}.tar.gz.md5
-  shasum ${dist_name}.tar.gz | diff - ${dist_name}.tar.gz.sha
+  shasum -a 512 ${dist_name}.tar.gz | diff - ${dist_name}.tar.gz.sha512
 }
 
 install_gradle_wrapper() {


Mime
View raw message