aurora-reviews mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From GitBox <...@apache.org>
Subject [GitHub] rdelval closed pull request #36: Removing MD5 check from verify release candidate script and release script
Date Tue, 04 Sep 2018 19:16:29 GMT
rdelval closed pull request #36: Removing MD5 check from verify release candidate script and
release script
URL: https://github.com/apache/aurora/pull/36
 
 
   

This is a PR merged from a forked repository.
As GitHub hides the original diff on merge, it is displayed below for
the sake of provenance:

As this is a foreign pull request (from a fork), the diff is supplied
below (as it won't show otherwise due to GitHub magic):

diff --git a/build-support/release/release b/build-support/release/release
index 86bcbe409..705ff8df9 100755
--- a/build-support/release/release
+++ b/build-support/release/release
@@ -192,8 +192,7 @@ echo "Signing the distribution"
 gpg --armor --output ${dist_name}.tar.gz.asc --detach-sig ${dist_name}.tar.gz
 
 # Create the checksums
-echo "Creating checksums"
-gpg --print-md MD5 ${dist_name}.tar.gz > ${dist_name}.tar.gz.md5
+echo "Creating checksum"
 shasum -a 512 ${dist_name}.tar.gz > ${dist_name}.tar.gz.sha512
 
 if [[ $publish == 1 ]]; then
@@ -241,8 +240,8 @@ ${aurora_git_web_url}&a=shortlog&h=refs/tags/${current_version_tag}
 The release is available at:
 ${aurora_svn_dist_url}/${current_version}/${dist_name}.tar.gz
 
-The MD5 checksum of the release can be found at:
-${aurora_svn_dist_url}/${current_version}/${dist_name}.tar.gz.md5
+The SHA-512 checksum of the release can be found at:
+${aurora_svn_dist_url}/${current_version}/${dist_name}.tar.gz.sha512
 
 The signature of the release can be found at:
 ${aurora_svn_dist_url}/${current_version}/${dist_name}.tar.gz.asc
diff --git a/build-support/release/release-candidate b/build-support/release/release-candidate
index 4547af67b..d7cb38f98 100755
--- a/build-support/release/release-candidate
+++ b/build-support/release/release-candidate
@@ -226,8 +226,8 @@ pushd ${dist_dir}
   echo "Signing the distribution"
   gpg --armor --output ${dist_name}.tar.gz.asc --detach-sig ${dist_name}.tar.gz
 
-  # Create the checksums
-  echo "Creating checksums"
+  # Create the checksum
+  echo "Creating checksum"
   shasum -a 512 ${dist_name}.tar.gz > ${dist_name}.tar.gz.sha512
 popd
 
diff --git a/build-support/release/verify-release-candidate b/build-support/release/verify-release-candidate
index dcd8114ec..524da76ca 100755
--- a/build-support/release/verify-release-candidate
+++ b/build-support/release/verify-release-candidate
@@ -40,10 +40,8 @@ fetch_archive() {
   local dist_name=$1
   download_rc_file ${dist_name}.tar.gz
   download_rc_file ${dist_name}.tar.gz.asc
-  download_rc_file ${dist_name}.tar.gz.md5
   download_rc_file ${dist_name}.tar.gz.sha512
   gpg --verify ${dist_name}.tar.gz.asc ${dist_name}.tar.gz
-  gpg --print-md MD5 ${dist_name}.tar.gz | diff - ${dist_name}.tar.gz.md5
   shasum -a 512 ${dist_name}.tar.gz | diff - ${dist_name}.tar.gz.sha512
 }
 


 

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services

Mime
View raw message