commons-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From sebb <>
Subject Re: New release distribution checksum policy
Date Fri, 24 Aug 2018 19:02:21 GMT
On 24 August 2018 at 19:42, sebb <> wrote:
> On 24 August 2018 at 18:51, Thomas Vandahl <> wrote:
>> On 24.08.18 15:42, sebb wrote:
>>> If it really is the case that the Apache Parent POM only creates the
>>> checksums for artifacts with a specific name, then IMO it is badly
>>> broken and needs a bug report.
>> Feel free. Lines 425 to 454.
>>> Note that it says:
>>> "For every artifact distributed to the public through Apache channels,
>>> the PMC..."
>>> Since we distribute the binaries, they must have SHA256+
>> I see. Does Maven Central qualify as "Apache channel"? Because I have no
>> idea how to achieve this. Tried multiple configurations - PITA.
> I don't know if Maven Central counts; I expect it needs changes to Nexus.
> However does count, and that's the one that Maven
> needs to fix.

I've just remembered - we don't use the apache-release profile, which
is where the new checksum has been added.

So the new Apache pom won't help.

I think the apache-release profile only handles source artifacts for dist.

It also uses a different naming convention, and there are a few other
differences from our release profile.

However it may be possible to use the checksum-maven-plugin in our POM
to create the additional hashes.

>> Bye, Thomas
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail:
>> For additional commands, e-mail:

To unsubscribe, e-mail:
For additional commands, e-mail:

View raw message