commons-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From sebb <seb...@gmail.com>
Subject Re: New release distribution checksum policy
Date Fri, 24 Aug 2018 19:02:21 GMT
On 24 August 2018 at 19:42, sebb <sebbaz@gmail.com> wrote:
> On 24 August 2018 at 18:51, Thomas Vandahl <tv@apache.org> wrote:
>> On 24.08.18 15:42, sebb wrote:
>>> If it really is the case that the Apache Parent POM only creates the
>>> checksums for artifacts with a specific name, then IMO it is badly
>>> broken and needs a bug report.
>>
>> Feel free. Lines 425 to 454.
>>
>>> Note that it says:
>>> "For every artifact distributed to the public through Apache channels,
>>> the PMC..."
>>>
>>> Since we distribute the binaries, they must have SHA256+
>>
>> I see. Does Maven Central qualify as "Apache channel"? Because I have no
>> idea how to achieve this. Tried multiple configurations - PITA.
>
> I don't know if Maven Central counts; I expect it needs changes to Nexus.
>
> However www.apache.org/dist does count, and that's the one that Maven
> needs to fix.

I've just remembered - we don't use the apache-release profile, which
is where the new checksum has been added.

So the new Apache pom won't help.

I think the apache-release profile only handles source artifacts for dist.
See
http://maven.apache.org/pom/asf/

It also uses a different naming convention, and there are a few other
differences from our release profile.

However it may be possible to use the checksum-maven-plugin in our POM
to create the additional hashes.

>> Bye, Thomas
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
>> For additional commands, e-mail: dev-help@commons.apache.org
>>

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org


Mime
View raw message