Mailing-List: contact repository-help@apache.org; run by ezmlm
Precedence: bulk
Reply-To: repository@apache.org
Received-SPF: pass (hermes.apache.org: domain of mdiggory@gmail.com designates
 64.233.184.199 as permitted sender)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
        s=beta; d=gmail.com;
        h=received:message-id:date:from:user-agent:x-accept-language:mime-version:to:subject:references:in-reply-to:content-type:content-transfer-encoding;
        b=uB5jpXeEyeNqMQHoMNYIIwQSPwOS9tSY5FpcHRrHvk3+H6uD/erJTJtfJRqCH9/sx7mhgxDBTl1r5fO9qF5GpIP2l6k8wEZeT9iGf+LRmgAKP5Hv2gpPtSgZF5/cYwrcSlbK7HtGF4TqPDA0qUQQmuKeFcMxeGghVJNpUukChN4=
Message-ID: <4236F68A.3000905@gmail.com>
Date: Tue, 15 Mar 2005 09:51:54 -0500
From: Mark Diggory <mdiggory@gmail.com>
User-Agent: Mozilla Thunderbird 1.0 (Windows/20041206)
MIME-Version: 1.0
To: repository@apache.org
Subject: Re: security, hashing.
References: <c84a5078050310121173aac83d@mail.gmail.com>
 <853ac4f40503150632263b70ad@mail.gmail.com>
In-Reply-To: <853ac4f40503150632263b70ad@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Russell Gold wrote:

>On Thu, 10 Mar 2005 20:11:20 +0000, Steve Loughran
><steve.loughran@gmail.com> wrote:
>  
>
>>The disadvantages
>> -no obvious 'latest version' in the repository
>> -harder to field support calls, "what is the hash of your artifacts"?
>>    
>>
>
>Not to mention, really complicating the job of upgrading to new versions. 
>
>Is there a danger here of solving the 1% case at the expense of the 99% case?
>
>  
>
axis-0.0.1-04f3d5aab0.jar

then you have the version and the hash... Think of the hash as similar "alpha", "beta" or "rcN" identifiers (isn't it really? Your just identifying this particular "packaging" of axis-0.0.1.). 

But then again, this starts to get into the arena of Jar Signing, and there already is facility for that in Jar Artifacts...

-Mark Diggory