hashes in download directory

[Ian Young]

We're including hash files in the download directory, presumably as an additional integrity check for people who don't use GPG. (Obviously not as an authenticity check, right?)

In 3.0.0, we included SHA-1 and SHA-256 hashes for all four artifacts. In the 3.1.0 directory, we had SHA-1 and a mixture of SHA-256 (for the MSIs) and SHA-512 (for the .gz and .zip). This broke something at my end.

Scott has now replaced the SHA-512 ones with SHA-256 so we now have what we had before.

I'm not sure that the business of generating hashes and uploading to the downloads directory is actually documented at the moment; I can't find it in the wiki. I guess it should be, as otherwise we won't really have a stable release process.

I'm agnostic, by the way, about whether SHA-256 or SHA-512 is the right answer. I only care that the process is consistent and documented.

    -- Ian




-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5250 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/dev/attachments/20150311/2f333d40/attachment.bin