hashes in download directory

[Brent Putman]

On 3/11/15 1:09 PM, Ian Young wrote:
>
> I'm not sure that the business of generating hashes and uploading to the downloads directory is actually documented at the moment; I can't find it in the wiki. I guess it should be, as otherwise we won't really have a stable release process.


The "old" (I guess) instructions are there in the release process:

https://wiki.shibboleth.net/confluence/display/DEV/Java+Product+Release+Process

"Minor Version Release Process", step 10 b:

> Copy the distribution archive, its md5 and sha1 hashes, and PGP
> signature to a version-named directory in the download site. You can
> verify the signature(s) at this point.


That's what I have always done.  I happened to notice the .sha256 ones
recently in the 3.0.0 directory and meant to bring up how we were
getting that.

So just noting that Maven/Nexus already does 2 of them for us, so
really no reason to duplicate, unless it's easier with a script.  But I
have found using wget to be painless for this, as mentioned in the
release process. 

I was also wondering (starting looking in Maven docs and got
sidetracked) whether there was a way to have Maven also generate
SHA256, SHA512, etc hashes during a 'deploy', instead of or in addition
to the MD5 and SHA1 ones.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20150311/d93d4219/attachment.html