hashes in download directory

[Ian Young]

> On 11 Mar 2015, at 17:29, Brent Putman <putmanb at georgetown.edu> wrote:
> 
> "Minor Version Release Process", step 10 b:
> 
>> Copy the distribution archive, its md5 and sha1 hashes, and PGP signature to a version-named directory in the download site. You can verify the signature(s) at this point.

Thanks, I guess my eye slid over that for some reason.

> I was also wondering (starting looking in Maven docs and got sidetracked) whether there was a way to have Maven also generate SHA256, SHA512, etc hashes during a 'deploy', instead of or in addition to the MD5 and SHA1 ones.

SHA-1 and even MD5 are fine as *integrity* checks. I don't see a need to go to even SHA-256 for that purpose.

Providing longer hashes doesn't give you more in the way of *authenticity* unless you're actually performing signatures.

In practice, of course, there's the "optics" of it, as Scott would say: if someone doesn't understand that distinction, giving them a SHA-256 or even SHA-512 hash as well may make them feel better, even if it really shouldn't, and the reduced support load might be of value.

    -- Ian




-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20150311/f9cf9a23/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5250 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/dev/attachments/20150311/f9cf9a23/attachment-0001.bin