hashes in download directory

[Brent Putman]

On 3/11/15 4:06 PM, Tom Zeller wrote:
> On Wed, Mar 11, 2015 at 12:29 PM, Brent Putman <putmanb at georgetown.edu> wrote:
>> So just noting that Maven/Nexus already does 2 of them for us, so really no
>> reason to duplicate, unless it's easier with a script.  But I have found
>> using wget to be painless for this, as mentioned in the release process.
> I generated hashes because [md5|shaX]sum -c <hash> does not work for
> the hashes generated by Maven, AFAIK.

That's true.  No one's ever brought that up before.  Obviously it's
because sha1sum and friends generate output and operate on input like:

7e6ab71bc6626169ca6b5a23ad7afbe44d9dde79  opensaml-2.6.5-bin.zip


And Maven just produces output as the digest value only (and annoyingly
without a newline).

Of course it's pretty easy to verify the Maven digest form by simply
visually comparing the digest values:

# sha1sum opensaml-2.6.5-bin.zip; cat opensaml-2.6.5-bin.zip.sha1; echo

7e6ab71bc6626169ca6b5a23ad7afbe44d9dde79  opensaml-2.6.5-bin.zip
7e6ab71bc6626169ca6b5a23ad7afbe44d9dde79


I never noticed but unless I'm missing it, it doesn't seem like sha1sum
has a mode that stays "verify the digest of file X against the digest
value stored in file Y".  Maybe some other digest/hashing tool does. 


>
>> I was also wondering (starting looking in Maven docs and got sidetracked)
>> whether there was a way to have Maven also generate SHA256, SHA512, etc
>> hashes during a 'deploy', instead of or in addition to the MD5 and SHA1
>> ones.
> That would be good to know,

As Ian said, for the integrity checks these no real cryptographic
reason to do it.  It's merely a perception thing.  I haven't really
looked, but I don't know that many projects typically use anything
better than SHA1.  Maybe some do.



>  as well as how to compare those hashes
> outside of Maven.

Would be nice if sha1sum -c worked as a one-liner, but doesn't seem
like a deal breaker to me personally.  But if we want our published
downloadable distributions to have the sha1sum style output to make
this easier for people, then no objection from me.   Would just need to
be put into the release process.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20150311/17f2ab9f/attachment.html