<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 3/11/15 4:06 PM, Tom Zeller wrote:<br>
</div>
<blockquote
cite="mid:CAMNmQDRqyLD-HczDAR7eUwToa59AXzfbW_FSyFqdRU_C6HeD+w@mail.gmail.com"
type="cite">
<pre wrap="">On Wed, Mar 11, 2015 at 12:29 PM, Brent Putman <a class="moz-txt-link-rfc2396E" href="mailto:putmanb@georgetown.edu"><putmanb@georgetown.edu></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">So just noting that Maven/Nexus already does 2 of them for us, so really no
reason to duplicate, unless it's easier with a script. But I have found
using wget to be painless for this, as mentioned in the release process.
</pre>
</blockquote>
<pre wrap="">
I generated hashes because [md5|shaX]sum -c <hash> does not work for
the hashes generated by Maven, AFAIK.</pre>
</blockquote>
<br>
That's true. No one's ever brought that up before. Obviously it's
because sha1sum and friends generate output and operate on input
like:<br>
<br>
<tt>7e6ab71bc6626169ca6b5a23ad7afbe44d9dde79 opensaml-2.6.5-bin.zip</tt><br>
<br>
<br>
And Maven just produces output as the digest value only (and
annoyingly without a newline).<br>
<br>
Of course it's pretty easy to verify the Maven digest form by simply
visually comparing the digest values:<br>
<br>
<tt># sha1sum opensaml-2.6.5-bin.zip; cat
opensaml-2.6.5-bin.zip.sha1; echo</tt><tt><br>
</tt><tt><br>
7e6ab71bc6626169ca6b5a23ad7afbe44d9dde79 opensaml-2.6.5-bin.zip</tt><tt><br>
</tt><tt>7e6ab71bc6626169ca6b5a23ad7afbe44d9dde79</tt><br>
<br>
<br>
I never noticed but unless I'm missing it, it doesn't seem like
sha1sum has a mode that stays "verify the digest of file X against
the digest value stored in file Y". Maybe some other digest/hashing
tool does. <br>
<br>
<br>
<blockquote
cite="mid:CAMNmQDRqyLD-HczDAR7eUwToa59AXzfbW_FSyFqdRU_C6HeD+w@mail.gmail.com"
type="cite">
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">I was also wondering (starting looking in Maven docs and got sidetracked)
whether there was a way to have Maven also generate SHA256, SHA512, etc
hashes during a 'deploy', instead of or in addition to the MD5 and SHA1
ones.
</pre>
</blockquote>
<pre wrap="">
That would be good to know,</pre>
</blockquote>
<br>
As Ian said, for the integrity checks these no real cryptographic
reason to do it. It's merely a perception thing. I haven't really
looked, but I don't know that many projects typically use anything
better than SHA1. Maybe some do.<br>
<br>
<br>
<br>
<blockquote
cite="mid:CAMNmQDRqyLD-HczDAR7eUwToa59AXzfbW_FSyFqdRU_C6HeD+w@mail.gmail.com"
type="cite">
<pre wrap=""> as well as how to compare those hashes
outside of Maven.</pre>
</blockquote>
<br>
Would be nice if <tt>sha1sum -c</tt> worked as a one-liner, but
doesn't seem like a deal breaker to me personally. But if we want
our published downloadable distributions to have the sha1sum style
output to make this easier for people, then no objection from me.
Would just need to be put into the release process.<br>
<br>
<br>
<blockquote
cite="mid:CAMNmQDRqyLD-HczDAR7eUwToa59AXzfbW_FSyFqdRU_C6HeD+w@mail.gmail.com"
type="cite">
</blockquote>
<br>
</body>
</html>