<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 3/11/15 1:09 PM, Ian Young wrote:<br>
</div>
<blockquote
cite="mid:BD2DA7DD-015C-49C1-8C6C-3C010440F07D@iay.org.uk"
type="cite">
<pre wrap="">
I'm not sure that the business of generating hashes and uploading to the downloads directory is actually documented at the moment; I can't find it in the wiki. I guess it should be, as otherwise we won't really have a stable release process.
</pre>
</blockquote>
<br>
<br>
The "old" (I guess) instructions are there in the release process:<br>
<br>
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/DEV/Java+Product+Release+Process">https://wiki.shibboleth.net/confluence/display/DEV/Java+Product+Release+Process</a><br>
<br>
"Minor Version Release Process", step 10 b:<br>
<br>
<blockquote type="cite">
<meta http-equiv="content-type" content="text/html;
charset=windows-1252">
Copy the distribution archive, its md5 and sha1 hashes, and PGP
signature to a version-named directory in the download site. You
can verify the signature(s) at this point.</blockquote>
<br>
<br>
That's what I have always done. I happened to notice the .sha256
ones recently in the 3.0.0 directory and meant to bring up how we
were getting that.<br>
<br>
So just noting that Maven/Nexus already does 2 of them for us, so
really no reason to duplicate, unless it's easier with a script.
But I have found using wget to be painless for this, as mentioned in
the release process. <br>
<br>
I was also wondering (starting looking in Maven docs and got
sidetracked) whether there was a way to have Maven also generate
SHA256, SHA512, etc hashes during a 'deploy', instead of or in
addition to the MD5 and SHA1 ones.<br>
</body>
</html>