osdir.com


[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: New release distribution checksum policy


On 24 August 2018 at 19:42, sebb <sebbaz@xxxxxxxxx> wrote:
> On 24 August 2018 at 18:51, Thomas Vandahl <tv@xxxxxxxxxx> wrote:
>> On 24.08.18 15:42, sebb wrote:
>>> If it really is the case that the Apache Parent POM only creates the
>>> checksums for artifacts with a specific name, then IMO it is badly
>>> broken and needs a bug report.
>>
>> Feel free. Lines 425 to 454.
>>
>>> Note that it says:
>>> "For every artifact distributed to the public through Apache channels,
>>> the PMC..."
>>>
>>> Since we distribute the binaries, they must have SHA256+
>>
>> I see. Does Maven Central qualify as "Apache channel"? Because I have no
>> idea how to achieve this. Tried multiple configurations - PITA.
>
> I don't know if Maven Central counts; I expect it needs changes to Nexus.
>
> However www.apache.org/dist does count, and that's the one that Maven
> needs to fix.

I've just remembered - we don't use the apache-release profile, which
is where the new checksum has been added.

So the new Apache pom won't help.

I think the apache-release profile only handles source artifacts for dist.
See
http://maven.apache.org/pom/asf/

It also uses a different naming convention, and there are a few other
differences from our release profile.

However it may be possible to use the checksum-maven-plugin in our POM
to create the additional hashes.

>> Bye, Thomas
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: dev-unsubscribe@xxxxxxxxxxxxxxxxxx
>> For additional commands, e-mail: dev-help@xxxxxxxxxxxxxxxxxx
>>

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@xxxxxxxxxxxxxxxxxx
For additional commands, e-mail: dev-help@xxxxxxxxxxxxxxxxxx