[MPOM-282] Create correct SHA512 content

[jira-importer]

Karl Heinz Marbaise opened MPOM-282 and commented

Currently the created SHA512 which is used for the distribution area contains only the checksum but not the filename which results in bad output if the checksums being checked via command line tool:

$ shasum -c apache-maven-3.2.5-bin.tar.gz.sha512
$ shasum: apache-maven-3.2.5-bin.tar.gz.sha512: no properly formatted SHA checksum lines found

The checksum should be enhanced to support that correctly.

---

Issue Links:

• MPOM-244 Deploy SHA-512 for source-release to Remote Repository

• MNGSITE-378 Maven 3.6.2 incomplete sha512 checksum files

1 votes, 8 watchers

[jira-importer]

Michael Osipov commented

I concur to change this. Because this will deviate from the general habit we provide checksum files. They contain the checksum only. There is no canoncial checksum file format.

[jira-importer]

Michael Osipov commented

Can we close this? There is no canonical checksum output format.

[jira-importer]

Michael Osipov commented

Yet another ping...

[jira-importer]

Konrad Windszus commented

ASF requires raw hashes: https://www.apache.org/info/verification.html#CheckingHashes

[jira-importer]

Christopher Tubbs commented

Konrad Windszus - The page you linked is an informational page, a "HOW TO" guide, not policy. Even if it were ASF policy, nothing in that page describes any kind of file format requirement, as far as I can tell. If you believe otherwise, please cite the specific line.

[jira-importer]

Michael Osipov commented

The linked paragraph by Konrad Windszus, contains a lot of non-sense since checksum and hash are used interchangeably which is wrong. All of the checksums we provide are solely for the consumption of Resolver to detect bitrot. Nothing else.

Tamas Cservenak

[jira-importer]

Michael Osipov commented

I am quite certain that this will not change.

[jira-importer]

Tamas Cservenak commented

Agreed, please do not mix the two: md5/sha1 is used by resolver ONLY to eliminate transport corruption (bitrot). While SHA1 (and MD5) are deprecated in cryptography, this is not cryptography, just data integrity (and even today many Linux/Unix use MD5 for same purpose). Also, see https://en.wikipedia.org/wiki/SHA-1 the "Data integrity" section.

[jira-importer]

Tamas Cservenak commented

Hm, after rereading original issue: "the created SHA512 which is used for the distribution area" – is it maybe us misinterpreting this? As it is not resolver that creates "checksum for the distribution area", is it? If it is, it is wrong. If it is not, what does it create it?

[jira-importer]

Tamas Cservenak commented

And one more thing: re checksum content, there are (to me at least) 3 "formats" known:

• resolver style checksum (just checksum in file)
• GNU style checksum filename
• BSD style alg(filename) = checksum

Resolver can READ all 3 types of checksum styles, but WRITES only the first type.

[jira-importer]

Christopher Tubbs commented

I'm not sure if this issue is about the resolver, or about files produced by some plugin for the release distribution area. In any case, I do think it would make sense if anywhere these files were created, they wrote in a format that included the filename, so it can be more easily verified with standard tooling. It does no harm to include the filename, and makes it easier for anybody, regardless of context to use a checksum file they encounter to verify the file it accompanies.

[jira-importer]

Michael Osipov commented

If this is going to change it should happen ASF wide, not just us. It is part of the Maven Apache Parent.

[jira-importer]

Michael Osipov commented

http://checksum-maven-plugin.nicoulaj.net/ is used.

[jira-importer]

Christopher Tubbs commented

If we're talking about the files generated by the plugin in MPOM, and not the resolver stuff, then here's the related upstream ticket I filed awhile back: nicoulaj/checksum-maven-plugin#127

[jira-importer]

Michael Osipov commented

Christopher Tubbs, correct. Back then people requested Resolver to do that and I refused because I consider those to be an implemenation detail of Resolver. Therefore, this approach has been used. Obviously, we need to make a difference for ALL Maven-based plugins in ASF. I think should be moved to MPOM.