[CASSANDRA-14970] New releases must supply SHA-256 and/or SHA-512 checksums

• Type: Bug
• Status: Resolved
• Priority: Urgent
• Resolution: Fixed
• Fix Version/s: 2.2.16, 3.0.20, 3.11.6, 4.0, 4.0-beta1
• Component/s: Packaging
• Severity: Critical
• Since Version: 0.3

Source Control Link

https://github.com/apache/cassandra/commit/70d8db8558c346603da6e64c035d325834467d3a https://github.com/apache/cassandra-builds/commit/0bdc460cba741a47abb0634905aa7bcd5310f13a

Test and Documentation Plan

`ant artifacts` and cutting 4.0-alpha3

• Assignee: Michael Semb Wever
• Reporter: Michael Shuler

Authors

Michael Semb Wever

Reviewers

Michael Semb Wever, Michael Shuler

• Created: 08/Jan/19 22:51
• Updated: 15/May/20 08:54
• Resolved: 24/Apr/20 13:28

Description

Release policy was updated around 9/2018 to state:

"For new releases, PMCs MUST supply SHA-256 and/or SHA-512; and SHOULD NOT supply MD5 or SHA-1. Existing releases do not need to be changed."

build.xml needs to be updated from MD5 & SHA-1 to, at least, SHA-256 or both. cassandra-builds/cassandra-release scripts need to be updated to work with the new checksum files.

http://www.apache.org/dev/release-distribution#sigs-and-sums

Issue Links

• is related to: CASSANDRA-14963 Release artifacts should be able to be built without being release manager
• relates to: CASSANDRA-14962 Package builds should use source tar artifact as "orig"
• relates to: CASSANDRA-15541 Add dch release version to debian packages
• relates to: CASSANDRA-15540 Use the ASF process for packaging and uploading deb files
• requires: INFRA-14923 Add new SHA-* rules to Nexus staging