[CASSANDRA-14970] New releases must supply SHA-256 and/or SHA-512 checksums

• Type: Bug
• Status: Open
• Priority: Urgent
• Resolution: Unresolved
• Fix Version/s: 2.2.15, 3.0.19, 3.11.5, 4.0
• Component/s: Packaging
• Severity: Critical
• Assignee: Michael Shuler
• Reporter: Michael Shuler

Authors

Michael Shuler

• Created: 08/Jan/19 22:51
• Updated: 16/Apr/19 09:29

Description

Release policy was updated around 9/2018 to state:

"For new releases, PMCs MUST supply SHA-256 and/or SHA-512; and SHOULD NOT supply MD5 or SHA-1. Existing releases do not need to be changed."

build.xml needs to be updated from MD5 & SHA-1 to, at least, SHA-256 or both. cassandra-builds/cassandra-release scripts need to be updated to work with the new checksum files.

http://www.apache.org/dev/release-distribution#sigs-and-sums

Issue Links

• requires: INFRA-14923 Add new SHA-* rules to Nexus staging