[LUCENE-8493] Stop publishing .sha1 files with releases

• Type: Task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 7.5.1, 7.6, 8.0
• Component/s: general/build
• Labels: build release security sha1sum
• Lucene Fields: New
• Assignee: Jan Høydahl
• Reporter: Jan Høydahl
• Created: 07/Sep/18 21:19
• Updated: 28/Aug/22 15:35
• Resolved: 26/Sep/18 14:19

Description

In LUCENE-7935 we added .sha512 checksums to releases and removed .md5 files.

According to the Release Distribution Policy (http://www.apache.org/dev/release-distribution#sigs-and-sums):

For every artifact distributed to the public through Apache channels, the PMC

MUST supply a valid OpenPGP-compatible ASCII-armored detached signature file
MUST supply at least one checksum file
SHOULD supply a SHA-256 and/or SHA-512 checksum file
SHOULD NOT supply a MD5 or SHA-1 checksum file (because these are deprecated)

So this Jira will stop publishing .sha1 files, leaving only the .sha512

Issue Links

• is duplicated by: LUCENE-8514 MD5 and SHA1 should no longer be provided on download pages
• is duplicated by: SOLR-12800 MD5 and SHA1 should no longer be provided on download pages