[MNG-7776] don't fingerprint Sigstore signatures (like GPG)

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.9.1, 4.0.0-alpha-5
• Fix Version/s: 3.9.2, 4.0.0-alpha-7, 4.0.0
• Assignee: Herve Boutemy
• Reporter: Herve Boutemy
• Created: 29/Apr/23 09:21
• Updated: 25/Jun/23 13:44
• Resolved: 01/Jun/23 15:17

Description

Maven repository format requires .md5 and .sha1 fingerprints/checksums for every artifact: https://maven.apache.org/repository/layout.html

.GPG signature (.asc) is not considered as an artifact, and it does not require these fingerprints

While working on Sigstore support in addition to GPG, the same should be done for Sigstore signatures: no fingerprint for .sigstore files (like no GPG signature for Sigstore signature: see MGPG-86)

Issue Links

• is fixed by: MNG-7769 Upgrade to Maven Resolver 1.9.10
• relates to: MGPG-95 don't GPG-sign .sigstore signatures
• requires: MRESOLVER-360 disable checksum by default for .sigstore in addition to .asc