[SLING-7534] Release policy - stop providing MD5 and start providing SHA-512 checksums

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: Parent 43
• Component/s: Tooling
• Assignee: Konrad Windszus
• Reporter: Robert Munteanu
• Created: 05/Mar/18 15:53
• Updated: 22/Jul/21 09:07
• Resolved: 21/May/21 07:05

Description

See http://www.apache.org/dev/release-distribution#sigs-and-sums , we SHOULD no longer provide MD5 checksums for new releases.

Issue Links

• causes: SLING-10355 Update the Commiter CLI to check SHA-512 signatures for the source release
• is blocked by: MRESOLVER-56 Support SHA-256 and SHA-512 as checksums
• is duplicated by: SLING-8052 MD5 and SHA1 should no longer be provided on download pages
• is related to: SLING-8699 Create sub-command to moving artifacts to dist.apache.org
• is related to: MPOM-205 create SHA-512 checksum for source-release archive(s) in target/checkout/target/ during release
• is related to: MDEPLOY-271 Allow to optionally disable checksum creation
• is related to: MPOM-244 Deploy SHA-512 for source-release to Remote Repository
• relates to: JCR-4378 MD5 and SHA1 should no longer be provided on download pages
• links to: GH PR
• links to: MVNCENTRAL-5276
• links to: NEXUS-21802

Sub-Tasks

• Update check_staged_release.sh to verify SHA-512 signature for the source release: Resolved