[UIMA-6453] Invalid SHA512 generated for Maven artifacts

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.2.0uimaFIT, 3.2.0SDK, 3.1.0ruta, 3.3.0SDK
• Fix Version/s: 3.3.0uimaFIT, 3.1.0ruta, parent-pom-15, 0.4.0jsoncas, 3.3.1SDK
• Component/s: Build, Packaging and Test
• Assignee: Richard Eckart de Castilho
• Reporter: Richard Eckart de Castilho
• Created: 13/May/22 08:23
• Updated: 13/May/22 18:12
• Resolved: 13/May/22 17:39

Description

The SHA512 signature files we generate for the Maven artifacts overwrite each other. E.g. in the recent uimaFIT 3.3.0 RC 2, I found:

% cat org/apache/uima/uimafit-maven-plugin/3.3.0/uimafit-maven-plugin-3.3.0.sha512
4db94daceccf1727b1620a20a708eb1830a95fa8ad967219ad7fff537bf845055174f659b43f3bb827cd1296d4608c10b3f36306a76da4dd27af50a45517bb2f  uimafit-maven-plugin-3.3.0-javadoc.jar

Looking at Maven Central, I can see such bad signatures in multiple releases:

UIMAJ

• https://repo1.maven.org/maven2/org/apache/uima/uimaj-core/3.1.1/ - looks ok
• https://repo1.maven.org/maven2/org/apache/uima/uimaj-core/3.2.0/ - BAD
• https://repo1.maven.org/maven2/org/apache/uima/uimaj-core/3.3.0/ - BAD (latest version)

uimaFIT

• https://repo1.maven.org/maven2/org/apache/uima/uimafit-core/3.1.0/ - looks ok
• https://repo1.maven.org/maven2/org/apache/uima/uimafit-core/3.2.0/ - BAD (latest version)

RUTA

• https://repo1.maven.org/maven2/org/apache/uima/ruta-core/3.0.1/ - looks ok
• https://repo1.maven.org/maven2/org/apache/uima/ruta-core/3.1.0/ - BAD (latest version)

UIMA-AS

• https://repo1.maven.org/maven2/org/apache/uima/uimaj-as-core/2.9.0/ - last release seems to have been before the SHA512 requirement

DUCC

• https://repo1.maven.org/maven2/org/apache/uima/uima-ducc-common/3.0.0/ - looks ok (latest version)

Issue Links

• relates to: UIMA-6432 Upgrade dependencies (uimaFIT 3.3.0)
• relates to: UIMA-6447 Update dependencies (Ruta 3.2.0)
• relates to: UIMA-6454 Update dependencies (UIMA Java SDK 3.3.1)
• relates to: UIMA-6455 Update dependencies (JSON CAS IO 0.4.0)