[
https://issues.apache.org/jira/browse/MNGSITE-347?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16582649#comment-16582649
]
Karl Heinz Marbaise commented on MNGSITE-347:
---------------------------------------------
First on the pages there should be no reference to MD5 checksums anymore please
check against SHA1 checksums instead...furthermore can you please write where
you got the MD5 checksums from ?
Apart from that I recommend to use always https for the Apache Maven Sites...
> Maven Download page : MD5 not match the download
> ------------------------------------------------
>
> Key: MNGSITE-347
> URL: https://issues.apache.org/jira/browse/MNGSITE-347
> Project: Maven Project Web Site
> Issue Type: Bug
> Environment: Windows
> Reporter: Jean-Patrick BOYET
> Priority: Trivial
> Labels: security
>
> Dear All,
> After dowloading the latest maven release from:
> [http://maven.apache.org/download.cgi]
> with the following link:
> [http://mirror.ibcp.fr/pub/apache/maven/maven-3/3.5.4/binaries/apache-maven-3.5.4-bin.zip]
> and verifying the MD5 checksum with both MD5 and WinMD5Free, they do not
> match:
> 235db716537989e9e949e5bf23f965c0 # 8a0d9cc9d4da3fac195de8e1e99fe07158d54192
> trying with other mirror: the same.
> Verifying with older version:
> [https://archive.apache.org/dist/maven/binaries/apache-maven-3.2.2-bin.zip]
> and
> [https://archive.apache.org/dist/maven/binaries/apache-maven-3.2.2-bin.zip.md5]
> They match !
>
> MD5 not updated on the download page ?
> Regards
>
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
