[MINSTALL-133] Take Security More Seriously - Checksum by default

[jira-importer]

John Patrick opened MINSTALL-133 and commented

I believe that a default of createChecksum being false is bad practice and a checksum should always being produced.

Maven doesn't appear to have a guide so I'm looking towards the main apache guide i.e. https://www.apache.org/dev/release-signing.html

---

Affects: 2.5.2

Remote Links:

• GitHub Pull Request #97
  

0 votes, 5 watchers

[jira-importer]

Robert Scholte commented

Even though that parameter is specified in this plugin, I think it belongs to the maven-deploy-plugin. IIRC that's also that's also he approach chosen by Aether/Maven Resolver. Not sure what its default is.

[jira-importer]

Elliotte Rusty Harold commented

I think the install plugin only copies the built jar into the local repository. It's not used for remote deployment, and I can't think of anything that would fail if the checksum were off in this case. I propose closing this issue as won't fix unless a clearer problem can be stated.

Remote deployment is a very different story, but that's not this plugin.