Include sha256sums on the download page

[meta-forte]

Hi,

The page http://www.scala-lang.org/download/ does not have the md5/sha256sum values for the download packages.

Please can these be added to the site so that I can check my downloads

Aside, for now, please could you confirm if this is correct

d7335d2448cfed038f0cd79ed946ce82883651b80e4b698031261df23d9cb662 scala-2.11.8.deb

thank you

[jarrodu]

That is what I got when I downloaded it just now.

The download files are hosted by Lightbend and I don't have access to their servers. If I did I would check there.

[SethTisue]

This would be a nice enhancement. There would need to be corresponding changes in https://github.com/scala/make-release-notes

[jarrodu]

I am still thinking that the initial work needs to be done by Lightbend when the artifacts are uploaded to the server. When the hashs are available on the download server then links to them can be added to the download pages.

[SethTisue]

the initial work needs to be done by Lightbend when the artifacts are uploaded to the server

well, the scripts that do that are public and in version control, so anyone can do a pull request against them. but there's still truth in your statement, in that Lightbend folks will be needed to help test.

we're currently in the process of attempting to relocate our publishing process from Jenkins to Travis-CI (free or hosted, not sure which yet). let's come back to this once that effort has either succeeded or failed

[SethTisue]

the transition to Travis-CI is now complete. https://github.com/scala/scala-dist/blob/2.12.x/scripts/jobs/release/website/archives actually uploads the distribution packages to the server; the downloads page is still generated by https://github.com/scala/make-release-notes, as before.

[SethTisue]

I think the work needed for this may be confined to https://github.com/scala/make-release-notes, at least, if that isn't true, I don't see why.

[SethTisue]

to understand how this stuff works overall, it may be useful to consult e.g. scala/scala-dev#490 (the release steps we followed for 2.12.6)

[jarrodu]

Thanks for the extra resources. Just an extra thought. Do you think that gpg signatures would be a good thing to add at the same time? The hashes only provide a way to see if the download succeeded without corruption or tampering. The gpg signatures would allow for some assurance that the site its self was not compromised. The TLS certificates help with this but do not completely solve the problem.

Maybe I am over thinking this. Does anyone know if people have these concerns? I generally let sbt do whatever it wants and don't think much about it.

[ashawley]

Just an extra thought. Do you think that gpg signatures would be a good thing to add at the same time?

+1, but should probably be a new issue?

[SethTisue]

yeah I mean if somebody wanted to tackle both at the same time, awesome, but nobody should hold back from doing just the sums, that would still be awesome all by itself