[MWRAPPER-145] Allow for sha512 checksum verification of downloaded artifacts

[jira-importer]

Brian Demers opened MWRAPPER-145 and commented

The wrapper supports both dist and wrapper jar sha256 checksums for download verification.

This is great but only sha512 (and legacy sha1, md5) checksums are published to the Apache dist servers (linked from https://maven.apache.org/download.cgi) and available on Maven Central

(opinion: because the above we should favor sha512)

Similar to: MWRAPPER-75

---

No further details from MWRAPPER-145

[jira-importer]

Michael Osipov commented

Those are checksums for accidental/unintentional bitrot, not intentional. Read https://maven.apache.org/resolver/about-checksums.html

Tamas Cservenak

[jira-importer]

Tamas Cservenak commented

IMHO resolver != wrapper, and I agree with Brian, as ASF binary (and source) bundle include SHA512, so why not use it?

[jira-importer]

Michael Osipov commented

Yes, resolver isn't wrapper, but doesn't the same logic apply?