Hi.

I downloaded the hibernate-annotations-3.3.1.GA.zip and wanted to verify it with an md5 file.

I see that the core has an md5, but other downloads don't.

Could someone post the md5 for the annotations zip? Are there plans in the future to post these for other non-core downloads?

Thanks in advance!

Josh

Hi,

Where did you download from? Sourceforge? I think you are right that there are no md5 checksums there for Hibernate sub projects. I guess we could start doing it.

If you are just interested in the jar file (not the whole distribution) and want to verify it you could use the jboss maven repository: http://repository.jboss.com/maven2/org/hibernate/hibernate-annotations/3.3.1.GA/. There the checksum files are published.

--Hardy

Hi Hardy.

I did download from sourceforge. The reason I was hoping for checksums (although pgp signatures would be better) was that I was worried about malicious code from a mirror.

How concerned should I be about downloading code without signatures? Does the SHA1 checksum (on the maven site) give you any protection?

Thanks for the info.
Josh

Hi,

You never have a full guarantee. If someone compromises eg a mirror he would probably change the checksums as well. Personally, I would not be concerned about downloading from sourceforge or the jboss repo.

You could checkout the source from svn and build the release yourself.

--Hardy