Maven Repository Checksums

How to verify a checksum

> By the way... without maven implicitly checking the checksum and reporting a
> problem to me, I don't know how to manually check the checksum for myself.

Normally, you could just do:

$ sha1sum -c filename.jar.sha1

However, the checksums in the repository do not have the usual *filename appended to the checksum, so you get:

$ sha1sum -c commons-logging-1.0.4.jar.sha1
sha1sum: commons-logging-1.0.4.jar.sha1: no properly formatted SHA1 checksum lines found

So, resort to:

$ sha1sum commons-logging-1.0.4.jar
f029a2aefe2b3e1517573c580f948caac31b1056 *commons-logging-1.0.4.jar

And compare with the checksum:

$ cat commons-logging-1.0.4.jar.sha1
f029a2aefe2b3e1517573c580f948caac31b1056

(If you're on Windows, Cygwin has the md5 and sha1 utilities: http://www.cygwin.com )