Will provide SHA1 checksums soon

git-svn-id: https://svn.apache.org/repos/asf/ant/core/trunk@278244 13f79535-47bb-0310-9956-ffa450edef68

docs/bindownload.html

@@ -238,16 +238,19 @@ may not be available on all mirrors for a few days.</div>
 <li><code>.zip</code> archive: 
 <a href="[preferred]/ant/binaries/apache-ant-1.6.3-bin.zip">apache-ant-1.6.3-bin.zip</a>
 [<a href="http://www.apache.org/dist/ant/binaries/apache-ant-1.6.3-bin.zip.asc">PGP</a>]
+<!--[<a href="http://www.apache.org/dist/ant/binaries/apache-ant-1.6.3-bin.zip.sha1">SHA1</a>]-->
 [<a href="http://www.apache.org/dist/ant/binaries/apache-ant-1.6.3-bin.zip.md5">MD5</a>]</li>
 
 <li><code>.tar.gz</code> archive: 
 <a href="[preferred]/ant/binaries/apache-ant-1.6.3-bin.tar.gz">apache-ant-1.6.3-bin.tar.gz</a>
 [<a href="http://www.apache.org/dist/ant/binaries/apache-ant-1.6.3-bin.tar.gz.asc">PGP</a>]
+<!--[<a href="http://www.apache.org/dist/ant/binaries/apache-ant-1.6.3-bin.tar.gz.sha1">SHA1</a>]-->
 [<a href="http://www.apache.org/dist/ant/binaries/apache-ant-1.6.3-bin.tar.gz.md5">MD5</a>]</li>
 
 <li><code>.tar.bz2</code> archive: 
 <a href="[preferred]/ant/binaries/apache-ant-1.6.3-bin.tar.bz2">apache-ant-1.6.3-bin.tar.bz2</a>
 [<a href="http://www.apache.org/dist/ant/binaries/apache-ant-1.6.3-bin.tar.bz2.asc">PGP</a>]
+<!--[<a href="http://www.apache.org/dist/ant/binaries/apache-ant-1.6.3-bin.tar.bz2.sha1">SHA1</a>]-->
 [<a href="http://www.apache.org/dist/ant/binaries/apache-ant-1.6.3-bin.tar.bz2.md5">MD5</a>]</li>
 </ul>
                         <h3 class="section">
@@ -270,7 +273,8 @@ recommend to not use those releases but upgrade to Ant's <a href="[location]#Cur
       Verify Releases
     </h3>
                         <p>It is essential that you verify the integrity of the downloaded
-files using the PGP or MD5 signatures.</p>
+files using the PGP signature or the SHA1 or MD5 checksums.  The
+checksums are not as strong indicators as the PGP signature.</p>
                                 <p>The PGP signatures can be verified using PGP or GPG.  First
 download the <a href="http://www.apache.org/dist/ant/KEYS">KEYS</a>
 as well as the <code>asc</code> signature file for the particular
@@ -291,12 +295,12 @@ using</p>
 % gpg --import KEYS<br />
 % gpg --verify apache-ant-1.6.3-bin.tar.gz.asc
 </code></p>
-                                <p>Alternatively, you can verify the MD5 signature on the files.  A
-unix program called <code>md5</code> or <code>md5sum</code> is
-included in many unix distributions.  It is also available as part of
-<a href="http://www.gnu.org/software/textutils/textutils.html">GNU
-Textutils</a>.  Windows users can get binary md5 programs from <a href="http://www.fourmilab.ch/md5/">here</a>, <a href="http://www.pc-tools.net/win32/freeware/console/">here</a>, or
-<a href="http://www.slavasoft.com/fsum/">here</a>.</p>
+                                <p>Alternatively, you can verify the checksums on the files.  Unix
+programs called <code>md5</code>/<code>sha1</code> or
+<code>md5sum</code>/<code>sha1sum</code> are included in many unix
+distributions.  <code>*sum</code> is also available as part of <a href="http://www.gnu.org/software/textutils/textutils.html">GNU
+Textutils</a>.  Windows users can get binary md5 programs from <a href="http://www.fourmilab.ch/md5/">here</a>, <a href="http://www.pc-tools.net/win32/freeware/console/">here</a>.  <a href="http://www.slavasoft.com/fsum/">fsum</a> supports MD5 and
+SHA1.</p>
                                 <p>We highly recommend to verify the PGP signature, though.</p>
                 
     </div>

docs/srcdownload.html

@@ -236,16 +236,19 @@ may not be available on all mirrors for a few days.</div>
 <li><code>.zip</code> archive: 
 <a href="[preferred]/ant/source/apache-ant-1.6.3-src.zip">apache-ant-1.6.3-src.zip</a>
 [<a href="http://www.apache.org/dist/ant/source/apache-ant-1.6.3-src.zip.asc">PGP</a>]
+<!--[<a href="http://www.apache.org/dist/ant/source/apache-ant-1.6.3-src.zip.sha1">SHA1</a>]-->
 [<a href="http://www.apache.org/dist/ant/source/apache-ant-1.6.3-src.zip.md5">MD5</a>]</li>
 
 <li><code>.tar.gz</code> archive: 
 <a href="[preferred]/ant/source/apache-ant-1.6.3-src.tar.gz">apache-ant-1.6.3-src.tar.gz</a>
 [<a href="http://www.apache.org/dist/ant/source/apache-ant-1.6.3-src.tar.gz.asc">PGP</a>]
+<!--[<a href="http://www.apache.org/dist/ant/source/apache-ant-1.6.3-src.tar.gz.sha1">SHA1</a>]-->
 [<a href="http://www.apache.org/dist/ant/source/apache-ant-1.6.3-src.tar.gz.md5">MD5</a>]</li>
 
 <li><code>.tar.bz2</code> archive: 
 <a href="[preferred]/ant/source/apache-ant-1.6.3-src.tar.bz2">apache-ant-1.6.3-src.tar.bz2</a>
 [<a href="http://www.apache.org/dist/ant/source/apache-ant-1.6.3-src.tar.bz2.asc">PGP</a>]
+<!--[<a href="http://www.apache.org/dist/ant/source/apache-ant-1.6.3-src.tar.bz2.sha1">SHA1</a>]-->
 [<a href="http://www.apache.org/dist/ant/source/apache-ant-1.6.3-src.tar.bz2.md5">MD5</a>]</li>
 </ul>
                         <h3 class="section">
@@ -268,7 +271,8 @@ recommend to not use those releases but upgrade to Ant's <a href="[location]#Cur
       Verify Releases
     </h3>
                         <p>It is essential that you verify the integrity of the downloaded
-files using the PGP or MD5 signatures.</p>
+files using the PGP signature or the SHA1 or MD5 checksums.  The
+checksums are not as strong indicators as the PGP signature.</p>
                                 <p>The PGP signatures can be verified using PGP or GPG.  First
 download the <a href="http://www.apache.org/dist/ant/KEYS">KEYS</a>
 as well as the <code>asc</code> signature file for the particular
@@ -289,12 +293,12 @@ using</p>
 % gpg --import KEYS<br />
 % gpg --verify apache-ant-1.6.3-src.tar.gz.asc
 </code></p>
-                                <p>Alternatively, you can verify the MD5 signature on the files.  A
-unix program called <code>md5</code> or <code>md5sum</code> is
-included in many unix distributions.  It is also available as part of
-<a href="http://www.gnu.org/software/textutils/textutils.html">GNU
-Textutils</a>.  Windows users can get binary md5 programs from <a href="http://www.fourmilab.ch/md5/">here</a>, <a href="http://www.pc-tools.net/win32/freeware/console/">here</a>, or
-<a href="http://www.slavasoft.com/fsum/">here</a>.</p>
+                                <p>Alternatively, you can verify the checksums on the files.  Unix
+programs called <code>md5</code>/<code>sha1</code> or
+<code>md5sum</code>/<code>sha1sum</code> are included in many unix
+distributions.  <code>*sum</code> is also available as part of <a href="http://www.gnu.org/software/textutils/textutils.html">GNU
+Textutils</a>.  Windows users can get binary md5 programs from <a href="http://www.fourmilab.ch/md5/">here</a>, <a href="http://www.pc-tools.net/win32/freeware/console/">here</a>.  <a href="http://www.slavasoft.com/fsum/">fsum</a> supports MD5 and
+SHA1.</p>
                                 <p>We highly recommend to verify the PGP signature, though.</p>
                 
     </div>

xdocs/bindownload.xml

@@ -49,7 +49,6 @@ directory</a> or, preferably, its <a href="[preferred]/ant/">mirror</a>.</p>
 
 </section>
 
-
 <section name="Mirror">
 
 <p>You are currently using <b>[preferred]</b>.  If you encounter a
@@ -94,16 +93,19 @@ may not be available on all mirrors for a few days.</div>
 <li><code>.zip</code> archive: 
 <a href="[preferred]/ant/binaries/apache-ant-1.6.3-bin.zip">apache-ant-1.6.3-bin.zip</a>
 [<a href="http://www.apache.org/dist/ant/binaries/apache-ant-1.6.3-bin.zip.asc">PGP</a>]
+<!--[<a href="http://www.apache.org/dist/ant/binaries/apache-ant-1.6.3-bin.zip.sha1">SHA1</a>]-->
 [<a href="http://www.apache.org/dist/ant/binaries/apache-ant-1.6.3-bin.zip.md5">MD5</a>]</li>
 
 <li><code>.tar.gz</code> archive: 
 <a href="[preferred]/ant/binaries/apache-ant-1.6.3-bin.tar.gz">apache-ant-1.6.3-bin.tar.gz</a>
 [<a href="http://www.apache.org/dist/ant/binaries/apache-ant-1.6.3-bin.tar.gz.asc">PGP</a>]
+<!--[<a href="http://www.apache.org/dist/ant/binaries/apache-ant-1.6.3-bin.tar.gz.sha1">SHA1</a>]-->
 [<a href="http://www.apache.org/dist/ant/binaries/apache-ant-1.6.3-bin.tar.gz.md5">MD5</a>]</li>
 
 <li><code>.tar.bz2</code> archive: 
 <a href="[preferred]/ant/binaries/apache-ant-1.6.3-bin.tar.bz2">apache-ant-1.6.3-bin.tar.bz2</a>
 [<a href="http://www.apache.org/dist/ant/binaries/apache-ant-1.6.3-bin.tar.bz2.asc">PGP</a>]
+<!--[<a href="http://www.apache.org/dist/ant/binaries/apache-ant-1.6.3-bin.tar.bz2.sha1">SHA1</a>]-->
 [<a href="http://www.apache.org/dist/ant/binaries/apache-ant-1.6.3-bin.tar.bz2.md5">MD5</a>]</li>
 </ul>
 </section>
@@ -130,7 +132,8 @@ href="[location]#Current Release of Ant">latest</a> release.</p>
 <section name="Verify Releases">
 
 <p>It is essential that you verify the integrity of the downloaded
-files using the PGP or MD5 signatures.</p>
+files using the PGP signature or the SHA1 or MD5 checksums.  The
+checksums are not as strong indicators as the PGP signature.</p>
 
 <p>The PGP signatures can be verified using PGP or GPG.  First
 download the <a href="http://www.apache.org/dist/ant/KEYS">KEYS</a>
@@ -155,14 +158,16 @@ using</p>
 % gpg --verify apache-ant-1.6.3-bin.tar.gz.asc
 </code></p>
 
-<p>Alternatively, you can verify the MD5 signature on the files.  A
-unix program called <code>md5</code> or <code>md5sum</code> is
-included in many unix distributions.  It is also available as part of
-<a href="http://www.gnu.org/software/textutils/textutils.html">GNU
+<p>Alternatively, you can verify the checksums on the files.  Unix
+programs called <code>md5</code>/<code>sha1</code> or
+<code>md5sum</code>/<code>sha1sum</code> are included in many unix
+distributions.  <code>*sum</code> is also available as part of <a
+href="http://www.gnu.org/software/textutils/textutils.html">GNU
 Textutils</a>.  Windows users can get binary md5 programs from <a
 href="http://www.fourmilab.ch/md5/">here</a>, <a
-href="http://www.pc-tools.net/win32/freeware/console/">here</a>, or
-<a href="http://www.slavasoft.com/fsum/">here</a>.</p>
+href="http://www.pc-tools.net/win32/freeware/console/">here</a>.  <a
+href="http://www.slavasoft.com/fsum/">fsum</a> supports MD5 and
+SHA1.</p>
 
 <p>We highly recommend to verify the PGP signature, though.</p>
 

xdocs/srcdownload.xml

@@ -90,16 +90,19 @@ may not be available on all mirrors for a few days.</div>
 <li><code>.zip</code> archive: 
 <a href="[preferred]/ant/source/apache-ant-1.6.3-src.zip">apache-ant-1.6.3-src.zip</a>
 [<a href="http://www.apache.org/dist/ant/source/apache-ant-1.6.3-src.zip.asc">PGP</a>]
+<!--[<a href="http://www.apache.org/dist/ant/source/apache-ant-1.6.3-src.zip.sha1">SHA1</a>]-->
 [<a href="http://www.apache.org/dist/ant/source/apache-ant-1.6.3-src.zip.md5">MD5</a>]</li>
 
 <li><code>.tar.gz</code> archive: 
 <a href="[preferred]/ant/source/apache-ant-1.6.3-src.tar.gz">apache-ant-1.6.3-src.tar.gz</a>
 [<a href="http://www.apache.org/dist/ant/source/apache-ant-1.6.3-src.tar.gz.asc">PGP</a>]
+<!--[<a href="http://www.apache.org/dist/ant/source/apache-ant-1.6.3-src.tar.gz.sha1">SHA1</a>]-->
 [<a href="http://www.apache.org/dist/ant/source/apache-ant-1.6.3-src.tar.gz.md5">MD5</a>]</li>
 
 <li><code>.tar.bz2</code> archive: 
 <a href="[preferred]/ant/source/apache-ant-1.6.3-src.tar.bz2">apache-ant-1.6.3-src.tar.bz2</a>
 [<a href="http://www.apache.org/dist/ant/source/apache-ant-1.6.3-src.tar.bz2.asc">PGP</a>]
+<!--[<a href="http://www.apache.org/dist/ant/source/apache-ant-1.6.3-src.tar.bz2.sha1">SHA1</a>]-->
 [<a href="http://www.apache.org/dist/ant/source/apache-ant-1.6.3-src.tar.bz2.md5">MD5</a>]</li>
 </ul>
 </section>
@@ -126,7 +129,8 @@ href="[location]#Current Release of Ant">latest</a> release.</p>
 <section name="Verify Releases">
 
 <p>It is essential that you verify the integrity of the downloaded
-files using the PGP or MD5 signatures.</p>
+files using the PGP signature or the SHA1 or MD5 checksums.  The
+checksums are not as strong indicators as the PGP signature.</p>
 
 <p>The PGP signatures can be verified using PGP or GPG.  First
 download the <a href="http://www.apache.org/dist/ant/KEYS">KEYS</a>
@@ -151,14 +155,16 @@ using</p>
 % gpg --verify apache-ant-1.6.3-src.tar.gz.asc
 </code></p>
 
-<p>Alternatively, you can verify the MD5 signature on the files.  A
-unix program called <code>md5</code> or <code>md5sum</code> is
-included in many unix distributions.  It is also available as part of
-<a href="http://www.gnu.org/software/textutils/textutils.html">GNU
+<p>Alternatively, you can verify the checksums on the files.  Unix
+programs called <code>md5</code>/<code>sha1</code> or
+<code>md5sum</code>/<code>sha1sum</code> are included in many unix
+distributions.  <code>*sum</code> is also available as part of <a
+href="http://www.gnu.org/software/textutils/textutils.html">GNU
 Textutils</a>.  Windows users can get binary md5 programs from <a
 href="http://www.fourmilab.ch/md5/">here</a>, <a
-href="http://www.pc-tools.net/win32/freeware/console/">here</a>, or
-<a href="http://www.slavasoft.com/fsum/">here</a>.</p>
+href="http://www.pc-tools.net/win32/freeware/console/">here</a>.  <a
+href="http://www.slavasoft.com/fsum/">fsum</a> supports MD5 and
+SHA1.</p>
 
 <p>We highly recommend to verify the PGP signature, though.</p>