Generate sha512 aside of sha1

[cstamas]

Is handy to have multiple hashes and let resolver get strongest.

[manandbytes]

to have multiple hashes

Not sure about Resolver's behaviour in this regard, will it check all of them? Just flashback from the past where eclipse p2 did exactly this.

[cstamas]

See https://maven.apache.org/resolver-archives/resolver-1.9.25/configuration.html (as Maven 3.x uses Resolver 1.x).
The aether.checksums.algorithms key, that defaults to "SHA-1,MD5" defines two things:

• generated checksums on deploy
• the order of tried checksums on consume

So the second stanza means that that list is queried in order (first SHA1 is tried, but today everything have it, so it stops there. If there would be no sha1, Maven would ask for md5 and use that). Hence, the order in config is important.

[cstamas]

The project config uses list of "SHA-512,SHA-1,MD5" and it makes sense to define the list "from strongest to weakest". Also, depite the used algorithms are cryptographical hashes, Maven (resolver) uses them merely for bit-rot detection, there is nothing crypto involved there. It is just "nice to have" that Maven essentially (mis)uses hashes as checksums as they do somewhat overlap.