西格贾尔& jar:sign 与 Artifactory 校验和
如果作为构建的一部分，我通过 Ant 的 signjar 任务对一个 jar 进行签名，那么它将被视为“已签名的 jar”。通过执行 jar:sign 目标，可以在 Maven 领域完成同样的事情。
Artifactory 等存储库管理器具有校验和的概念，您可以因校验和错误而导致部署失败，可以重新计算错误/丢失的校验和，并根据校验和状态采取各种其他操作。
我想知道通过 signjar 或 jar:sign 等方法获得的 jar 的结果（“签名”）与 Artifactory 的校验和概念之间有什么关系。
“校验和”只是运行这些签名任务/目标所产生的内容的通用术语吗？或者它们是完全不同的项目？
If, as part of my build, I sign a jar via Ant's signjar task, it will then be considered a "signed jar". The same thing can be accomplished in Maven-land by executing the jar:sign goal.
Repository managers such as Artifactory have the concept of checksums where you can fail deployments on bad checksums, you can recalculate bad/missing checksums, and take all sorts of other actions based on checksum status.
I'm wondering what the relationship is between the results ("signing") of jars via methods like signjar or jar:sign to Artifactory's notion of checksums.
Are "checksums" just a generic term for what is produced by running these signature tasks/goals? Or are they completely different items altogether?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
校验和是文件内容的数字表示。签名是给文件添加签名的过程。
由于签名过程中文件的大小和内容会发生变化，因此签名和未签名的同一文件的校验和会有所不同。
使用校验和验证文件传输是否成功的过程对于 Artifactory 来说并不特殊。
对于上传，它是这样的：
当您使用构建工具（Maven 或 Ivy）在签名后将 jar 部署到 Artifactory 时，计算出的校验和将是正确的（签名的 jar 的），因此一切都应该按预期工作。
Checksum is a numeric representation of file's content. Signing is a process of adding signature to the file.
Since the size and the content of file change during the signing, checksums of the same file singed and unsigned will be different.
The process of verifying file transfer success with checksums is not special to Artifactory.
For upload it goes like this:
When you use build tool (Maven or Ivy) to deploy jars to Artifactory after signing, the calculated checksum will be the correct one (of the signed jar), so everything should work as expected.
签名的 jar 可以保证其内容是由签名者创建的。而校验和只是检查文件是否完好。例如，某人可以修改文件并更改校验和以匹配新内容。
A signed jar gives a guarantee that its content been created by the person who signed it. While check sum is just a check that file is intact. For example, someone can modify file and change check sum to match the new content.