Add checksum report as option during build phase

[gregturn]

Generating a report showing the checksums of everything package into either a JAR or WAR would be useful for many end users.

Here are some brainstormed ideas I would want in this report if I was at my old job where we had such process standards in place:

• checksum value or SHA hash of each file bundled (like JARs, support files, etc.)
• at a minimum the report should be generated adjacent to the JAR, so people can pick up the report and hand it to QA, auditors, etc. Such teams can probably easily incorporate into their processes as desired
• embedding the report inside a JAR might be convenient as well (if possible). This way, any given JAR file can be interrogated to see if it matches an independently registered file
• optionally adding things like git hash values to the report if git is being used would enhance traceability to the source
• optionally embed a free form text value in the report. This would probably allow end users to customize the report in ways we can't predict. People might embed their own control codes, labels, etc.

[philwebb]

@gregturn Have you seen any plugins/tools for this? It seems like it could be a generally useful plugin even if you aren't using Boot.

[kennyk65]

Original requirement from the customer was to see the 'version of the app', which of course is a little ambiguous. I think they'd like to see the war/jar name, plus the classpath. Their use case is just for auditing purposes

[gregturn]

@philwebb For the record, I have done zero research in plugins.

[frankr12]

We are using maven-jarsigner-plugin for signing the final artifact. It will give a listing of all files, libraries and their SHA hashes in META-INF/MANIFEST.MF. Not a nice report but I guess it can easily be turned into one.

[wilkinsona]

Looks like this came up in the AliExpress talk at Spring IO: https://twitter.com/TubbyNL/status/865156761464057856

[philwebb]

We're cleaning out the issue tracker and closing issues that we've not seen much demand to fix. Feel free to comment with additional justifications if you feel that this one should not have been closed.