anchor.diff:  
   .Fetch artifacts
   ----
  -% svn co https://dist.apache.org/repos/dist/dev/uima/RELEASE-CANDIDATE-ID
  +% svn export https://dist.apache.org/repos/dist/dev/uima/RELEASE-CANDIDATE-ID
   % lftp -e "mirror org; exit" https://repository.apache.org/content/repositories/STAGING-REPO-ID
   ----
   
  
positive.code: 
  % chmod +x checkHashes.sh
  
  % find . -not '(' -name '*.md5' -or -name '*.sha*' -or -name '*.asc' -or -name 'maven-metadata.xml' -or -name 'DEPENDENCIES' -or -name 'LICENSE' -or -name 'NOTICE' ')' -type f -print0 | xargs -I '{}' -0 -n1 ./checkHashes.sh '{}'
  
  % rm checkHashes.sh
  ----
  
negative.code: 
  .Check GPG signatures
  ----
  % find . -not '(' -name '*.md5' -or -name '*.sha*' -or -name '*.asc' -or -name 'maven-metadata.xml' -or -name 'DEPENDENCIES' -or -name 'LICENSE' -or -name 'NOTICE' ')' -type f -print0 | xargs -I '{}' -0 -n1 -S 2000 gpg --verify '{}'.asc '{}'
  ----
  
  For the same set of files for which we checked the signatures, also check the SHA512 hashes are valid.
  
  .Check SHA512 hashes
  ----
  % find . -not '(' -name '*.md5' -or -name '*.sha*' -or -name '*.asc' -or -name 'maven-metadata.xml' -or -name 'DEPENDENCIES' -or -name 'LICENSE' -or -name 'NOTICE' ')' -type f -print0 | xargs -I '{}' -0 -n1 -S 2000 zsh -c 'cd `dirname {}`; sha512sum -c `basename {}.sha512`'
  ----
  
  Checking SHA1/MD5 files generated by the Maven Repository is a bit tedious because the hashsum files do not contain the filename and so the `sha1sum` and `md5sum` checking functionality does not work. We have to do set up a little script to help us.
  