You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@community.apache.org by tensizes <te...@gmail.com> on 2015/06/03 21:44:21 UTC
Source signed by someone not on your list
Hi,
This is a security heads-up. After downloading the latest release of
Apache Open Office and checking the key, I found it was signed by someone
not on your published KEYS file list of contributors, someone named Jeurgen
Schmidt
His/her pgp key id is 51B5FDE8
The release file is from mirror http://mirrors.gigenet.com
Filename: apache-openoffice-4.1.1-r1617669-src.tar.bz2
Either Jeurgen Schmidt has been left off of your list, or they have been
signing sources without permission.
Thanks for your development efforts,
tensizes
RE: Source signed by someone not on your list
Posted by "Ross Gardler (MS OPEN TECH)" <Ro...@microsoft.com>.
Thank you for your email, this is very helpul. I'm copying the open office project team for their information.
Ross
-----Original Message-----
From: tensizes [mailto:tensizes@gmail.com]
Sent: Wednesday, June 3, 2015 12:44 PM
To: dev@community.apache.org
Subject: Source signed by someone not on your list
Hi,
This is a security heads-up. After downloading the latest release of Apache Open Office and checking the key, I found it was signed by someone not on your published KEYS file list of contributors, someone named Jeurgen Schmidt
His/her pgp key id is 51B5FDE8
The release file is from mirror http://mirrors.gigenet.com
Filename: apache-openoffice-4.1.1-r1617669-src.tar.bz2
Either Jeurgen Schmidt has been left off of your list, or they have been signing sources without permission.
Thanks for your development efforts,
tensizes
Re: Source signed by someone not on your list
Posted by Rob Weir <ro...@robweir.com>.
On Wed, Jun 3, 2015 at 3:49 PM, jan i <ja...@apache.org> wrote:
> Hi
>
> Juergen Schmidt was the release manager for the latest AOO releases so the
> key is valid.
>
> If you use our official mirror through www.openoffice.org you should see
> that the
> key is legal.
>
> but thanks for being observant and reporting your findings.
>
> rgds
> jan i
> v.p. apache openoffice
>
>
> On Wednesday, June 3, 2015, tensizes <te...@gmail.com> wrote:
>
> > Hi,
> >
> > This is a security heads-up. After downloading the latest release of
> > Apache Open Office and checking the key, I found it was signed by someone
> > not on your published KEYS file list of contributors, someone named
> Jeurgen
> > Schmidt
> >
> > His/her pgp key id is 51B5FDE8
> >
>
His key is listed here as well: http://openoffice.apache.org/security
-Rob
> > The release file is from mirror http://mirrors.gigenet.com
> > Filename: apache-openoffice-4.1.1-r1617669-src.tar.bz2
> >
> > Either Jeurgen Schmidt has been left off of your list, or they have been
> > signing sources without permission.
> >
> > Thanks for your development efforts,
> > tensizes
> >
>
>
> --
> Sent from My iPad, sorry for any misspellings.
>
Re: Source signed by someone not on your list
Posted by Rob Weir <ro...@robweir.com>.
On Wed, Jun 3, 2015 at 3:49 PM, jan i <ja...@apache.org> wrote:
> Hi
>
> Juergen Schmidt was the release manager for the latest AOO releases so the
> key is valid.
>
> If you use our official mirror through www.openoffice.org you should see
> that the
> key is legal.
>
> but thanks for being observant and reporting your findings.
>
> rgds
> jan i
> v.p. apache openoffice
>
>
> On Wednesday, June 3, 2015, tensizes <te...@gmail.com> wrote:
>
> > Hi,
> >
> > This is a security heads-up. After downloading the latest release of
> > Apache Open Office and checking the key, I found it was signed by someone
> > not on your published KEYS file list of contributors, someone named
> Jeurgen
> > Schmidt
> >
> > His/her pgp key id is 51B5FDE8
> >
>
His key is listed here as well: http://openoffice.apache.org/security
-Rob
> > The release file is from mirror http://mirrors.gigenet.com
> > Filename: apache-openoffice-4.1.1-r1617669-src.tar.bz2
> >
> > Either Jeurgen Schmidt has been left off of your list, or they have been
> > signing sources without permission.
> >
> > Thanks for your development efforts,
> > tensizes
> >
>
>
> --
> Sent from My iPad, sorry for any misspellings.
>
Re: Source signed by someone not on your list
Posted by jan i <ja...@apache.org>.
Hi
Juergen Schmidt was the release manager for the latest AOO releases so the
key is valid.
If you use our official mirror through www.openoffice.org you should see
that the
key is legal.
but thanks for being observant and reporting your findings.
rgds
jan i
v.p. apache openoffice
On Wednesday, June 3, 2015, tensizes <te...@gmail.com> wrote:
> Hi,
>
> This is a security heads-up. After downloading the latest release of
> Apache Open Office and checking the key, I found it was signed by someone
> not on your published KEYS file list of contributors, someone named Jeurgen
> Schmidt
>
> His/her pgp key id is 51B5FDE8
>
> The release file is from mirror http://mirrors.gigenet.com
> Filename: apache-openoffice-4.1.1-r1617669-src.tar.bz2
>
> Either Jeurgen Schmidt has been left off of your list, or they have been
> signing sources without permission.
>
> Thanks for your development efforts,
> tensizes
>
--
Sent from My iPad, sorry for any misspellings.
RE: Source signed by someone not on your list
Posted by "Ross Gardler (MS OPEN TECH)" <Ro...@microsoft.com>.
Thank you for your email, this is very helpul. I'm copying the open office project team for their information.
Ross
-----Original Message-----
From: tensizes [mailto:tensizes@gmail.com]
Sent: Wednesday, June 3, 2015 12:44 PM
To: dev@community.apache.org
Subject: Source signed by someone not on your list
Hi,
This is a security heads-up. After downloading the latest release of Apache Open Office and checking the key, I found it was signed by someone not on your published KEYS file list of contributors, someone named Jeurgen Schmidt
His/her pgp key id is 51B5FDE8
The release file is from mirror http://mirrors.gigenet.com
Filename: apache-openoffice-4.1.1-r1617669-src.tar.bz2
Either Jeurgen Schmidt has been left off of your list, or they have been signing sources without permission.
Thanks for your development efforts,
tensizes
Re: Source signed by someone not on your list
Posted by jan i <ja...@apache.org>.
Hi
Juergen Schmidt was the release manager for the latest AOO releases so the
key is valid.
If you use our official mirror through www.openoffice.org you should see
that the
key is legal.
but thanks for being observant and reporting your findings.
rgds
jan i
v.p. apache openoffice
On Wednesday, June 3, 2015, tensizes <te...@gmail.com> wrote:
> Hi,
>
> This is a security heads-up. After downloading the latest release of
> Apache Open Office and checking the key, I found it was signed by someone
> not on your published KEYS file list of contributors, someone named Jeurgen
> Schmidt
>
> His/her pgp key id is 51B5FDE8
>
> The release file is from mirror http://mirrors.gigenet.com
> Filename: apache-openoffice-4.1.1-r1617669-src.tar.bz2
>
> Either Jeurgen Schmidt has been left off of your list, or they have been
> signing sources without permission.
>
> Thanks for your development efforts,
> tensizes
>
--
Sent from My iPad, sorry for any misspellings.