You are viewing a plain text version of this content. The canonical link for it is here.
Posted to j-users@xerces.apache.org by John Zoetebier <jo...@transparent.co.nz> on 2004/11/02 22:20:50 UTC
Problem gpg --verify of Xerces download
I have downloaded these file from http://www.apache.org/dist/xml/xerces-j/
KEYS
Xerces-J-bin.2.6.2.tar.gz
Xerces-J-bin.2.6.2.tar.gz.sig
Import keys with:
gpg --import KEYS
Verify signature gives error:
==>
[johnz@tsl010 Xerces]$ gpg --verify Xerces-J-bin.2.6.2.tar.gz.sig
Xerces-J-bin.2.6.2.tar.gz
gpg: Signature made Sat 21 Feb 2004 10:23:01 AM NZDT using DSA key ID
745ECEAA
gpg: Good signature from "Michael Glavassevich <mr...@ca.ibm.com>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the
owner.
Primary key fingerprint: 3526 7674 1E89 E1F0 20DF 0F43 1DC3 01DC 745E CEAA
[johnz@tsl010 Xerces]$
==>
What can be wrong here ?
--
John Zoetebier
Web site: http://www.transparent.co.nz
---------------------------------------------------------------------
To unsubscribe, e-mail: xerces-j-user-unsubscribe@xml.apache.org
For additional commands, e-mail: xerces-j-user-help@xml.apache.org
Re: Problem gpg --verify of Xerces download
Posted by Michael Glavassevich <mr...@ca.ibm.com>.
news <ne...@sea.gmane.org> wrote on 11/02/2004 04:20:50 PM:
> I have downloaded these file from
http://www.apache.org/dist/xml/xerces-j/
> KEYS
> Xerces-J-bin.2.6.2.tar.gz
> Xerces-J-bin.2.6.2.tar.gz.sig
>
> Import keys with:
> gpg --import KEYS
>
> Verify signature gives error:
> ==>
> [johnz@tsl010 Xerces]$ gpg --verify Xerces-J-bin.2.6.2.tar.gz.sig
> Xerces-J-bin.2.6.2.tar.gz
> gpg: Signature made Sat 21 Feb 2004 10:23:01 AM NZDT using DSA key ID
> 745ECEAA
> gpg: Good signature from "Michael Glavassevich <mr...@ca.ibm.com>"
> gpg: WARNING: This key is not certified with a trusted signature!
> gpg: There is no indication that the signature belongs to the
> owner.
> Primary key fingerprint: 3526 7674 1E89 E1F0 20DF 0F43 1DC3 01DC 745E
CEAA
> [johnz@tsl010 Xerces]$
> ==>
>
> What can be wrong here ?
It means my key has not been cross-signed by someone else. There are
number of other people who aren't connected to the Apache web of trust
[1]. It's just a matter of meeting face to face with someone who is
connected and cross-signing keys with them. That's on my TODO list.
> --
> John Zoetebier
> Web site: http://www.transparent.co.nz
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: xerces-j-user-unsubscribe@xml.apache.org
> For additional commands, e-mail: xerces-j-user-help@xml.apache.org
>
[1] http://www.apache.org/~henkp/trust/apache.html
Michael Glavassevich
XML Parser Development
IBM Toronto Lab
E-mail: mrglavas@ca.ibm.com
E-mail: mrglavas@apache.org