You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@santuario.apache.org by bu...@apache.org on 2010/09/22 01:58:40 UTC
DO NOT REPLY [Bug 49970] New: Releases are not being served from the
ASF mirror system
https://issues.apache.org/bugzilla/show_bug.cgi?id=49970
Summary: Releases are not being served from the ASF mirror
system
Product: Security
Version: unspecified
Platform: PC
OS/Version: Windows XP
Status: NEW
Severity: blocker
Priority: P2
Component: Signature
AssignedTo: security-dev@xml.apache.org
ReportedBy: sebb@apache.org
Santuario releases are not being served from the ASF mirror system.
AIUI, all ASF releases MUST use the mirror system.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
DO NOT REPLY [Bug 49970] Releases are not being served from the ASF
mirror system
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=49970
--- Comment #2 from Sebb <se...@apache.org> 2010-09-21 20:15:57 EDT ---
Note: the download page
http://santuario.apache.org/download.html
says:
"Source and binary distributions for both the Java and C++ libraries are
available from from the project site only. Current distributions are not
available from the mirrors."
This is not actually true, as the mirrors do have the current release.
Also, there are no MD5 or SHA1 checksum files for the releases.
AIUI at least one of these is also required for all ASF releases.
The download page then needs to link to the MD5/SHA1 checksums on the main
(non-mirror) server.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
DO NOT REPLY [Bug 49970] Releases are not being served from the ASF
mirror system
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=49970
--- Comment #7 from Sebb <se...@apache.org> 2010-09-22 09:50:36 EDT ---
AIUI, the requirement for MD5 files applies to all releases created after the
rule was published, and that was some years ago.
It's trivial to create MD5 / SHA files for existing archives.
I can create them if you want.
BTW, the Forrest web-site has a good download page:
http://forrest.apache.org/mirrors.cgi
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
DO NOT REPLY [Bug 49970] Releases are not being served from the ASF
mirror system
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=49970
Sebb <se...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|WORKSFORME |
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
DO NOT REPLY [Bug 49970] Releases are not being served from the ASF
mirror system
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=49970
--- Comment #9 from Sebb <se...@apache.org> 2010-09-22 19:13:53 EDT ---
The updated download page still points to the main ASF systems, not the
mirrors.
" available from the ASF distribution directory [1] ...
In addition, all distributions are available from the project site. [2]"
Neither [1] nor [2] should be promoted as download directories (except for KEYS
and the hash files).
There are also no links to the MD5 files.
[1] http://www.apache.org/dist/santuario/
[2] http://santuario.apache.org/dist/
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
DO NOT REPLY [Bug 49970] Releases are not being served from the ASF
mirror system
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=49970
--- Comment #3 from Scott Cantor <ca...@osu.edu> 2010-09-21 21:45:30 EDT ---
The web site is a known issue, I don't expect anything to get done there for a
while, but it's tracked.
I thought the checksums were created when the files were put into place the
other day. The directory isn't group writeable, will need to wait on the PMC
chair to fix.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
DO NOT REPLY [Bug 49970] Releases are not being served from the ASF
mirror system
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=49970
--- Comment #6 from coheigea <co...@apache.org> 2010-09-22 09:44:38 EDT ---
> "... must be accompanied by one file containing an OpenPGP compatible ASCII
> armored detached signature and another file containing an MD5 checksum."
Understood. I will make sure that all future releases will conform with this
requirement.
Colm.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
DO NOT REPLY [Bug 49970] Releases are not being served from the ASF
mirror system
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=49970
--- Comment #8 from coheigea <co...@apache.org> 2010-09-22 12:31:40 EDT ---
> It's trivial to create MD5 / SHA files for existing archives.
> I can create them if you want.
No thanks, I've taken care of it. All current and archived Santuario artifacts
now have a corresponding checksum file, and should appear on the ASF mirror
system whenever it sync's up.
Colm.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
DO NOT REPLY [Bug 49970] Releases are not being served from the ASF
mirror system
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=49970
--- Comment #10 from Sebb <se...@apache.org> 2010-09-23 15:12:54 EDT ---
There are now two download links on the main menu.
"Old download"
"New download"
I thin the "Old download" link and the
http://santuario.apache.org/download.html pasge should be deleted.
"New download" could then be renamed as "Download".
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
DO NOT REPLY [Bug 49970] Releases are not being served from the ASF
mirror system
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=49970
--- Comment #4 from coheigea <co...@apache.org> 2010-09-22 06:47:21 EDT ---
> This is not actually true, as the mirrors do have the current release.
I just added the distributions to www.apache.org/dist/santuario and
archive.apache.org/dist/santuario recently. The website hasn't been updated yet
to reflect this. I'm working on this at the moment.
> Also, there are no MD5 or SHA1 checksum files for the releases.
> AIUI at least one of these is also required for all ASF releases.
Previous releases of Santuario/XML-Security did not appear to create checksum
files. From what I can tell this is not a strict requirement...:
http://www.apache.org/dev/release-signing.html#motivation
>> Signatures should be ASCII armored and detached.
>>Your public key should be exported and the result appended to the appropriate >> KEYS file(s).
>>That's all you need to know to sign a release.
All of these steps have been followed for the current distribution(s).
> I thought the checksums were created when the files were put into place the
> other day.
No, I just copied the artifacts from the Santuario dist page across. Henk
objected to the fact that there was no KEYS file and so the signatures could
not be verified, I copied the KEYS file across to fix that.
> The directory isn't group writeable, will need to wait on the PMC chair to fix.
This is done now.
Colm.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
DO NOT REPLY [Bug 49970] Releases are not being served from the ASF
mirror system
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=49970
--- Comment #5 from Sebb <se...@apache.org> 2010-09-22 06:57:36 EDT ---
http://www.apache.org/dev/release-signing.html#policy
says
"... must be accompanied by one file containing an OpenPGP compatible ASCII
armored detached signature and another file containing an MD5 checksum."
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
DO NOT REPLY [Bug 49970] Releases are not being served from the ASF
mirror system
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=49970
Scott Cantor <ca...@osu.edu> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |WORKSFORME
--- Comment #1 from Scott Cantor <ca...@osu.edu> 2010-09-21 20:14:14 EDT ---
They were moved to the main distribution site and the mirrors a week or so ago.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
DO NOT REPLY [Bug 49970] Releases are not being served from the ASF
mirror system
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=49970
Sebb <se...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|REOPENED |RESOLVED
Resolution| |FIXED
--- Comment #11 from Sebb <se...@apache.org> 2010-09-26 20:40:39 EDT ---
Fixed, thanks
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.