You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ant.apache.org by Stefan Bodewig <bo...@apache.org> on 2003/08/18 14:00:13 UTC
I signed jakarta-ant-src.zip on archives.apache.org
Hi,
I checked out the ANT_12 tag from Ant's cvs and ran the srcdist target
in it. After that I unzipped the created zip as well as the one I've
downloaded from archive.apache.org and the only differences I could
find were whitespace changes, all line-ends were different (Conor did
the 1.2 release on Windows IIRC).
So I went ahead and signed the file and put the signature on
archive.apache.org. It would be nice if anybody using PGP and in
particular using PGP on Windows could verify the signature because of
this comment by Magesh in the ReleaseInstructions
,----
| Try to do this on Linux since the gpg signatures generated on Windows may
| cause some PGP users problems verifying signatures even though they seem
| OK.
`----
In fact, I've never used the --force-v3-sigs switch of GnuPG before.
Thanks
Stefan
BTW, it was amusing to see that a fresh CVS HEAD version of Ant
happily worked on the 1.2 build file and only complained about
<fixcrlf> using a deprecated attribute.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For additional commands, e-mail: dev-help@ant.apache.org
Re: I signed jakarta-ant-src.zip on archives.apache.org
Posted by Stefan Bodewig <bo...@apache.org>.
On Mon, 18 Aug 2003, Antoine Levy-Lambert <an...@antbuild.com>
wrote:
> I do not know why I am getting the warning saying that the key is
> not certified with a trusted signature.
It says that the signature is a valid signature done by my key. This
is the most important result.
The "not certified" part means that you haven't told GnuPG to trust
that key (which is fine, you cannot be sure that it really is mine)
and that it isn't signed by anybody you trust (any signature you've
told GnuPG you'd trust).
> something special to say that "Stefan Bodewig is trusted" ?
Yes, edit your keyring via whatever means you chose to do so (command
line or GUI client).
Don't blindly trust keys you haven't verified in any way. And in
particular, don't sign any key you are not 120% sure is authentic.
Stefan
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For additional commands, e-mail: dev-help@ant.apache.org
Re: I signed jakarta-ant-src.zip on archives.apache.org
Posted by Antoine Levy-Lambert <an...@antbuild.com>.
Hi Stefan,
I have just downloaded gpg and ran the following steps :
- generated keys for me,
- imported keys of ant committers,
gpg --import 'C:\dev\asf\ant\KEYS'
gpg: key FEECAAED: public key "Stefan Bodewig <bo...@apache.org>" imported
gpg: key 51898504: public key "Conor MacNeill
<co...@cortexebusiness.com.au>" imported
gpg: key 5F6B8B72: public key "Stefan Bodewig <bo...@apache.org>" imported
gpg: key 697ECEDD: public key "Henri Gomez <hg...@slib.fr>" imported
gpg: key 397DCAD5: public key "Henri Gomez <hg...@users.sourceforge.net>"
imported
gpg: key 307A10A5: public key "Henri Gomez <hg...@users.sourceforge.net>"
imported
gpg: key EDF62C35: public key "Magesh Umasankar <um...@apache.org>"
imported
gpg: Total number processed: 7
gpg: imported: 7 (RSA: 3)
C:\>gpg --verify C:\antoine\tools\jakarta-ant-1.2-src.zip.asc
gpg: Signature made 08/18/03 13:50:34 using DSA key ID 5F6B8B72
gpg: Good signature from "Stefan Bodewig <bo...@apache.org>"
gpg: aka "Stefan Bodewig <bo...@bost.de>"
gpg: aka "Stefan Bodewig <st...@freenet.de>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the
owner.
Primary key fingerprint: CE80 75A2 5154 7BEE 249B C151 A211 5AE1 5F6B 8B72
I do not know why I am getting the warning saying that the key is not
certified with a trusted signature.
Am I supposed to do something special to say that "Stefan Bodewig is
trusted" ?
Cheers,
Antoine
----- Original Message -----
From: "Stefan Bodewig" <bo...@apache.org>
To: <de...@ant.apache.org>
Sent: Monday, August 18, 2003 3:10 PM
Subject: Re: I signed jakarta-ant-src.zip on archives.apache.org
> On Mon, 18 Aug 2003, Magesh Umasankar <um...@apache.org> wrote:
>
> > IIRC, I did this to ensure it was compatible with some older
> > versions of PGP.
>
> Probably PGP 5.x as PGP 2.6.x doesn't support the algorithms used
> anyway.
>
> Thank you for the clarification
>
> Stefan
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
> For additional commands, e-mail: dev-help@ant.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For additional commands, e-mail: dev-help@ant.apache.org
Re: I signed jakarta-ant-src.zip on archives.apache.org
Posted by Stefan Bodewig <bo...@apache.org>.
On Mon, 18 Aug 2003, Magesh Umasankar <um...@apache.org> wrote:
> IIRC, I did this to ensure it was compatible with some older
> versions of PGP.
Probably PGP 5.x as PGP 2.6.x doesn't support the algorithms used
anyway.
Thank you for the clarification
Stefan
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For additional commands, e-mail: dev-help@ant.apache.org
Re: I signed jakarta-ant-src.zip on archives.apache.org
Posted by Steve Loughran <st...@iseran.com>.
Stefan Bodewig wrote:
>>2. mozilla junk mail filtering:
>
>
> Oh, I use ifile[1] as it has some decent integration with my MUA of
> choice (Gnus in XEmacs) and it flags the stuff as spam very well.
>
> The problem has been that I've been mostly offline for a week and
> accumulated half a gig of spam mails which simply took an hour to
> delete as my system was constantly swapping while it tried to reindex
> my mail folder.
>
ahh, so the problem was that you didnt leave the filtering system up and
running continuously. A few years ago, that would have been OK, but not
apparently, today.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For additional commands, e-mail: dev-help@ant.apache.org
Re: I signed jakarta-ant-src.zip on archives.apache.org
Posted by Stefan Bodewig <bo...@apache.org>.
On Mon, 25 Aug 2003, Steve Loughran <st...@iseran.com> wrote:
> 1. pull your email address out of all the ant source you can find;
I've already done this. Won't help, I'm still in the manual, on the
website and in the KEYS file. I can't change the last and wouldn't
like to change the former.
And then again, posting to mailing lists is probably enough.
I haven't found a way to avoid that my address gets added to an
Outlook address book either ;-)
> 2. mozilla junk mail filtering:
Oh, I use ifile[1] as it has some decent integration with my MUA of
choice (Gnus in XEmacs) and it flags the stuff as spam very well.
The problem has been that I've been mostly offline for a week and
accumulated half a gig of spam mails which simply took an hour to
delete as my system was constantly swapping while it tried to reindex
my mail folder.
Stefan
Footnotes:
[1] http://savannah.nongnu.org/projects/ifile
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For additional commands, e-mail: dev-help@ant.apache.org
Re: I signed jakarta-ant-src.zip on archives.apache.org
Posted by Steve Loughran <st...@iseran.com>.
Stefan Bodewig wrote:
> On Sat, 23 Aug 2003, Conor MacNeill <co...@cortexebusiness.com.au>
> wrote:
>
>
>>You can remove the statement.
>
>
> Will do, when I get to it.
>
>
>>Conor
>>(Catching up ...)
>
>
> I spent almost an hour deleting 5000 instances of SoBig.F and almost
> the same amount of "Your mail contained a virus" mails - I think I
> know what you are talking about 8-(
1. pull your email address out of all the ant source you can find; that
is what makes you such a big target
2. mozilla junk mail filtering: it is there for your own good. Or, for
outlook users, SpamBayes.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For additional commands, e-mail: dev-help@ant.apache.org
Re: I signed jakarta-ant-src.zip on archives.apache.org
Posted by Stefan Bodewig <bo...@apache.org>.
On Sat, 23 Aug 2003, Conor MacNeill <co...@cortexebusiness.com.au>
wrote:
> You can remove the statement.
Will do, when I get to it.
> Conor
> (Catching up ...)
I spent almost an hour deleting 5000 instances of SoBig.F and almost
the same amount of "Your mail contained a virus" mails - I think I
know what you are talking about 8-(
Stefan
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For additional commands, e-mail: dev-help@ant.apache.org
Re: I signed jakarta-ant-src.zip on archives.apache.org
Posted by Conor MacNeill <co...@cortexebusiness.com.au>.
On Mon, 18 Aug 2003 11:06 pm, Magesh Umasankar wrote:
>
> Conor had indicated that this was an issue when he shared an email
> detailing the steps he followed for making a release. I had added
> his comment directly. Later, I did find that I could successfully
> use a Windows version of GnuPG and PGP users did *not* have any
> problems. So, I suspect that this statement can be removed. Conor?
>
> > In fact, I've never used the --force-v3-sigs switch of GnuPG before.
>
> IIRC, I did this to ensure it was compatible with some older versions
> of PGP.
>
You can remove the statement. There definitely was an issue with PGP users
when signing using GPG on Windows. Not sure if it remains and whether the
--force-v3-sigs switch may fix it. In any case, I no longer build releases on
Windows.
Conor
(Catching up ...)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For additional commands, e-mail: dev-help@ant.apache.org
Re: I signed jakarta-ant-src.zip on archives.apache.org
Posted by Magesh Umasankar <um...@apache.org>.
----- Original Message -----
From: "Stefan Bodewig" <bo...@apache.org>
> So I went ahead and signed the file and put the signature on
> archive.apache.org. It would be nice if anybody using PGP and in
> particular using PGP on Windows could verify the signature because of
> this comment by Magesh in the ReleaseInstructions
>
> ,----
> | Try to do this on Linux since the gpg signatures generated on Windows
may
> | cause some PGP users problems verifying signatures even though they seem
> | OK.
> `----
>
Conor had indicated that this was an issue when he shared an email
detailing the steps he followed for making a release. I had added
his comment directly. Later, I did find that I could successfully
use a Windows version of GnuPG and PGP users did *not* have any
problems. So, I suspect that this statement can be removed. Conor?
> In fact, I've never used the --force-v3-sigs switch of GnuPG before.
IIRC, I did this to ensure it was compatible with some older versions
of PGP.
Cheers,
Magesh
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For additional commands, e-mail: dev-help@ant.apache.org