You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@maven.apache.org by Vincent Massol <vm...@pivolis.com> on 2006/04/19 21:58:26 UTC
Signing m2 releases? (was FW: [vmassol] maven-repository/org/apache/maven/plugins/maven-clover-plugin/2.1/)
Hi,
I see that other Maven committers also have some non-signed files on the
apache repo. Are we doing something as part of m2 to automate this as part
of our release plugin for example? Are there any issues related to putting
PGP signatures next to the artifacts in the m2 repo?
We should probably add some text about this on our how-to release page. Yeah
I know, I can do it too once I figure this out...
Thanks
-Vincent
-----Original Message-----
From: Henk Penning [mailto:henkp@apache.org]
Sent: mercredi 19 avril 2006 21:18
To: vmassol@apache.org
Cc: Henk Penning
Subject: [vmassol]
maven-repository/org/apache/maven/plugins/maven-clover-plugin/2.1/
Hi Vincent Massol,
I see you published some files on www.apache.org/dist, in
maven-repository/org/apache/maven/plugins/maven-clover-plugin/2.1/
java-repository/cactus/jars/
java-repository/cactus/plugins/
java-repository/maven/plugins/
Please provide PGP signatures for these files as required
by apache.org policy
http://www.apache.org/dev/mirror-step-by-step.html
For a list of your unsigned files, see
http://people.apache.org/~henkp/checker/sig.html#vmassol
A signing-how-to can be found here:
http://www.apache.org/dev/release-signing.html
Please note that the java-repository should only contain
recent versions of software ; so cleanup your old stuff
before you add signatures.
Thanks a lot,
Regards,
Henk Penning -- apache.org infrastructure
___________________________________________________________________________
Faites de Yahoo! votre page d'accueil sur le web pour retrouver directement vos services pr�f�r�s : v�rifiez vos nouveaux mails, lancez vos recherches et suivez l'actualit� en temps r�el.
Rendez-vous sur http://fr.yahoo.com/set
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org
RE: Signing m2 releases? (was FW: [vmassol] maven-repository/org/apache/maven/plugins/maven-clover-plugin/2.1/)
Posted by Vincent Massol <vm...@pivolis.com>.
Thanks Trustin!
-Vincent
> -----Original Message-----
> From: Trustin Lee [mailto:trustin@gmail.com]
> Sent: jeudi 20 avril 2006 05:38
> To: Maven Developers List
> Subject: Re: Signing m2 releases? (was FW: [vmassol] maven-
> repository/org/apache/maven/plugins/maven-clover-plugin/2.1/)
>
> Hi Vincent,
>
> On 4/20/06, Vincent Massol <vm...@pivolis.com> wrote:
> >
> > Hi,
> >
> > I see that other Maven committers also have some non-signed files on the
> > apache repo. Are we doing something as part of m2 to automate this as
> part
> > of our release plugin for example? Are there any issues related to
> putting
> > PGP signatures next to the artifacts in the m2 repo?
> >
> > We should probably add some text about this on our how-to release page.
> > Yeah
> > I know, I can do it too once I figure this out...
> >
> > Thanks
> > -Vincent
> >
>
> For now, I'm using my shell script to save my time to sign all files at
> once:
>
> http://gleamynode.net/wordpress/archives/129
>
> HTH,
> Trustin
> --
> what we call human nature is actually human habit
> --
> http://gleamynode.net/
> --
> PGP key fingerprints:
> * E167 E6AF E73A CBCE EE41 4A29 544D DE48 FE95 4E7E
> * B693 628E 6047 4F8F CFA4 455E 1C62 A7DC 0255 ECA6
___________________________________________________________________________
Faites de Yahoo! votre page d'accueil sur le web pour retrouver directement vos services pr�f�r�s : v�rifiez vos nouveaux mails, lancez vos recherches et suivez l'actualit� en temps r�el.
Rendez-vous sur http://fr.yahoo.com/set
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org
Re: Signing m2 releases? (was FW: [vmassol] maven-repository/org/apache/maven/plugins/maven-clover-plugin/2.1/)
Posted by Trustin Lee <tr...@gmail.com>.
Hi Vincent,
On 4/20/06, Vincent Massol <vm...@pivolis.com> wrote:
>
> Hi,
>
> I see that other Maven committers also have some non-signed files on the
> apache repo. Are we doing something as part of m2 to automate this as part
> of our release plugin for example? Are there any issues related to putting
> PGP signatures next to the artifacts in the m2 repo?
>
> We should probably add some text about this on our how-to release page.
> Yeah
> I know, I can do it too once I figure this out...
>
> Thanks
> -Vincent
>
For now, I'm using my shell script to save my time to sign all files at
once:
http://gleamynode.net/wordpress/archives/129
HTH,
Trustin
--
what we call human nature is actually human habit
--
http://gleamynode.net/
--
PGP key fingerprints:
* E167 E6AF E73A CBCE EE41 4A29 544D DE48 FE95 4E7E
* B693 628E 6047 4F8F CFA4 455E 1C62 A7DC 0255 ECA6
Re: Signing m2 releases? (was FW: [vmassol] maven-repository/org/apache/maven/plugins/maven-clover-plugin/2.1/)
Posted by Brett Porter <br...@apache.org>.
I wrote it in the airport lounge in December, it almost works.
Unfortunately, it requires core changes to really be automated on
deployment, and the issue of password handling is tricky. Anyone want to
run with it?
- Brett
Carlos Sanchez wrote:
> me too, manual process
>
> There's a wagon-openpgp in the wagon folder, maybe somebody knows what it is
>
> On 4/19/06, Arnaud HERITIER <ah...@gmail.com> wrote:
>> I also did it manually some weeks ago for m1 plugins I released :-(
>>
>> Arnaud
>>
>> On 4/19/06, Emmanuel Venisse <em...@venisse.net> wrote:
>>> We don't have an automate part for it :-(
>>> I have the same pb with with maven-scm release (60 files to sign)
>>>
>>> Emmanuel
>>>
>>> Vincent Massol a écrit :
>>>> Hi,
>>>>
>>>> I see that other Maven committers also have some non-signed files on the
>>>> apache repo. Are we doing something as part of m2 to automate this as
>>> part
>>>> of our release plugin for example? Are there any issues related to
>>> putting
>>>> PGP signatures next to the artifacts in the m2 repo?
>>>>
>>>> We should probably add some text about this on our how-to release page.
>>> Yeah
>>>> I know, I can do it too once I figure this out...
>>>>
>>>> Thanks
>>>> -Vincent
>>>>
>>>> -----Original Message-----
>>>> From: Henk Penning [mailto:henkp@apache.org]
>>>> Sent: mercredi 19 avril 2006 21:18
>>>> To: vmassol@apache.org
>>>> Cc: Henk Penning
>>>> Subject: [vmassol]
>>>> maven-repository/org/apache/maven/plugins/maven-clover-plugin/2.1/
>>>>
>>>> Hi Vincent Massol,
>>>>
>>>> I see you published some files on www.apache.org/dist, in
>>>>
>>>> maven-repository/org/apache/maven/plugins/maven-clover-plugin/2.1/
>>>> java-repository/cactus/jars/
>>>> java-repository/cactus/plugins/
>>>> java-repository/maven/plugins/
>>>>
>>>> Please provide PGP signatures for these files as required
>>>> by apache.org policy
>>>>
>>>> http://www.apache.org/dev/mirror-step-by-step.html
>>>>
>>>> For a list of your unsigned files, see
>>>>
>>>> http://people.apache.org/~henkp/checker/sig.html#vmassol
>>>>
>>>> A signing-how-to can be found here:
>>>>
>>>> http://www.apache.org/dev/release-signing.html
>>>>
>>>> Please note that the java-repository should only contain
>>>> recent versions of software ; so cleanup your old stuff
>>>> before you add signatures.
>>>>
>>>> Thanks a lot,
>>>>
>>>> Regards,
>>>>
>>>> Henk Penning -- apache.org infrastructure
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>> ___________________________________________________________________________
>>>> Faites de Yahoo! votre page d'accueil sur le web pour retrouver
>>> directement vos services préférés : vérifiez vos nouveaux mails, lancez vos
>>> recherches et suivez l'actualité en temps réel.
>>>> Rendez-vous sur http://fr.yahoo.com/set
>>>>
>>>> ---------------------------------------------------------------------
>>>> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
>>>> For additional commands, e-mail: dev-help@maven.apache.org
>>>>
>>>>
>>>>
>>>>
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
>>> For additional commands, e-mail: dev-help@maven.apache.org
>>>
>>>
>>
>
>
> --
> I could give you my word as a Spaniard.
> No good. I've known too many Spaniards.
> -- The Princess Bride
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> For additional commands, e-mail: dev-help@maven.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org
Re: Signing m2 releases? (was FW: [vmassol] maven-repository/org/apache/maven/plugins/maven-clover-plugin/2.1/)
Posted by Carlos Sanchez <ca...@apache.org>.
me too, manual process
There's a wagon-openpgp in the wagon folder, maybe somebody knows what it is
On 4/19/06, Arnaud HERITIER <ah...@gmail.com> wrote:
> I also did it manually some weeks ago for m1 plugins I released :-(
>
> Arnaud
>
> On 4/19/06, Emmanuel Venisse <em...@venisse.net> wrote:
> >
> > We don't have an automate part for it :-(
> > I have the same pb with with maven-scm release (60 files to sign)
> >
> > Emmanuel
> >
> > Vincent Massol a écrit :
> > > Hi,
> > >
> > > I see that other Maven committers also have some non-signed files on the
> > > apache repo. Are we doing something as part of m2 to automate this as
> > part
> > > of our release plugin for example? Are there any issues related to
> > putting
> > > PGP signatures next to the artifacts in the m2 repo?
> > >
> > > We should probably add some text about this on our how-to release page.
> > Yeah
> > > I know, I can do it too once I figure this out...
> > >
> > > Thanks
> > > -Vincent
> > >
> > > -----Original Message-----
> > > From: Henk Penning [mailto:henkp@apache.org]
> > > Sent: mercredi 19 avril 2006 21:18
> > > To: vmassol@apache.org
> > > Cc: Henk Penning
> > > Subject: [vmassol]
> > > maven-repository/org/apache/maven/plugins/maven-clover-plugin/2.1/
> > >
> > > Hi Vincent Massol,
> > >
> > > I see you published some files on www.apache.org/dist, in
> > >
> > > maven-repository/org/apache/maven/plugins/maven-clover-plugin/2.1/
> > > java-repository/cactus/jars/
> > > java-repository/cactus/plugins/
> > > java-repository/maven/plugins/
> > >
> > > Please provide PGP signatures for these files as required
> > > by apache.org policy
> > >
> > > http://www.apache.org/dev/mirror-step-by-step.html
> > >
> > > For a list of your unsigned files, see
> > >
> > > http://people.apache.org/~henkp/checker/sig.html#vmassol
> > >
> > > A signing-how-to can be found here:
> > >
> > > http://www.apache.org/dev/release-signing.html
> > >
> > > Please note that the java-repository should only contain
> > > recent versions of software ; so cleanup your old stuff
> > > before you add signatures.
> > >
> > > Thanks a lot,
> > >
> > > Regards,
> > >
> > > Henk Penning -- apache.org infrastructure
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > ___________________________________________________________________________
> > > Faites de Yahoo! votre page d'accueil sur le web pour retrouver
> > directement vos services préférés : vérifiez vos nouveaux mails, lancez vos
> > recherches et suivez l'actualité en temps réel.
> > > Rendez-vous sur http://fr.yahoo.com/set
> > >
> > > ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> > > For additional commands, e-mail: dev-help@maven.apache.org
> > >
> > >
> > >
> > >
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> > For additional commands, e-mail: dev-help@maven.apache.org
> >
> >
>
>
--
I could give you my word as a Spaniard.
No good. I've known too many Spaniards.
-- The Princess Bride
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org
Re: Signing m2 releases? (was FW: [vmassol] maven-repository/org/apache/maven/plugins/maven-clover-plugin/2.1/)
Posted by Arnaud HERITIER <ah...@gmail.com>.
I also did it manually some weeks ago for m1 plugins I released :-(
Arnaud
On 4/19/06, Emmanuel Venisse <em...@venisse.net> wrote:
>
> We don't have an automate part for it :-(
> I have the same pb with with maven-scm release (60 files to sign)
>
> Emmanuel
>
> Vincent Massol a écrit :
> > Hi,
> >
> > I see that other Maven committers also have some non-signed files on the
> > apache repo. Are we doing something as part of m2 to automate this as
> part
> > of our release plugin for example? Are there any issues related to
> putting
> > PGP signatures next to the artifacts in the m2 repo?
> >
> > We should probably add some text about this on our how-to release page.
> Yeah
> > I know, I can do it too once I figure this out...
> >
> > Thanks
> > -Vincent
> >
> > -----Original Message-----
> > From: Henk Penning [mailto:henkp@apache.org]
> > Sent: mercredi 19 avril 2006 21:18
> > To: vmassol@apache.org
> > Cc: Henk Penning
> > Subject: [vmassol]
> > maven-repository/org/apache/maven/plugins/maven-clover-plugin/2.1/
> >
> > Hi Vincent Massol,
> >
> > I see you published some files on www.apache.org/dist, in
> >
> > maven-repository/org/apache/maven/plugins/maven-clover-plugin/2.1/
> > java-repository/cactus/jars/
> > java-repository/cactus/plugins/
> > java-repository/maven/plugins/
> >
> > Please provide PGP signatures for these files as required
> > by apache.org policy
> >
> > http://www.apache.org/dev/mirror-step-by-step.html
> >
> > For a list of your unsigned files, see
> >
> > http://people.apache.org/~henkp/checker/sig.html#vmassol
> >
> > A signing-how-to can be found here:
> >
> > http://www.apache.org/dev/release-signing.html
> >
> > Please note that the java-repository should only contain
> > recent versions of software ; so cleanup your old stuff
> > before you add signatures.
> >
> > Thanks a lot,
> >
> > Regards,
> >
> > Henk Penning -- apache.org infrastructure
> >
> >
> >
> >
> >
> >
> >
> ___________________________________________________________________________
> > Faites de Yahoo! votre page d'accueil sur le web pour retrouver
> directement vos services préférés : vérifiez vos nouveaux mails, lancez vos
> recherches et suivez l'actualité en temps réel.
> > Rendez-vous sur http://fr.yahoo.com/set
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> > For additional commands, e-mail: dev-help@maven.apache.org
> >
> >
> >
> >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> For additional commands, e-mail: dev-help@maven.apache.org
>
>
Re: Signing m2 releases? (was FW: [vmassol] maven-repository/org/apache/maven/plugins/maven-clover-plugin/2.1/)
Posted by Emmanuel Venisse <em...@venisse.net>.
We don't have an automate part for it :-(
I have the same pb with with maven-scm release (60 files to sign)
Emmanuel
Vincent Massol a écrit :
> Hi,
>
> I see that other Maven committers also have some non-signed files on the
> apache repo. Are we doing something as part of m2 to automate this as part
> of our release plugin for example? Are there any issues related to putting
> PGP signatures next to the artifacts in the m2 repo?
>
> We should probably add some text about this on our how-to release page. Yeah
> I know, I can do it too once I figure this out...
>
> Thanks
> -Vincent
>
> -----Original Message-----
> From: Henk Penning [mailto:henkp@apache.org]
> Sent: mercredi 19 avril 2006 21:18
> To: vmassol@apache.org
> Cc: Henk Penning
> Subject: [vmassol]
> maven-repository/org/apache/maven/plugins/maven-clover-plugin/2.1/
>
> Hi Vincent Massol,
>
> I see you published some files on www.apache.org/dist, in
>
> maven-repository/org/apache/maven/plugins/maven-clover-plugin/2.1/
> java-repository/cactus/jars/
> java-repository/cactus/plugins/
> java-repository/maven/plugins/
>
> Please provide PGP signatures for these files as required
> by apache.org policy
>
> http://www.apache.org/dev/mirror-step-by-step.html
>
> For a list of your unsigned files, see
>
> http://people.apache.org/~henkp/checker/sig.html#vmassol
>
> A signing-how-to can be found here:
>
> http://www.apache.org/dev/release-signing.html
>
> Please note that the java-repository should only contain
> recent versions of software ; so cleanup your old stuff
> before you add signatures.
>
> Thanks a lot,
>
> Regards,
>
> Henk Penning -- apache.org infrastructure
>
>
>
>
>
>
> ___________________________________________________________________________
> Faites de Yahoo! votre page d'accueil sur le web pour retrouver directement vos services préférés : vérifiez vos nouveaux mails, lancez vos recherches et suivez l'actualité en temps réel.
> Rendez-vous sur http://fr.yahoo.com/set
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
> For additional commands, e-mail: dev-help@maven.apache.org
>
>
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@maven.apache.org
For additional commands, e-mail: dev-help@maven.apache.org