You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tika.apache.org by Jukka Zitting <ju...@gmail.com> on 2013/01/21 07:11:53 UTC
KEYS file and dist.apache.org (Re: [VOTE] Apache Tika 1.3 Release
Candidate #1)
Hi,
On Sun, Jan 20, 2013 at 11:24 PM, Mattmann, Chris A (388J)
<ch...@jpl.nasa.gov> wrote:
> +1 to that -- Dave feel free to simply copy the one out of dist into the
> RC dir -- or whomever does the next release feel free to include the KEYS.
There's no particular need for the KEYS file to be included in the RC,
particularly inside the release package (shipping the key along with
the signed package is kind of bad practice). One could simply update
the KEYS file directly in http://www.apache.org/dist/tika/KEYS and
upload it to a key server [1]. It's also a good idea to add the key
fingerprint to https://id.apache.org/.
Another thing that came to my mind is migration from
/www/www.apache.org/dist/tika on people.apache.org to svnpubsub-based
release distribution [2]. AFAIUI infra wants to get all projects
migrated to svnpubsub, so I think we should look at doing that shortly
after 1.3 is out. I can volunteer to take care of this as I've already
done it for Jackrabbit.
[1] http://www.apache.org/dev/release-signing.html#keyserver
[2] http://www.apache.org/dev/release-publishing.html#distribution_dist
BR,
Jukka Zitting
Re: KEYS file and dist.apache.org (Re: [VOTE] Apache Tika 1.3 Release
Candidate #1)
Posted by Michael McCandless <lu...@mikemccandless.com>.
On Mon, Jan 21, 2013 at 7:13 AM, Jukka Zitting <ju...@gmail.com> wrote:
> Hi,
>
> On Mon, Jan 21, 2013 at 1:39 PM, Michael McCandless
> <lu...@mikemccandless.com> wrote:
>> I had thought we were supposed to ship the KEYS file next to all release bits.
>
> Yes, my point is just that it's better if it's not expressed as a
> *part* of the release candidate.
>
> Otherwise there's a risk of implying that one could/should verify the
> signature with the key included in the release, which is troublesome
> for people who don't follow the Apache Web of Trust (i.e. the majority
> of people out there). The best approach for such people is to download
> the KEYS file directly from www.apache.org instead of from the mirror
> from which they got the release or (even worse) from within the
> release archive. Otherwise an attacker could simply add their own key
> to the KEYS file before re-signing a modified release... That's why
> for example http://tika.apache.org/download.html points directly to
> http://www.apache.org/dist/tika/KEYS instead of using mirrors.
OK this makes sense!
Thanks for the explanation Jukka.
Mike McCandless
http://blog.mikemccandless.com
Re: KEYS file and dist.apache.org (Re: [VOTE] Apache Tika 1.3 Release
Candidate #1)
Posted by Jukka Zitting <ju...@gmail.com>.
Hi,
On Mon, Jan 21, 2013 at 1:39 PM, Michael McCandless
<lu...@mikemccandless.com> wrote:
> I had thought we were supposed to ship the KEYS file next to all release bits.
Yes, my point is just that it's better if it's not expressed as a
*part* of the release candidate.
Otherwise there's a risk of implying that one could/should verify the
signature with the key included in the release, which is troublesome
for people who don't follow the Apache Web of Trust (i.e. the majority
of people out there). The best approach for such people is to download
the KEYS file directly from www.apache.org instead of from the mirror
from which they got the release or (even worse) from within the
release archive. Otherwise an attacker could simply add their own key
to the KEYS file before re-signing a modified release... That's why
for example http://tika.apache.org/download.html points directly to
http://www.apache.org/dist/tika/KEYS instead of using mirrors.
BR,
Jukka Zitting
Re: KEYS file and dist.apache.org (Re: [VOTE] Apache Tika 1.3 Release
Candidate #1)
Posted by Michael McCandless <lu...@mikemccandless.com>.
Thanks Jukka.
I had thought we were supposed to ship the KEYS file next to all release bits.
As far as I can tell Lucene and Tika have done this for their past
releases, eg: http://www.eng.lsu.edu/mirrors/apache/tika and
http://apache.mesi.com.ar/lucene/java/4.0.0
But it sounds like this is actually bad practice and we should stop doing so?
Mike McCandless
http://blog.mikemccandless.com
On Mon, Jan 21, 2013 at 1:11 AM, Jukka Zitting <ju...@gmail.com> wrote:
> Hi,
>
> On Sun, Jan 20, 2013 at 11:24 PM, Mattmann, Chris A (388J)
> <ch...@jpl.nasa.gov> wrote:
>> +1 to that -- Dave feel free to simply copy the one out of dist into the
>> RC dir -- or whomever does the next release feel free to include the KEYS.
>
> There's no particular need for the KEYS file to be included in the RC,
> particularly inside the release package (shipping the key along with
> the signed package is kind of bad practice). One could simply update
> the KEYS file directly in http://www.apache.org/dist/tika/KEYS and
> upload it to a key server [1]. It's also a good idea to add the key
> fingerprint to https://id.apache.org/.
>
> Another thing that came to my mind is migration from
> /www/www.apache.org/dist/tika on people.apache.org to svnpubsub-based
> release distribution [2]. AFAIUI infra wants to get all projects
> migrated to svnpubsub, so I think we should look at doing that shortly
> after 1.3 is out. I can volunteer to take care of this as I've already
> done it for Jackrabbit.
>
> [1] http://www.apache.org/dev/release-signing.html#keyserver
> [2] http://www.apache.org/dev/release-publishing.html#distribution_dist
>
> BR,
>
> Jukka Zitting
Re: KEYS file and dist.apache.org (Re: [VOTE] Apache Tika 1.3
Release Candidate #1)
Posted by "Mattmann, Chris A (388J)" <ch...@jpl.nasa.gov>.
Thanks Jukka for the FYI...
Cheers,
Chris
On 1/20/13 10:11 PM, "Jukka Zitting" <ju...@gmail.com> wrote:
>Hi,
>
>On Sun, Jan 20, 2013 at 11:24 PM, Mattmann, Chris A (388J)
><ch...@jpl.nasa.gov> wrote:
>> +1 to that -- Dave feel free to simply copy the one out of dist into the
>> RC dir -- or whomever does the next release feel free to include the
>>KEYS.
>
>There's no particular need for the KEYS file to be included in the RC,
>particularly inside the release package (shipping the key along with
>the signed package is kind of bad practice). One could simply update
>the KEYS file directly in http://www.apache.org/dist/tika/KEYS and
>upload it to a key server [1]. It's also a good idea to add the key
>fingerprint to https://id.apache.org/.
>
>Another thing that came to my mind is migration from
>/www/www.apache.org/dist/tika on people.apache.org to svnpubsub-based
>release distribution [2]. AFAIUI infra wants to get all projects
>migrated to svnpubsub, so I think we should look at doing that shortly
>after 1.3 is out. I can volunteer to take care of this as I've already
>done it for Jackrabbit.
>
>[1] http://www.apache.org/dev/release-signing.html#keyserver
>[2] http://www.apache.org/dev/release-publishing.html#distribution_dist
>
>BR,
>
>Jukka Zitting