You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tooling.apache.org by "hboutemy (via GitHub)" <gi...@apache.org> on 2025/06/08 04:54:33 UTC
[I] propose "Upload a KEYS File" from Committees urls (tooling-trusted-release)
hboutemy opened a new issue, #132:
URL: https://github.com/apache/tooling-trusted-release/issues/132
https://release-test.apache.org/keys/upload
uploading from local disk is nice
in most cases, we'll upload from https://downloads.apache.org/[COMMITTEE]/KEYS
should not be an option hard to add, and very useful for real life
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] propose "Upload a KEYS File" from Committees dist area url (tooling-trusted-release)
Posted by "sebbASF (via GitHub)" <gi...@apache.org>.
sebbASF commented on issue #132:
URL: https://github.com/apache/tooling-trusted-release/issues/132#issuecomment-2954150139
However:
1. SVN dist is still here, and PMCs currently maintain KEYS there
2. Uploading KEYS from a file implies that the file has been created, probably using a text editor, so I'm not sure how it helps to insist that KEYS are uploaded again.
3. agreed, but in the meantime KEYS under downloads.a.o are a useful source.
Note that the KEYS files under downloads.a.o are supposed to be cumulative, so any key that has ever been used to sign a release should be in the file. It's important to keep historic keys available, so archive sigs can be checked.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] propose "Upload a KEYS File" from Committees dist area url (tooling-trusted-release)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #132:
URL: https://github.com/apache/tooling-trusted-release/issues/132#issuecomment-2980535250
Commits 8a787ee1366bc6ee9d6328d043653a7324c3406d, 910e8a9a8a3d199f6ebbb018802b0864fba4ae5c, c9fdfb8bb7ba6dc4905c594de69968364456d2ba, a9d2a1eed6d0e4a5a93f73e01aa31c0d131da831, and aca2188365983dcfbaaeff13b19eb5a6fbc8daa9 introduce a mechanism for admins to fetch existing ASF `KEYS` files and import them into ATR. This can be run as necessary to update from these sources, like the separate mechanism that we use for updating committee and project data.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] propose "Upload a KEYS File" from Committees dist area url (tooling-trusted-release)
Posted by "sebbASF (via GitHub)" <gi...@apache.org>.
sebbASF commented on issue #132:
URL: https://github.com/apache/tooling-trusted-release/issues/132#issuecomment-2953999845
Seems to me that ATR should use such KEYS files by default, and not expect projects to upload them.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] propose "Upload a KEYS File" from Committees dist area url (tooling-trusted-release)
Posted by "sebbASF (via GitHub)" <gi...@apache.org>.
sebbASF commented on issue #132:
URL: https://github.com/apache/tooling-trusted-release/issues/132#issuecomment-2954173795
Note that https://people.apache.org/keys/committer/ contains keys files for users that have updated their LDAP record with the key ids. Maybe add that as a standard source?
Also, why not allow users to provide their key id?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] propose "Upload a KEYS File" from Committees dist area url (tooling-trusted-release)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #132:
URL: https://github.com/apache/tooling-trusted-release/issues/132#issuecomment-2954187410
Those are the fingerprints and not the full GPG public key which has much more complete information.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] propose "Upload a KEYS File" from Committees dist area url (tooling-trusted-release)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #132:
URL: https://github.com/apache/tooling-trusted-release/issues/132#issuecomment-2980637554
Resolved by a44adfcdb9c8d17cad48a7d0d5bf4adcebd39bec, which adds a URL input tab to the `KEYS` file upload form.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] propose "Upload a KEYS File" from Committees dist area url (tooling-trusted-release)
Posted by "hboutemy (via GitHub)" <gi...@apache.org>.
hboutemy commented on issue #132:
URL: https://github.com/apache/tooling-trusted-release/issues/132#issuecomment-2954299863
every PMC already has a KEYS file in https://downloads.apache.org/[COMMITTEE]/KEYS
this issue is just about easing import of existing content to ATR when starting to use ATR, instead of restarting from scratch: once imported, using ATR to maintain evolution of KEYS works perfectly
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] propose "Upload a KEYS File" from Committees dist area url (tooling-trusted-release)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #132:
URL: https://github.com/apache/tooling-trusted-release/issues/132#issuecomment-2954190919
Currently when a Release Manager adds their GPG public key to a KEYS file they have to go through svn checkout, edit, and commit. Ideally ATR has the KEYS file automatically imported and adding is done in the UI by uploading or pasting the full GPG public key. The KEYS file can then be regenerated.
With our current methods a simple stray editing mistake can make many of the keys unusable. I've also seen KEYS with the same key duplicated.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] propose "Upload a KEYS File" from Committees dist area url (tooling-trusted-release)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp closed issue #132: propose "Upload a KEYS File" from Committees dist area url
URL: https://github.com/apache/tooling-trusted-release/issues/132
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] propose "Upload a KEYS File" from Committees dist area url (tooling-trusted-release)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #132:
URL: https://github.com/apache/tooling-trusted-release/issues/132#issuecomment-2954136453
Considerations
1. Eventually svn dist will go away.
2. Managing KEYS files in a text editor is hard and I've seen corruption in at least one PMC as a Member in the past.
3. We will need a mechanism in the future for the new Release Manager to add their keys.
4. In the future Beta when we will be hooked up with the current flow of svn dist for releases we can rework the ATR's KEYS process to better automate the process.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] propose "Upload a KEYS File" from Committees dist area url (tooling-trusted-release)
Posted by "sebbASF (via GitHub)" <gi...@apache.org>.
sebbASF commented on issue #132:
URL: https://github.com/apache/tooling-trusted-release/issues/132#issuecomment-2954288068
> Those are the fingerprints and not the full GPG public key
The page lists the fingerprints, but they link to a file containing the full keys.
> I've also seen KEYS with the same key duplicated.
Does not seem like a big issue to me.
I agree that it is tedious maintaining the KEYS files, but that does not mean they should be ignored.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] propose "Upload a KEYS File" from Committees dist area url (tooling-trusted-release)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #132:
URL: https://github.com/apache/tooling-trusted-release/issues/132#issuecomment-2954154246
Thanks for the feedback. We will rework the KEYS file UX to be more explicitly cumulative and automatic.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] propose "Upload a KEYS File" from Committees dist area url (tooling-trusted-release)
Posted by "hboutemy (via GitHub)" <gi...@apache.org>.
hboutemy commented on issue #132:
URL: https://github.com/apache/tooling-trusted-release/issues/132#issuecomment-2954167985
> Eventually svn dist will go away
it's just an immediate import to start: later, this won't be used any more
yes, adding my own key via the UI is much better than playing by hand with the full KEYS files and uploading
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] propose "Upload a KEYS File" from Committees dist area url (tooling-trusted-release)
Posted by "sebbASF (via GitHub)" <gi...@apache.org>.
sebbASF commented on issue #132:
URL: https://github.com/apache/tooling-trusted-release/issues/132#issuecomment-2954171807
> yes, adding my own key via the UI is much better than playing by hand with the full KEYS files and uploading
I don't understand what you mean by "playing by hand with the full KEYS files"?
Can't you just upload the full KEYS file?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org