You are viewing a plain text version of this content. The canonical link for it is here.
Posted to general@incubator.apache.org by Shane Curcuru <as...@shanecurcuru.org> on 2012/10/10 15:43:09 UTC
Re: key signing - trust path check
Anyone interested in details of PGP signing and tracing trust paths at
the ASF should say thank you to long-time member henkp who has done a
ton of work documenting and verifying release signing and keys:
https://people.apache.org/~henkp/trust/
- Shane
On 10/8/2012 6:37 PM, Noah Slater wrote:
> Found one... Just poking around manually...
>
> J. Daniel Kulp <dk...@apache.org>
> http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0x858FC4C4F43856A3
>
> Signed by Carsten Ziegeler <cz...@apache.org>
> http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0x132E49D4E41EDC7E
>
> Signed by Marcus Crafter <cr...@debian.org>
> http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0x394D2FE3C4C57B42
>
> And all Debian folk are connected, as per my pervious email. :)
>
> There should be a tool for this!
>
> On Mon, Oct 8, 2012 at 11:23 PM, Benson Margulies <bi...@gmail.com>wrote:
>
>> Let's try a little statistically-invalid experiment of sample size
>> one. The last time I had a key signed at Apache, it was by Dan Kulp.
>> Now, pretend that you are a suspicious user of one of the many Maven
>> plugins releases that I RM. Can you reach Dan from yourself in the
>> web? Is there anyone you, personally, trust who starts a chain that
>> leads to him?
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
>> For additional commands, e-mail: general-help@incubator.apache.org
>>
>>
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org
Re: key signing - trust path check
Posted by Noah Slater <ns...@tumbolia.org>.
This is awesome! Unfortunately I (61D50B88) am not in the strong set.
Bummer. :(
On Wed, Oct 10, 2012 at 2:43 PM, Shane Curcuru <as...@shanecurcuru.org> wrote:
> Anyone interested in details of PGP signing and tracing trust paths at the
> ASF should say thank you to long-time member henkp who has done a ton of
> work documenting and verifying release signing and keys:
>
> https://people.apache.org/~**henkp/trust/<https://people.apache.org/~henkp/trust/>
>
> - Shane
>
> On 10/8/2012 6:37 PM, Noah Slater wrote:
>
>> Found one... Just poking around manually...
>>
>> J. Daniel Kulp <dk...@apache.org>
>> http://pgp.mit.edu:11371/pks/**lookup?op=vindex&search=**
>> 0x858FC4C4F43856A3<http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0x858FC4C4F43856A3>
>>
>> Signed by Carsten Ziegeler <cz...@apache.org>
>> http://pgp.mit.edu:11371/pks/**lookup?op=vindex&search=**
>> 0x132E49D4E41EDC7E<http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0x132E49D4E41EDC7E>
>>
>> Signed by Marcus Crafter <cr...@debian.org>
>> http://pgp.mit.edu:11371/pks/**lookup?op=vindex&search=**
>> 0x394D2FE3C4C57B42<http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0x394D2FE3C4C57B42>
>>
>> And all Debian folk are connected, as per my pervious email. :)
>>
>> There should be a tool for this!
>>
>> On Mon, Oct 8, 2012 at 11:23 PM, Benson Margulies <bimargulies@gmail.com
>> >wrote:
>>
>> Let's try a little statistically-invalid experiment of sample size
>>> one. The last time I had a key signed at Apache, it was by Dan Kulp.
>>> Now, pretend that you are a suspicious user of one of the many Maven
>>> plugins releases that I RM. Can you reach Dan from yourself in the
>>> web? Is there anyone you, personally, trust who starts a chain that
>>> leads to him?
>>>
>>> ------------------------------**------------------------------**
>>> ---------
>>> To unsubscribe, e-mail: general-unsubscribe@incubator.**apache.org<ge...@incubator.apache.org>
>>> For additional commands, e-mail: general-help@incubator.apache.**org<ge...@incubator.apache.org>
>>>
>>>
>>>
>>
>>
> ------------------------------**------------------------------**---------
> To unsubscribe, e-mail: general-unsubscribe@incubator.**apache.org<ge...@incubator.apache.org>
> For additional commands, e-mail: general-help@incubator.apache.**org<ge...@incubator.apache.org>
>
>
--
NS