You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@commons.apache.org by Ben Speakmon <bs...@apache.org> on 2007/06/12 22:42:41 UTC
centralized KEYS file?
Would it be a good idea to have one centralized KEYS file for all commons
developers? It'd be easier to update, delete or revoke any single key and
remove a lot of duplication.
I was reviewing the IO 1.3.2 RC and I couldn't find the key Jochen used to
sign the release tarballs. I don't see any reason offhand why it shouldn't
be in the same place as the keys to verify any other release.
Thoughts?
Re: centralized KEYS file?
Posted by Dion Gillard <di...@trongus.com>.
Go for it!
On 6/13/07, Ben Speakmon <bs...@apache.org> wrote:
> Would it be a good idea to have one centralized KEYS file for all commons
> developers? It'd be easier to update, delete or revoke any single key and
> remove a lot of duplication.
>
> I was reviewing the IO 1.3.2 RC and I couldn't find the key Jochen used to
> sign the release tarballs. I don't see any reason offhand why it shouldn't
> be in the same place as the keys to verify any other release.
>
> Thoughts?
>
--
dIon Gillard
Rule #131 of Acquisition: Information is Profit.
---------------------------------------------------------------------
To unsubscribe, e-mail: commons-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-dev-help@jakarta.apache.org
Re: centralized KEYS file?
Posted by Henri Yandell <fl...@gmail.com>.
I've done the below.
* New central KEYS file in place.
* README.txt's changed to point to the new one.
* jakarta.apache.org download page points to the new one.
* Old KEYS files deleted
* central KEYS file added to svn
* KEYS files in individual components removed (13 had them)
* find performed for jakarta.apache.org/commons to make sure nothing
has urls to the removed KEYS
Tim's expired key has been used.
Robert's hasn't (afaict), so we can remove that one.
On 6/13/07, Henri Yandell <fl...@gmail.com> wrote:
> I think we'd just delete them. There'd be a KEYS file one higher in
> the hierarchy, and the downloads.xml page can be changed to link to
> that top one.
>
> Also need to check there are no links to KEYS within the commons space.
>
> Hen
>
> On 6/12/07, Jochen Wiedmann <jo...@gmail.com> wrote:
> > And replace the current KEYS files with soft links? Dunno how the
> > mirrors handle that.
> >
> >
> > --
> > "Besides, manipulating elections is under penalty of law, resulting in
> > a preventative effect against manipulating elections.
> >
> > The german government justifying the use of electronic voting machines
> > and obviously believing that we don't need a police, because all
> > illegal actions are forbidden.
> >
> > http://dip.bundestag.de/btd/16/051/1605194.pdf
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: commons-dev-unsubscribe@jakarta.apache.org
> > For additional commands, e-mail: commons-dev-help@jakarta.apache.org
> >
> >
>
---------------------------------------------------------------------
To unsubscribe, e-mail: commons-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-dev-help@jakarta.apache.org
Re: centralized KEYS file?
Posted by Henri Yandell <fl...@gmail.com>.
I think we'd just delete them. There'd be a KEYS file one higher in
the hierarchy, and the downloads.xml page can be changed to link to
that top one.
Also need to check there are no links to KEYS within the commons space.
Hen
On 6/12/07, Jochen Wiedmann <jo...@gmail.com> wrote:
> And replace the current KEYS files with soft links? Dunno how the
> mirrors handle that.
>
>
> --
> "Besides, manipulating elections is under penalty of law, resulting in
> a preventative effect against manipulating elections.
>
> The german government justifying the use of electronic voting machines
> and obviously believing that we don't need a police, because all
> illegal actions are forbidden.
>
> http://dip.bundestag.de/btd/16/051/1605194.pdf
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: commons-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: commons-dev-help@jakarta.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: commons-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-dev-help@jakarta.apache.org
Re: centralized KEYS file?
Posted by sebb <se...@gmail.com>.
On 14/06/07, Ben Speakmon <bs...@apache.org> wrote:
> > Let's deal with them after we get things merged (which I'm doing right
> > now in fact :) ).
> >
> > What do we do with the above?
>
>
> Getting rid of them is only a problem if they were used to sign a release.
> If so, we need to resign such releases with valid keys before throwing them
> out permanently.
Good point.
However there will be copies of the KEYS files in the dist (and
archive) directories.
One way to deal with this would be to create the KEYS file with all
the entries, and then remove any expired keys that are not used in
current releases. So the key would still be recoverable via SVN and
from the archives.
Just a suggestion.
S
---------------------------------------------------------------------
To unsubscribe, e-mail: commons-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-dev-help@jakarta.apache.org
Re: centralized KEYS file?
Posted by Ben Speakmon <bs...@apache.org>.
> Let's deal with them after we get things merged (which I'm doing right
> now in fact :) ).
>
> What do we do with the above?
Getting rid of them is only a problem if they were used to sign a release.
If so, we need to resign such releases with valid keys before throwing them
out permanently.
Re: centralized KEYS file?
Posted by Henri Yandell <fl...@gmail.com>.
On 6/14/07, sebb <se...@gmail.com> wrote:
> On 13/06/07, Ben Speakmon <bs...@apache.org> wrote:
> > I condensed all KEYS files from dist/jakarta/commons into the file at:
> >
> > http://people.apache.org/~bspeakmon/KEYS-commons-proper.gpg
> >
> > I only removed duplicates and made sure the whole thing imported correctly
> > into my gpg; I didn't try to verify them against a store or check for
> > expiry.
>
> The following have expired:
>
> sub 1024g/6AE82A1A 2003-11-23 [expires: 2005-11-22]
> sig DB00048C 2003-11-23 Tim O'Brien <to...@apache.org>
>
> and
>
> sub 1056g/EF8E1258 2003-08-27 [expires: 2005-08-26]
> sig F2A46D40 2003-08-27 Rob Leland (For Uploading
> Builds/Releases) <rl...@apache.org>
Let's deal with them after we get things merged (which I'm doing right
now in fact :) ).
What do we do with the above?
Hen
---------------------------------------------------------------------
To unsubscribe, e-mail: commons-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-dev-help@jakarta.apache.org
Re: centralized KEYS file?
Posted by sebb <se...@gmail.com>.
On 13/06/07, Ben Speakmon <bs...@apache.org> wrote:
> I condensed all KEYS files from dist/jakarta/commons into the file at:
>
> http://people.apache.org/~bspeakmon/KEYS-commons-proper.gpg
>
> I only removed duplicates and made sure the whole thing imported correctly
> into my gpg; I didn't try to verify them against a store or check for
> expiry.
The following have expired:
sub 1024g/6AE82A1A 2003-11-23 [expires: 2005-11-22]
sig DB00048C 2003-11-23 Tim O'Brien <to...@apache.org>
and
sub 1056g/EF8E1258 2003-08-27 [expires: 2005-08-26]
sig F2A46D40 2003-08-27 Rob Leland (For Uploading
Builds/Releases) <rl...@apache.org>
> Not sure what needs to be done with it from here...?
>
> On 6/12/07, Jochen Wiedmann <jo...@gmail.com> wrote:
> >
> > And replace the current KEYS files with soft links? Dunno how the
> > mirrors handle that.
> >
> >
> > --
> > "Besides, manipulating elections is under penalty of law, resulting in
> > a preventative effect against manipulating elections.
> >
> > The german government justifying the use of electronic voting machines
> > and obviously believing that we don't need a police, because all
> > illegal actions are forbidden.
> >
> > http://dip.bundestag.de/btd/16/051/1605194.pdf
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: commons-dev-unsubscribe@jakarta.apache.org
> > For additional commands, e-mail: commons-dev-help@jakarta.apache.org
> >
> >
>
---------------------------------------------------------------------
To unsubscribe, e-mail: commons-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-dev-help@jakarta.apache.org
Re: centralized KEYS file?
Posted by Ben Speakmon <bs...@apache.org>.
I condensed all KEYS files from dist/jakarta/commons into the file at:
http://people.apache.org/~bspeakmon/KEYS-commons-proper.gpg
I only removed duplicates and made sure the whole thing imported correctly
into my gpg; I didn't try to verify them against a store or check for
expiry.
Not sure what needs to be done with it from here...?
On 6/12/07, Jochen Wiedmann <jo...@gmail.com> wrote:
>
> And replace the current KEYS files with soft links? Dunno how the
> mirrors handle that.
>
>
> --
> "Besides, manipulating elections is under penalty of law, resulting in
> a preventative effect against manipulating elections.
>
> The german government justifying the use of electronic voting machines
> and obviously believing that we don't need a police, because all
> illegal actions are forbidden.
>
> http://dip.bundestag.de/btd/16/051/1605194.pdf
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: commons-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: commons-dev-help@jakarta.apache.org
>
>
Re: centralized KEYS file?
Posted by Jochen Wiedmann <jo...@gmail.com>.
And replace the current KEYS files with soft links? Dunno how the
mirrors handle that.
--
"Besides, manipulating elections is under penalty of law, resulting in
a preventative effect against manipulating elections.
The german government justifying the use of electronic voting machines
and obviously believing that we don't need a police, because all
illegal actions are forbidden.
http://dip.bundestag.de/btd/16/051/1605194.pdf
---------------------------------------------------------------------
To unsubscribe, e-mail: commons-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-dev-help@jakarta.apache.org
Re: centralized KEYS file?
Posted by Rory Winston <rw...@eircom.net>.
+1
---------------------------------------------------------------------
To unsubscribe, e-mail: commons-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-dev-help@jakarta.apache.org
Re: centralized KEYS file?
Posted by Torsten Curdt <tc...@apache.org>.
On 12.06.2007, at 22:53, Dennis Lundberg wrote:
> Ben Speakmon wrote:
>> Would it be a good idea to have one centralized KEYS file for all
>> commons
>> developers? It'd be easier to update, delete or revoke any single
>> key and
>> remove a lot of duplication.
>> I was reviewing the IO 1.3.2 RC and I couldn't find the key Jochen
>> used to
>> sign the release tarballs. I don't see any reason offhand why it
>> shouldn't
>> be in the same place as the keys to verify any other release.
>> Thoughts?
>
> I like the idea of a single KEYS file for commons.
To no surprise this gets my +1 as well ;)
cheers
--
Torsten
---------------------------------------------------------------------
To unsubscribe, e-mail: commons-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-dev-help@jakarta.apache.org
Re: centralized KEYS file?
Posted by Henri Yandell <fl...@gmail.com>.
On 6/12/07, Dennis Lundberg <de...@apache.org> wrote:
> Ben Speakmon wrote:
> > Would it be a good idea to have one centralized KEYS file for all commons
> > developers? It'd be easier to update, delete or revoke any single key and
> > remove a lot of duplication.
> >
> > I was reviewing the IO 1.3.2 RC and I couldn't find the key Jochen used to
> > sign the release tarballs. I don't see any reason offhand why it shouldn't
> > be in the same place as the keys to verify any other release.
> >
> > Thoughts?
> >
>
> I like the idea of a single KEYS file for commons.
+1.
Should be pretty easy to put in place. Concatenate the existing ones,
then modify the downloads.xml in jakarta/site.
Hen
---------------------------------------------------------------------
To unsubscribe, e-mail: commons-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-dev-help@jakarta.apache.org
Re: centralized KEYS file?
Posted by Dennis Lundberg <de...@apache.org>.
Ben Speakmon wrote:
> Would it be a good idea to have one centralized KEYS file for all commons
> developers? It'd be easier to update, delete or revoke any single key and
> remove a lot of duplication.
>
> I was reviewing the IO 1.3.2 RC and I couldn't find the key Jochen used to
> sign the release tarballs. I don't see any reason offhand why it shouldn't
> be in the same place as the keys to verify any other release.
>
> Thoughts?
>
I like the idea of a single KEYS file for commons.
--
Dennis Lundberg
---------------------------------------------------------------------
To unsubscribe, e-mail: commons-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-dev-help@jakarta.apache.org