Two KEYS files for Tomcat-5?

[Stefan Bodewig <bo...@apache.org>]

Hi,

we've recently had a mail to security@apache.org by a user who claimed
he couldn't verify Remy's signature for the latest Tomcat-5 release,
even after importing the KEYS file.

I went to the distribution area in order to reproduce the problem and
found that there are two different KEYS files, one in .../tomcat-5 and
one in .../tomcat-5/v5.0.19 and those two files are different.  What's
even worse is that the file in .../tomcat-5/v5.0.19 contains a key for
Remy that is different from the one being used to sign the
distribution, but doesn't contain the key he used.

Could you please merge the two files and ensure that the "correct"
keys get into it?

Thanks

        Stefan

---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org