[jira] [Commented] (AMBARI-4075) Download pages must use ASF mirror system for current releases

["Sebb (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/AMBARI-4075?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14366035#comment-14366035 ] 

Sebb commented on AMBARI-4075:
------------------------------

I don't understand why the KEYS file still has not been created and uploaded.

There must be copies of the public keys somewhere otherwise how could anyone on the PMC check the .asc files when reviewing the release artifacts?

At present it is not possible for consumers to verify the downloads. Consumers must be given access to the KEYS file.

> Download pages must use ASF mirror system for current releases
> --------------------------------------------------------------
>
>                 Key: AMBARI-4075
>                 URL: https://issues.apache.org/jira/browse/AMBARI-4075
>             Project: Ambari
>          Issue Type: Bug
>            Reporter: Sebb
>            Assignee: Jaimin D Jetly
>            Priority: Critical
>             Fix For: 2.1.0
>
>
> The Ambari download links currently point directly to the ASF servers, for example:
> http://www.apache.org/dist/incubator/ambari/ambari-1.4.1/
> This is not allowed. Downloads MUST use the ASF mirroring system.
> Also, only the current release(s) should be available from the mirrors.
> Older (non-maintained) releases should be linked from the ASF archive server.
> Please read:
> http://www.apache.org/dev/release.html
> The folllowing need fixing:
> - change all download links for older releases to use the archive server
> - remove all the older releases from SVN [1]
> - change the current release download links to use the mirror system [2]
> [1] https://dist.apache.org/repos/dist/release/incubator/ambari/
> [2] http://www.apache.org/dev/release-download-pages



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)