new KEYS scheme? (Was: Re: [VOTE] Release Apache Bloodhound 0.4 (incubating))

[Gary Martin <ga...@wandisco.com>]

On 15/01/13 06:22, Ryan Ollos wrote:
> On Mon, Jan 14, 2013 at 9:23 PM, Branko Čibej <br...@wandisco.com> wrote:
>
>> +1
>>
> Can I count you as a binding vote?
>
>
>> Very nice. I see you remove trac/contrib when creating the tarball,
>> which is good. Installed in 5 minutes on my Mac, too.
>>
>> Only one nit: the release manager's PGP key is not in KEYS. Ryan, you
>> should add it; as far as I'm concerned it's OK to just fix the KEYS file
>> in the dist tree, since that won't be changing the packages or checksums
>> in any way.
>>
> Thanks, I will add my key. Gary had mentioned this might be needed. I'll
> also add a note to the Release Process wiki page about this.

Yeah, I vaguely remembered something about a new way of listing the 
keys. Presumably, that is something to do with what this file: 
https://people.apache.org/keys/group/bloodhound.asc

I don't know if there is a plan to make this even less work but I think 
we could probably keep the KEYS file up to date by:

    wget -O KEYS https://people.apache.org/keys/group/bloodhound.asc

and committing any changes.

Does anyone know more about all this though? I didn't see any mention 
about this in http://www.apache.org/dev/release-signing.html so I am not 
sure it is likely that new incubator projects will pick up on this.

Cheers,
     Gary

Re: new KEYS scheme? (Was: Re: [VOTE] Release Apache Bloodhound 0.4 (incubating))

[Gary Martin <ga...@wandisco.com>]

On 15/01/13 10:56, Nick Burch wrote:
> On Tue, 15 Jan 2013, Gary Martin wrote:
>> I don't know if there is a plan to make this even less work but I 
>> think we could probably keep the KEYS file up to date by:
>>
>>   wget -O KEYS https://people.apache.org/keys/group/bloodhound.asc
>>
>> and committing any changes.
>>
>> Does anyone know more about all this though?
>
> There has been some discussions about this in the last few weeks (most 
> on the infrastructure list, if memory serves). As long as everyone has 
> their current key in LDAP, then that's a good way to keep the list 
> current. However, the KEYs file should generally also contain the list 
> of past keys too, so people can use it to verify old releases too. To 
> that end, you probably want to use the LDAP generated keys file to 
> append to your keys list, not replace it, so the old keys remain there 
> too. It's a few more steps than just a wget+commit, but not many!
>
> Nick

Ah, thanks for that; good point there. It may not be hugely complicated 
but I might write a script to do the job so that we don't have to worry 
too much about manually working out which entries are new and which are 
no longer in the bloodhound.asc file.

Cheers,
     Gary

Re: new KEYS scheme? (Was: Re: [VOTE] Release Apache Bloodhound 0.4 (incubating))

[Nick Burch <ap...@gagravarr.org>]

On Tue, 15 Jan 2013, Gary Martin wrote:
> I don't know if there is a plan to make this even less work but I think we 
> could probably keep the KEYS file up to date by:
>
>   wget -O KEYS https://people.apache.org/keys/group/bloodhound.asc
>
> and committing any changes.
>
> Does anyone know more about all this though?

There has been some discussions about this in the last few weeks (most on 
the infrastructure list, if memory serves). As long as everyone has their 
current key in LDAP, then that's a good way to keep the list current. 
However, the KEYs file should generally also contain the list of past keys 
too, so people can use it to verify old releases too. To that end, you 
probably want to use the LDAP generated keys file to append to your keys 
list, not replace it, so the old keys remain there too. It's a few more 
steps than just a wget+commit, but not many!

Nick