You are viewing a plain text version of this content. The canonical link for it is here.
Posted to general@xml.apache.org by Shane Curcuru <sh...@yahoo.com> on 2003/09/13 03:37:09 UTC
Getting all projects to sign releases - Forrest, Xindice
Is it just me, or don't we have a policy that all software distributions
should be PGP/GPG or equivalently signed with the release manager's key? 8-)
Admittedly, plus points to Forrest and Xindice since they've already moved
their distributions to the mirroring system at
www.apache.org/dist/xml/[subproject]. But I'd really like to see future
releases also get signed before they're put on the distro site.
Thanks,
Shane
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@xml.apache.org
For additional commands, e-mail: general-help@xml.apache.org
Re: Getting all projects to sign releases - Forrest, Xindice
Posted by Jeff Turner <je...@apache.org>.
On Fri, Sep 12, 2003 at 09:37:09PM -0400, Shane Curcuru wrote:
> Is it just me, or don't we have a policy that all software distributions
> should be PGP/GPG or equivalently signed with the release manager's key?
> 8-)
>
> Admittedly, plus points to Forrest and Xindice since they've already moved
> their distributions to the mirroring system at
> www.apache.org/dist/xml/[subproject]. But I'd really like to see future
> releases also get signed before they're put on the distro site.
The latest Forrest 0.5 release has been signed:
-bash-2.05b$ pwd
/www/www.apache.org/dist/xml/forrest
-bash-2.05b$ pgp < KEYS
...
...
-bash-2.05b$ pgp apache-forrest-current-bin.tar.gz.asc apache-forrest-current-bin.tar.gz
Pretty Good Privacy(tm) Version 6.5.8
Internal development version only - not for general release.
(c) 1999 Network Associates Inc.
Export of this software may be restricted by the U.S. government.
File 'apache-forrest-current-bin.tar.gz.asc' has signature, but with no text.
Text is assumed to be in file 'apache-forrest-current-bin.tar.gz'.
Good signature from user "Jeff Turner <je...@apache.org>".
Signature made 2003/09/13 04:42 GMT
WARNING: Because this public key is not certified with a trusted
signature, it is not known with high confidence that this public key
actually belongs to: "Jeff Turner <je...@apache.org>".
--Jeff
>
> Thanks,
> Shane
>
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@xml.apache.org
For additional commands, e-mail: general-help@xml.apache.org
Re: Getting all projects to sign releases - Forrest, Xindice
Posted by Tetsuya Kitahata <te...@apache.org>.
On Sat, 13 Sep 2003 11:41:10 -0700
Ted Leung <tw...@sauria.com> wrote:
> But we also need to work on getting our keyrings / web of trust built
> out. If people are at ApacheCon it will help. Also, if people can sign
> keys of people that they know when they see them face to face, that will
> help as well.
Ditto:
> There are now good tools for doing GPG (as well as PGP Freeware) on
> Windows -- Look at the Enigmail plugin to Mozilla and Thunderbird as an
> example. That's why you'll be seeing more signed messages from me on
> "official" matters...
Agreed. I think it would be better for us to use
PGP signatured e-mails when you all announcement your
news at announce@apache.org (The ASF-Wide announcement list).
Also:
When you make an announcement to announce@apache.org,
it would be recommended of you to put 3-5 lines blurb
of the projects.
http://www.apache.org/foundation/mailinglists.html#foundation-announce
Hope this helps.
Sincerely,
__ Tetsuya <te...@apache.org> __
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@xml.apache.org
For additional commands, e-mail: general-help@xml.apache.org
Re: Getting all projects to sign releases - Forrest, Xindice
Posted by Ted Leung <tw...@sauria.com>.
On 9/12/2003 6:37 PM, Shane Curcuru wrote:
> Is it just me, or don't we have a policy that all software
> distributions should be PGP/GPG or equivalently signed with the
> release manager's key? 8-)
>
> Admittedly, plus points to Forrest and Xindice since they've already
> moved their distributions to the mirroring system at
> www.apache.org/dist/xml/[subproject]. But I'd really like to see
> future releases also get signed before they're put on the distro site.
>
+1
But we also need to work on getting our keyrings / web of trust built
out. If people are at ApacheCon it will help. Also, if people can sign
keys of people that they know when they see them face to face, that will
help as well.
There are now good tools for doing GPG (as well as PGP Freeware) on
Windows -- Look at the Enigmail plugin to Mozilla and Thunderbird as an
example. That's why you'll be seeing more signed messages from me on
"official" matters...
Ted
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@xml.apache.org
For additional commands, e-mail: general-help@xml.apache.org
Re: Getting all projects to sign releases - Forrest, Xindice
Posted by Berin Lautenbach <be...@ozemail.com.au>.
Shane,
No it's not just you, and it's particularly important now that we are
moving to the mirrors as we don't have control over the majority of the
distribution points now.
Xindice has an Md-5 hash which can be read from www.apache.org/dist
which will do the trick until the next release.
I just checked the dist directory and it looks like Jeff is right in the
middle of uploading a new version of forrest with PGP signatures :>.
Cheers,
Berin
Shane Curcuru wrote:
> Is it just me, or don't we have a policy that all software distributions
> should be PGP/GPG or equivalently signed with the release manager's
> key? 8-)
>
> Admittedly, plus points to Forrest and Xindice since they've already
> moved their distributions to the mirroring system at
> www.apache.org/dist/xml/[subproject]. But I'd really like to see future
> releases also get signed before they're put on the distro site.
>
> Thanks,
> Shane
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@xml.apache.org
> For additional commands, e-mail: general-help@xml.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@xml.apache.org
For additional commands, e-mail: general-help@xml.apache.org