Verify signature for BookKeeper releases

[Enrico Olivelli <eo...@gmail.com>]

Hi all,
While developing the Docker image Francesco noticed that it is not
very clear how to find the official signature of BookKeeper release

If an user browses to:
http://bookkeeper.apache.org/releases.html#download
gets to:
http://www.apache.org/dyn/closer.cgi/bookkeeper

and there is a suggestion to verify the signature
https://www.apache.org/info/verification.html

but actually I can find the .asc files only in this official repo,
which is not easy to find:
http://apache.org/dist/bookkeeper/bookkeeper-4.4.0/

and this is the official "KEYS" file
http://apache.org/dist/bookkeeper/KEYS

Maybe we can make it more clear for users to look for the signature

Is there some piece I am missing ?


-- Enrico

Re: Verify signature for BookKeeper releases

[Sijie Guo <gu...@gmail.com>]

Sounds like a documentation improvement on Download/Release pages?

- Sijie

On Tue, Jun 20, 2017 at 3:30 AM, Enrico Olivelli <eo...@gmail.com>
wrote:

> Hi all,
> While developing the Docker image Francesco noticed that it is not
> very clear how to find the official signature of BookKeeper release
>
> If an user browses to:
> http://bookkeeper.apache.org/releases.html#download
> gets to:
> http://www.apache.org/dyn/closer.cgi/bookkeeper
>
> and there is a suggestion to verify the signature
> https://www.apache.org/info/verification.html
>
> but actually I can find the .asc files only in this official repo,
> which is not easy to find:
> http://apache.org/dist/bookkeeper/bookkeeper-4.4.0/
>
> and this is the official "KEYS" file
> http://apache.org/dist/bookkeeper/KEYS
>
> Maybe we can make it more clear for users to look for the signature
>
> Is there some piece I am missing ?
>
>
> -- Enrico
>