[jira] [Created] (REEF-1021) Spurious file in https://dist.apache.org/repos/dist/release/incubator/reef/

["Sebb (JIRA)" <ji...@apache.org>]

Sebb created REEF-1021:
--------------------------

             Summary: Spurious file in https://dist.apache.org/repos/dist/release/incubator/reef/
                 Key: REEF-1021
                 URL: https://issues.apache.org/jira/browse/REEF-1021
             Project: REEF
          Issue Type: Bug
         Environment: https://dist.apache.org/repos/dist/release/incubator/reef/
            Reporter: Sebb


The directory https://dist.apache.org/repos/dist/release/incubator/reef/ contains the file:

download-keys.sh

This does not belong on the ASF mirror system.
Also the script is not suitable for downloading KEYS.
The file https://people.apache.org/keys/group/reef.asc is not guaranteed to contain all the keys needed to validate a signature, because the file only contains the current keys for the current members of the PPMC. However the KEYS file is also used for checking archived releases so must contain all keys that have ever been used to sign a release.

Please remove the script file, and ensure that the KEYS file contains all the keys for every ASF release that has been made. Entries should never be dropped from KEYS files if they have been used to sign a release.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)