Mailing-List: contact dev-help@commons.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Commons Developers List" <dev@commons.apache.org>
Received-SPF: pass (athena.apache.org: domain of grobmeier@gmail.com
 designates 209.85.220.169 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:from:date:message-id:subject:to
         :content-type:content-transfer-encoding;
        b=d+9cBUP3AVdFUEM93Gk47dU9KDUmdl6Clef5r5tIelpQLeohSOKw4tx+CX0cJFmBhq
         AJcB01yuMD3y8e5BPoUB1lqKAwphB7Uxn/cVTYmmr8TUhxzvVoSRsU0IpO5jBxpLjmQZ
         j2gx46xdJPMj0bh1dGwDtYES/JN3NdgQez5+I=
MIME-Version: 1.0
In-Reply-To: <25aac9fc0905060357t583978cfs9619fcd1d20880fa@mail.gmail.com>
References: <ded132f10905050641q20a78781y6ddf07a62af24ffa@mail.gmail.com>
	<4A007298.9050104@it20one.at>
 <25aac9fc0905051420n55a2c0fdo1740b45e26266279@mail.gmail.com>
	<ded132f10905052242p2f730936s78c22caa637c06d5@mail.gmail.com>
	<91548FF2-C7CF-4F06-A8A8-523B21DF333D@SUN.com>
 <ded132f10905052335u20d583dfi413341eca8c16624@mail.gmail.com>
	<25aac9fc0905060333v3153f35au23f840ab433a91e8@mail.gmail.com>
	<ded132f10905060345q2157c013i50f70f472470a725@mail.gmail.com>
	<25aac9fc0905060357t583978cfs9619fcd1d20880fa@mail.gmail.com>
From: Christian Grobmeier <grobmeier@gmail.com>
Date: Wed, 6 May 2009 14:29:53 +0200
Message-ID: <ded132f10905060529h4bbe4162u6fb8e8bd4a9a3a40@mail.gmail.com>
Subject: Re: [releasing] PGP keys for code signing
To: Commons Developers List <dev@commons.apache.org>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

>> http://people.apache.org/~grobmeier/test/grobmeier-codesigning.pub
>
> Thanks, that has allowed me to check the signature. Validates OK.

Cool!

> However I was unable to download the key from a keyserver - maybe
> there was a problem with the server I was using.

Strange... I uploaded it to: pgp.mit.edu and to subkeys.pgp.net
Its available by webinterface from mit, but not from pgg.net.

>> =C2=A0> It will need to be added to KEYS at some point if you are to use=
 it.
>>
>> Yes. I didn't understood when a key is beeing considered "trusted" at ap=
ache.
>
> See:  http://www.apache.org/dev/release-signing.html
> In theory, all ASF keys should be connected in a web of trust, however
> that is not the case.

OK. Thats the point which confused me.

> But at least if your key is in the KEYS file it shows that it was
> trusted by the person updating the file, and that person must have had
> commit access.

OK, I will add my key to the KEYS file then and go ahead :-)
Thanks for your help!

Christian

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org