directory-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Stefano Bagnara <apa...@bago.org>
Subject Links to GPG signature (Was: Adding some google analytics to our downloads)
Date Wed, 12 Sep 2007 16:31:32 GMT
Not related to Google Analytics, but I cannot see anywhere a place where
you suggest users to verify their downloads (and links to the PGP/MD5
files) and maybe you can fix this while you're there.

here is the text we use in Apache JAMES:
--------------
Use the links below to download the Apache JAMES Mail Server from one of
our mirrors. You *must* verify the integrity of the downloaded files
using signatures downloaded from our main distribution directory.
----------------------
Then verify the integrity points to this paragraph:
-------------------------
Verify the integrity of the files
It is essential that you verify the integrity of the downloaded files
using the PGP or MD5 signatures. The PGP signatures can be verified
using PGP or GPG. First download the KEYS as well as the asc signature
file for the particular distribution. Make sure you get these files from
the main distribution directory, rather than from a mirror. Then verify
the signatures using % pgpk -a KEYS
% pgpv james-version.tar.gz.asc
or
% pgp -ka KEYS
% pgp james-version.tar.gz.asc
or
% gpg --import KEYS
% gpg --verify james-version.tar.gz.asc
-------------------------------

Also make sure you provide the MD5 and PGP links to the official main
ASF distribution site (www.apache.org/dist/).

As far as I know ASF *requires* signing for releases and strongly
suggest to "incentivate" users to verify downloads.

HTH,
Stefano

Emmanuel Lecharny ha scritto:
> This is perfect !
> 
> let's see what will be the stats starting from today :)
> 
> On 9/12/07, Pierre-Arnaud Marcelot <pa@marcelot.net> wrote:
>> Hey Guys,
>>
>> I've prepared a new download page that can be tracked by Google Analytics.
>>
>> I've re-used the cgi script of the Apache Download Mirrors, the one that is
>> used at the moment to download releases.
>> But I have used our website template...
>> So now, we can track our visitors when they download something and the page
>> they get when trying to download something looks exactly the same as our
>> website.
>>
>> It's as easy to use as is the current download system.
>> Before, to link a download, you would use this url:
>> http://www.apache.org/dyn/closer.cgi/directory/studio/stable/1.0.0/Apache_Directory_Studio_1.0.0_MacOSX.dmg
>> Now, you could use this one:
>> http://directory.apache.org/studio/download/download.cgi/directory/studio/stable/1.0.0/Apache_Directory_Studio_1.0.0_MacOSX.dmg
>>
>> (To view the last url properly, you may need to use the proxy
>> 140.211.11.10:80, as the page may not be rsynced yet on the website
>> mirrors).
>>
>> WDYT ?
>>
>> P-A
>>
>>
>>
>> On 9/11/07, Emmanuel Lecharny <elecharny@gmail.com> wrote:
>>> Thanks Stefano !
>>>
>>> We will try to add those scripts to our confluenc WIKI.
>>>
>>> On 9/11/07, Stefano Bagnara <apache@bago.org> wrote:
>>>> Emmanuel Lecharny ha scritto:
>>>>> Hi,
>>>>>
>>>>> we can't currently use GA to count the number of server downloads,
>>>>> because the link is on a dynamic server (a mirror).
>>>>>
>>>>> We should create a page where we redirect to these dynamic pages, so
>>>>> that we can have a GA count.
>>>>>
>>>>> Who want to do that ?
>>>>>
>>>>> Thanks !
>>>>
>>>> In Apache JAMES I added a javascript tracking to the download links.
>>>> As we generate the pages using maven I added it to our skin.
>>>>
>>>> Here is the javascript that automatically track every link to gz, bz2,
>>>> zip, jar, asc, sar files. Please note that the trackDownloads methods
>>>> include the JAMES specific way to find the common part of the path in
>>>> mirror strings so that they are rewritten to
>> /downloads/relativefilepaths.
>>>> ---------------------
>>>> <script type="text/javascript">
>>>> if (document.getElementsByTagName) {
>>>>   var hrefs = document.getElementsByTagName('a');
>>>>   var extensions =
>> ["gz","bz2","zip","jar","asc","sar"];
>>>>   for (var l = 0; l < hrefs.length; l++) {
>>>>     // 0+ is a workaround for download.cgi script by ASF that
>>>>     // is not happy with simple words in square brackets
>>>>     if (hrefs[0+l] != "") {
>>>>       var path = hrefs[0+l].pathname;
>>>>       var external = hrefs[0+l].hostname != location.host;
>>>>       if (external) {
>>>>         var splitted = path.split('.');
>>>>         var ext = splitted[0+splitted.length-1];
>>>>         for (var e = 0; e < extensions.length; e++) {
>>>>           if (extensions[0+e] == ext) {
>>>>
>> startListening(hrefs[0+l],"click",trackDownloads);
>>>>           }
>>>>         }
>>>>       }
>>>>     }
>>>>   }
>>>> }
>>>>
>>>> function startListening (obj,evnt,func) {
>>>>   if (obj.addEventListener) {
>>>>     obj.addEventListener(evnt,func,false);
>>>>   } else if ( obj.attachEvent) {
>>>>     obj.attachEvent("on" + evnt,func);
>>>>   }
>>>> }
>>>>
>>>> function trackDownloads (evnt) {
>>>>   var lnk;
>>>>   if (evnt.srcElement) {
>>>>     var elmnt = evnt.srcElement;
>>>>     while (elmnt.tagName != "A") {
>>>>       var newelmnt = elmnt.parentNode;
>>>>       elmnt = newelmnt;
>>>>     }
>>>>     lnk = elmnt.hostname + "/" + elmnt.pathname + elmnt.search;
>>>>   } else {
>>>>     lnk = this.hostname + this.pathname + this.search;
>>>>   }
>>>>
>>>>   var pos = lnk.indexOf("/james/");
>>>>   if (pos != -1) {
>>>>     lnk = lnk.substr (pos+7);
>>>>   }
>>>>   lnk = "/downloads/"+lnk;
>>>>
>>>>   if (typeof(urchinTracker) == "function") {
>>>>     urchinTracker(lnk);
>>>>   }
>>>> }
>>>> </script>
>>>> ------------------------------------
>>>>
>>>> Hope this helps,
>>>> Stefano
>>>>
>>>>
>>>
>>> --
>>> Regards,
>>> Cordialement,
>>> Emmanuel L├ęcharny
>>> www.iktek.com
>>>
>>
> 
> 



Mime
View raw message