Return-Path: <cvs-return-60613-archive-asf-public=cust-asf.ponee.io@httpd.apache.org>
X-Original-To: archive-asf-public-internal@cust-asf2.ponee.io
Delivered-To: archive-asf-public-internal@cust-asf2.ponee.io
Received: from cust-asf.ponee.io (cust-asf.ponee.io [163.172.22.183])
	by cust-asf2.ponee.io (Postfix) with ESMTP id B2D64200C65
	for <archive-asf-public-internal@cust-asf2.ponee.io>; Sat, 29 Apr 2017 16:36:55 +0200 (CEST)
Received: by cust-asf.ponee.io (Postfix)
	id B166C160BA9; Sat, 29 Apr 2017 14:36:55 +0000 (UTC)
Delivered-To: archive-asf-public@cust-asf.ponee.io
Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
	by cust-asf.ponee.io (Postfix) with SMTP id 03FAD160BA0
	for <archive-asf-public@cust-asf.ponee.io>; Sat, 29 Apr 2017 16:36:54 +0200 (CEST)
Received: (qmail 9556 invoked by uid 500); 29 Apr 2017 14:36:54 -0000
Mailing-List: contact cvs-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
list-help: <mailto:cvs-help@httpd.apache.org>
list-unsubscribe: <mailto:cvs-unsubscribe@httpd.apache.org>
List-Post: <mailto:cvs@httpd.apache.org>
List-Id: <cvs.httpd.apache.org>
Delivered-To: mailing list cvs@httpd.apache.org
Received: (qmail 9547 invoked by uid 99); 29 Apr 2017 14:36:54 -0000
Received: from Unknown (HELO svn01-us-west.apache.org) (209.188.14.144)
    by apache.org (qpsmtpd/0.29) with ESMTP; Sat, 29 Apr 2017 14:36:54 +0000
Received: from svn01-us-west.apache.org (localhost [127.0.0.1])
	by svn01-us-west.apache.org (ASF Mail Server at svn01-us-west.apache.org) with ESMTP id 9F1C83A1965
	for <cvs@httpd.apache.org>; Sat, 29 Apr 2017 14:36:53 +0000 (UTC)
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: svn commit: r1011384 - in /websites/staging/httpd/trunk/content: ./
 dev/verification.html
Date: Sat, 29 Apr 2017 14:36:53 -0000
To: cvs@httpd.apache.org
From: buildbot@apache.org
X-Mailer: svnmailer-1.0.9
Message-Id: <20170429143653.9F1C83A1965@svn01-us-west.apache.org>
archived-at: Sat, 29 Apr 2017 14:36:55 -0000

Author: buildbot
Date: Sat Apr 29 14:36:53 2017
New Revision: 1011384

Log:
Staging update by buildbot for httpd

Modified:
    websites/staging/httpd/trunk/content/   (props changed)
    websites/staging/httpd/trunk/content/dev/verification.html

Propchange: websites/staging/httpd/trunk/content/
------------------------------------------------------------------------------
--- cms:source-revision (original)
+++ cms:source-revision Sat Apr 29 14:36:53 2017
@@ -1 +1 @@
-1793202
+1793205

Modified: websites/staging/httpd/trunk/content/dev/verification.html
==============================================================================
--- websites/staging/httpd/trunk/content/dev/verification.html (original)
+++ websites/staging/httpd/trunk/content/dev/verification.html Sat Apr 29 14:36:53 2017
@@ -147,7 +147,7 @@ together, so you should be able to conne
 </pre></div>
 
 
-<p>In this example, you have now received two public keys for an entity known
+<p>In this example, you have now received two public keys for entities known
 as 'Jim Jagielski &lt;jim@apache.org&gt;' However, you have no way of
 verifying whether these keys were created by the person known as Jim
 Jagielski whose email address is claimed.  In fact, one of them is
@@ -182,27 +182,21 @@ Then, if you tried to verify the signatu
 would succeed because the key was not the 'real' key. Therefore, you need
 to validate the authenticity of this key.</p>
 <h1 id="Validating">Validating Authenticity of a Key<a class="headerlink" href="#Validating" title="Permanent link">&para;</a></h1>
-<p>There are two ways to validate Jim's key.  The really secure way
+<p>The crucial step to validation is to confirm the key fingerprint of the
+public key.  We saw the fingerprint when we verified the download: it's
+A93D 62EC C3C8 EA12 DB22  0EC9 34EA 76E6 7914 85A8</p>
+<p>There are two ways to validate Jim's fingerprint.  The really secure way
 (described below) is using the PGP "Web of Trust", which will give
 you a cryptographically-strong chain of trust to Jim's key.
 However, if you are new to PGP, this takes some time and effort.
 A shortcut to a reasonable level of security is to check Jim's
 fingerprint (using https, not http) against the database maintained
 by the Apache foundation of Apache developers' fingerprints at
-https://people.apache.org/keys/committer/</p>
-<p>The crucial step to validation is to confirm the key fingerprint of the
-public key.</p>
-<div class="codehilite"><pre><span class="c">% gpg --fingerprint 791485A8</span>
-<span class="n">pub</span>   4096<span class="n">R</span><span class="o">/</span>791485<span class="n">A8</span> 2010<span class="o">-</span>11<span class="o">-</span>04 2002<span class="o">-</span>04<span class="o">-</span>10 
-      <span class="n">Key</span> <span class="n">fingerprint</span> <span class="p">=</span> <span class="n">A93D</span> 62<span class="n">EC</span> <span class="n">C3C8</span> <span class="n">EA12</span> <span class="n">DB22</span>  0<span class="n">EC9</span> 34<span class="n">EA</span> 76<span class="n">E6</span> 7914 85<span class="n">A8</span>
-<span class="n">uid</span>                  <span class="n">Jim</span> <span class="n">Jagielski</span> <span class="p">(</span><span class="n">Release</span> <span class="n">Signing</span> <span class="n">Key</span><span class="p">)</span> <span class="o">&lt;</span><span class="n">jim</span><span class="p">@</span><span class="n">apache</span><span class="p">.</span><span class="n">org</span><span class="o">&gt;</span>
-<span class="n">uid</span>                  <span class="n">Jim</span> <span class="n">Jagielski</span> <span class="o">&lt;</span><span class="n">jim</span><span class="p">@</span><span class="n">jimjag</span><span class="p">.</span><span class="n">com</span><span class="o">&gt;</span>
-<span class="n">uid</span>                  <span class="n">Jim</span> <span class="n">Jagielski</span> <span class="o">&lt;</span><span class="n">jim</span><span class="p">@</span><span class="n">jaguNET</span><span class="p">.</span><span class="n">com</span><span class="o">&gt;</span>
-<span class="n">uid</span>                  <span class="n">Jim</span> <span class="n">Jagielski</span> <span class="o">&lt;</span><span class="n">jimjag</span><span class="p">@</span><span class="n">gmail</span><span class="p">.</span><span class="n">com</span><span class="o">&gt;</span>
-<span class="n">sub</span>   4096<span class="n">R</span><span class="o">/</span>9<span class="n">B6D9BF7</span> 2010<span class="o">-</span>11<span class="o">-</span>04
-</pre></div>
-
-
+https://people.apache.org/keys/committer/ .
+Note that this shortcut fails catastrophically if the Apache website is
+ever compromised, or if an imposter breaks HTTPS security by obtaining
+a fake certificate and impersonates the site.  Be sure to keep an eye
+on the techie press for news stories of any such event!</p>
 <p>A good start to validating a key is by face-to-face communication with
 multiple government-issued photo identification confirmations. However,
 each person is free to have their own standards for determining the