httpd-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From <...@covalent.net>
Subject Re: Tagging 2.0.17 in a few...
Date Tue, 17 Apr 2001 15:42:47 GMT
> > >
> > > Assuming no KEYS file in the distro, then step (2) can be ignored.
> > >
> > > A KEYS file on the public site (whichever of the bazillion
> > redundant copies)
> > > needs a key, tho.
> >
> >I seriously disagree.  I thought a lot about this before I posted,
> >because I was trying to figure out why the site said you needed the
> >KEYS file to be up-to-date before the tag.  The reason is
> >simple.  If I just downloaded the 2.0.17 tarball, and I want to get
> >the KEYS file, I am going to go to CVS, and grab the one with the
> >2.0.17 tag.
>
> That assumes the user knows something about CVS, and where to find
> the keys file.  It also requires a separate keys file for every
> project.  If there is a central keys file on the web, or at least one
> per project, then the user can just go to that page (probably the
> download page) and get the current keys file.

The ASF is trying to create a single KEYS file, but it takes some time
because of all the signing that needs to be done.  For right now,the KEYS
file is supposed to have the key used to sign the tarball when it is
signed.  The "how to roll a release" page specifically states that.

Ryan

_______________________________________________________________________________
Ryan Bloom                        	rbb@apache.org
406 29th St.
San Francisco, CA 94131
-------------------------------------------------------------------------------


Mime
View raw message