Mailing-List: contact general-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: general@incubator.apache.org
Received-SPF: pass (athena.apache.org: domain of gscokart@gmail.com designates
 66.249.92.175 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=beta;
        h=received:from:to:subject:date:message-id:mime-version:content-type:content-transfer-encoding:x-mailer:in-reply-to:thread-index:x-mimeole;
        b=CeUWRPf9JrDPpIhTZsKJ0ZHNSCiI8tg7r30a1+BzbrP+Fo9PL0H6JNBCmGuaIvPYb82GETaQ7Ph0I1Ty4ZL6yjcokFjcKR4tGt6TxG3TQHUQFlMc30ijErQA8q1PpxgSOhyhYsF4PoCVfhIMuDEVaSmziyLT/4SX+SqR4Sc+RfA=
From: "Gilles Scokart" <gscokart@gmail.com>
To: <general@incubator.apache.org>
Subject: RE: ASF Web of Trust [was: Release Distribution Strategy]
Date: Mon, 29 Oct 2007 15:30:22 +0100
Message-ID: <04b901c81a38$3e5ad4d0$0920a8c0@isabelteam.be>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
In-Reply-To: <25aac9fc0710290637m3470b829j20d7ee83b85fe622@mail.gmail.com>
Thread-Index: AcgaMZvRwP9JtseYRFuJlnSVjDGDOQABeBhw


> -----Original Message-----
> From: sebb [mailto:sebbaz@gmail.com]
> 
> Even if you can't establish a trust path, the PGP signature gives a
> bit more assurance than a hash. The KEY file should be in SVN, so you
> can ensure that the person that added the key to the KEY file was at
> least a committer to SVN.

That's only for the users who have https access to SVN (and who can reliably verify the SSH key of the server).  The
others have to assume that server from which they are reading the KEY file is the real one.

Gilles


---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org