Mailing-List: contact general-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: general@incubator.apache.org
Received-SPF: neutral (athena.apache.org: local policy)
Message-ID: <f2e8eedf0805310605o6d43f920kfa313a867d026582@mail.gmail.com>
Date: Sat, 31 May 2008 09:05:06 -0400
From: "James Carman" <james@carmanconsulting.com>
Sender: jcarman@carmanconsulting.com
To: general@incubator.apache.org
Subject: Re: enforced signing of artifacts, [was maven repository]
In-Reply-To: <f470f68e0805302233t142d0f3fh19396b3cef95f9f7@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <f470f68e0805300556n6d8c7d76g7fc0a23c06fb619e@mail.gmail.com>
	 <NBBBJGEAGJAKLIDBKJOPAEELEOAD.noel@devtech.com>
	 <2BABBE7D2A66E04DB8A66A527D29927E403DFB@intrepid.infinity.nu>
	 <9e3862d80805301942q897b0f4i9f9fe4b09494628f@mail.gmail.com>
	 <f470f68e0805302233t142d0f3fh19396b3cef95f9f7@mail.gmail.com>

On Sat, May 31, 2008 at 1:33 AM, Robert Burrell Donkin
<robertburrelldonkin@gmail.com> wrote:

> IMO this isn't really a maven issue: basic checks should be performed
> on all releases. i favour a private subversion repository with custom
> hooks for release publishing.

I think it very much is a maven issue.  Maven is the tool that
automatically downloads jar files from the public repository
automagically (I love that by the way).  If there were a setting in
maven that I could set that says "don't add anything to my local maven
repository that isn't signed by someone that I trust", then I think we
would be good here.  I don't know if I'd make it a required feature,
though.  I think making it optional would be okay.  Maven should also
ask you if you want to trust a signer if it hasn't seen it before
(kind of like how webstart does).  Perhaps it could be a three-choice
setting:

1.  Allow any jars from the central repository.
2.  Ask me before allowing jars from someone I haven't specifically
trusted before.
3.  Don't allow any jars signed by people I do not trust.

This, of course, would mean that we should probably set up a release
signing committee so that we only use one signing key from the ASF
(users shouldn't have to say that they trust jars signed by me, and
Robert, and Brett, and Noel).  The members of the committee would be
the only ones with write access to the maven rsync directory.  The
requests could be set up in JIRA or something (hopefully there would
be a committee member on each PMC).

---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org