Mailing-List: contact general-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: general@incubator.apache.org
Received-SPF: pass (athena.apache.org: domain of robertburrelldonkin@gmail.com
 designates 209.85.200.172 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
        b=UacY7VD/mbL9j9qDYO+7bhBOrURSkTs8/6yLkjlDtBXN9aCBvm8iqTHczZJlbUIMJfEd3tZ7FrcYnSGOm/PbC4/VdYQ9pqwot6X2fcqsjNueKbI9iDu+yMUaOt43HQQd6jhTCKG7LQ7XI3ZWP6PfsPYXAekMFnzAh2ZoqwYkjDA=
Message-ID: <f470f68e0805302253n20ae2ad1xb81b7915d0fede38@mail.gmail.com>
Date: Sat, 31 May 2008 06:53:55 +0100
From: "Robert Burrell Donkin" <robertburrelldonkin@gmail.com>
To: general@incubator.apache.org
Subject: Re: maven repository
In-Reply-To: <NBBBJGEAGJAKLIDBKJOPEEICEOAD.noel@devtech.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <9e3862d80805301916q4554755fl1662c385929c5d48@mail.gmail.com>
	 <NBBBJGEAGJAKLIDBKJOPEEICEOAD.noel@devtech.com>

On Sat, May 31, 2008 at 3:30 AM, Noel J. Bergman <noel@devtech.com> wrote:
> Brett Porter wrote:
>
>> Noel J. Bergman:
>> > I really don't care what cuts across the grain of Maven.  I do care
> about
>> > the established principle that people must make a deliberate decision to
> use
>> > Incubator artifacts.  If Maven would finally support enforcing signing
> of
>> > artifacts, as they have been asked to do for years, we could use an
>> > Incubator-specific signing key, forcing people to approve the use of
>> > Incubator artifacts, regardless of download location.
>
>> You're asking for it to enforce the use of signed artifacts out of the
>> box, not enforce signing.
>
> Yes.  As noted in my reply to Brian E. Fox in his renamed thread "enforced
> signing of artifacts".

i've talked at length about this before (IIRC with brett and others)
and done quite a bit of thinking. it is a much more general issue than
just maven. one signature isn't good enough. it would be good for
maven to lead the way but IMO we need a comprehensive solution for all
apache releases.

- robert

---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org