Mailing-List: contact general-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: general@incubator.apache.org
Received-SPF: pass (athena.apache.org: domain of robertburrelldonkin@gmail.com
 designates 64.233.184.227 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
        b=ltU3z2EYm6Bcy1I0jP+Nv18Luv3C2D/1BJUyLEoqlt3+XjlXmue6+op/dRQYVeWxmXnaOjoNueZ0ZIsHnMj2TC7zzxPu48mOG9icCtrZBz4gbsZt35X/8f+5a1pY/Kur5dcS6ovy5ZRL9R4AU+QSvujWEqBSG6F+w44R3K1+t14=
Message-ID: <f470f68e0806030439j2bd2523aofce99478f0f618d1@mail.gmail.com>
Date: Tue, 3 Jun 2008 12:39:38 +0100
From: "Robert Burrell Donkin" <robertburrelldonkin@gmail.com>
To: general@incubator.apache.org
Subject: Re: enforced signing of artifacts, [was maven repository]
In-Reply-To: <e9d8a2610806030341q636db8ffw69a3b2a8998dcefc@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <e9d8a2610806012358i397edbadl318d3536ca661018@mail.gmail.com>
	 <NBBBJGEAGJAKLIDBKJOPEEEBEPAD.noel@devtech.com>
	 <e9d8a2610806030341q636db8ffw69a3b2a8998dcefc@mail.gmail.com>

On 6/3/08, Gilles Scokart <gscokart@gmail.com> wrote:
> I thought this thread started with the idea : if maven would be able
> to validate signature, we could use this feature to inform someone
> that he is using incubator artefacts.
> I thought the idea that launched this thread was to have a unique key
> for the incubator that the user has as to trust if he want to use
> incubator artefacts.

Stated like that then the artifact would need to be encrypted
> My question was in that context.

AIUI maven decided against enforcing download verification. So
requires the maven team developing this feature first.

Robert
>
> 2008/6/2 Noel J. Bergman <noel@devtech.com>:
>> Gilles Scokart wrote:
>>
>>> Noel J. Bergman:
>>> > Implement that, and we're fine.  We will
>>> > require Incubator artifacts to be signed by a designated key available
>> to
>>> > the PMC, and once a user has acknowledged that they accept such
>> Incubator
>>> > signed artifacts, maven can do what it wants with them.
>>>
>>>        --- Noel
>>
>>> Is that really possible?
>>
>> Very.
>>
>>> I remember some discussion on the infra list about an ASF wide signature.
>>> And the conclusion was always the same: how to secure a key that can be
>>> used by so many people.  If I remember well, some solution were proposed,
>>> but they were quiet heavy.  Do we have a solution for that?
>>
>> There are various things that can be done with respect to key management.
>> Personally, I would not go with a single key.  But maven ought to maintain
>> a
>> trust file, with options to accept files that are signed with a trusted
>> key,
>> or signed by a key that is signed by a trusted key, etc.  The first thing
>> that has to happen is for the Maven PMC to make security a priority.
>>
>>        --- Noel
>>
>
> --
> Gilles Scokart
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
>
>

---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org